{ "Event": { "published": true, "date": "2026-05-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-28", "timestamp": 1780012982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3378e23b-937c-43a4-8583-6a65ea88fb1c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a0f2f4-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973552, "uuid": "7835d469-6ec5-44f3-9c3c-ee004c533dbf", "comment": "Malware payload (Mirai)", "value": "8cbd970afc1a442768ec7730b26b9f02", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973552, "uuid": "25fcbc69-500f-4119-956f-61e79c80ee7a", "comment": "Malware payload (Mirai)", "value": "0001a7e82ccc41a89d7792159ce3e936a91dbe8ce2781edd742ea0943c84093d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973552, "uuid": "7bfd2d82-5aae-4f8c-a712-7567c8ef7d6d", "comment": "Malware payload (Mirai)", "value": "9449206ef8a8639c2b8178f653bc8f54d4652fd1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973552, "uuid": "2e380039-8db8-464d-8c7c-10677c0a056a", "comment": "Malware payload (Mirai)", "value": "840274afb186ea03b60cf9d14643863efed4358c378fbd0229681f5b6d8767ee0dba8ad6c04735cf41007a299a3ed27e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973552, "uuid": "f9715c38-cb1e-4a59-9274-cfa83b70de91", "value": "T1D2C32B73A61C0743C49B5AF02DBB27F18F69ADA312D611C5A21DFED01B73AB02522F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973552, "uuid": "dc53b480-2ca7-41b6-b613-780c07e86fc1", "value": "3072:BZs9UC5KY2AOUyN2DjzCDX/R4ALFbaeHNg:BZqUC5K1AOUyNezCDX/R4ALFbaeHNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973552, "uuid": "98e88a88-785a-42f1-93c1-7d2e28710f08", "value": 118735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973552, "uuid": "489d231e-ee8e-4273-a1ea-68db7100942d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973552, "uuid": "4c8d78d9-1f1b-4514-b9a6-cedf17f86217", "value": "0001a7e82ccc41a89d7792159ce3e936a91dbe8ce2781edd742ea0943c84093d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80b151c-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973558, "uuid": "3bb16d3d-f523-4cb3-a44a-54e6dd7b8ee7", "comment": "Malware payload (Mirai)", "value": "213c1a3b00d280097b7ca5cc07ee2f90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973558, "uuid": "2c749a36-0d6d-4d07-8737-10e37ed4265c", "comment": "Malware payload (Mirai)", "value": "0003cdf49cc31f363db1517330bf7f0f30923b435675bcb63686db57bd34b34c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973558, "uuid": "248d0c69-d924-4e14-8057-ee92f05f258d", "comment": "Malware payload (Mirai)", "value": "883669985daa25f7ee8ece6eac157552833afb9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973558, "uuid": "884c2ced-bb55-42dc-a62d-4c2b3db3f064", "comment": "Malware payload (Mirai)", "value": "3279749b31d13d0fad4092d4980afb28df646e5cc0658d0f1fb7a1828e86a4e19a7cef8068f75f27071235a21cb41c65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973558, "uuid": "47b97e96-e79b-427b-8f24-c8f72f5140b4", "value": "T1FF430882B881AA29C7C05777EE9F104E3354E7DCD1EA7347CC144B957ACA90B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973558, "uuid": "503c9ea8-1eee-47a7-b68e-38ac95bfee35", "value": "768:jM6Y8s3WTX8bPdy40K5YMKEKxLinom70dmVt9Ck4g3a7wCVy/Jx+5H8hG1rmCd/3:tCW6P049Kx+om70dmL9CTgweZWeQhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973558, "uuid": "0046a8e2-fa28-4a40-8b75-8a27c0cae46b", "value": 59996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973558, "uuid": "fbb114f8-e8ef-4fc9-8ac3-46a763bb9c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973558, "uuid": "22658790-7bb1-4958-b8ba-8f9574626b9b", "value": "0003cdf49cc31f363db1517330bf7f0f30923b435675bcb63686db57bd34b34c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bbffa8-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973764, "uuid": "545583dd-dc55-46b2-abc9-ab682f4baf92", "comment": "Malware payload", "value": "e6a3c52b7cca752066cc771bee206dba", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973764, "uuid": "67be4c2d-0e06-4503-b528-2830e22a062e", "comment": "Malware payload", "value": "0004b57f7671cb3dbc993e632279e883d138ea72a271b3ab84637c918e391023", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973764, "uuid": "8b922cc3-4197-4d3a-8812-41c26fc9165c", "comment": "Malware payload", "value": "8e2874a8ecb5c961ab8a7472b4f73826c424d2d7", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973764, "uuid": "c32d7fdc-fdd4-478d-bf33-5b02e1a4bb48", "comment": "Malware payload", "value": "93ffa8100d270f6359e153ad16c440e6ba97f94c5cd7b72820034b867c1a019a0ab0eeed36968b5ed112332fa97dac3e", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973764, "uuid": "2c533188-8fcb-4941-ba15-b707daac4aea", "value": "T133632A02A741CAB3D4831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B22B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973764, "uuid": "0ac79c3f-f1a5-4c8f-8dfe-2c5ab5495552", "value": "1536:zLVYPCpH1jUdOn4JymPWBSgSh1MtNMr/NbHBDSDmd+l2OZ/fufYEZ:zLUCpH1gdikrEHM1IirVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973764, "uuid": "bc0aa39a-42f0-48b8-82b8-5a5f32bdd3dd", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973764, "uuid": "6002d321-56cd-41d9-99d8-42d1ee61a0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973764, "uuid": "d69db84f-d56e-4552-bce8-129d5f532694", "value": "0004b57f7671cb3dbc993e632279e883d138ea72a271b3ab84637c918e391023.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a1e499-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973770, "uuid": "0d6c7cd0-7cdd-4f64-926c-a8fcbe71f9b4", "comment": "Malware payload (Mirai)", "value": "35eb40ce79d6354b0eb95ac0ec61dbac", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973770, "uuid": "c7178bec-8bcf-4d27-97e5-41c5b52c02cf", "comment": "Malware payload (Mirai)", "value": "000503de34028005e123e8202ca18e8881a6cc8c11adb15f6b3a171fab745f20", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973770, "uuid": "1f0e1980-b529-4f30-b872-b9a159affc28", "comment": "Malware payload (Mirai)", "value": "c05bac0e1df3279176edc2a45f7fb4de281464b3", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973770, "uuid": "36fb9e63-1d86-4c64-86b5-311ecfe17278", "comment": "Malware payload (Mirai)", "value": "14a7c112bbe6a77e7410a6fb16edb385d50b36e0c5e45dd33c926e9abde8b3262eade021e05eb5fc7c20a4abbb89b69f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973770, "uuid": "7bb61bf9-5bbf-43f9-84a4-3ad35230310d", "value": "T120B2D1B9170064F9EE3294FF42BF5B422E2E4FD2B0E7E9175E44A84D7D016346C36591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973770, "uuid": "b08153fd-07d9-4d7d-ba8f-16651c3cf763", "value": "768:jJzRYvAicCP+wprgNOrP0LHJgGlzDpUYs0s:WAid+wVgNWwFVqYns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973770, "uuid": "fdc6ecec-d4d7-452d-a5c3-dd9f377b84ae", "value": 24748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973770, "uuid": "ceb1fc1d-2eae-4ae1-adab-13f264a9f10c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973770, "uuid": "67ec6b67-e485-48ee-9928-6dc37e8d5e52", "value": "000503de34028005e123e8202ca18e8881a6cc8c11adb15f6b3a171fab745f20.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b473cedc-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973874, "uuid": "db03547b-6380-437b-9a8f-2dd084431d9b", "comment": "Malware payload (Mirai)", "value": "069ce0006e02ff1bb317b33188145c8d", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973874, "uuid": "0f985b60-f3aa-4f3a-abf3-080ec12142ab", "comment": "Malware payload (Mirai)", "value": "0005ead0e5bc5ed7d40c6f2c90c0f8d1574c6039feeed79c7e78b967ccf8652c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973874, "uuid": "9ffdf06b-b619-4ffe-93f3-23c55143d99d", "comment": "Malware payload (Mirai)", "value": "e89cbc94e20225e1db5f184cdd2225823398d6ad", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973874, "uuid": "bbc6d9e4-9c81-47fc-8917-bd7fb4e72e6b", "comment": "Malware payload (Mirai)", "value": "3fb9eabc03d416e64cfecf88ccf1f7bc970c8645194f1ed9cc09c16135a2f91e5c4546f9a7360d9bf1e0635f26016c66", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973874, "uuid": "3c50a701-3068-4baf-bbd6-238209ddbfc1", "value": "T17683D60ABB600EFBECABDC3745EA1706209D552A34A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973874, "uuid": "dbbb9f9c-4497-484b-80c7-913b9b66b0e9", "value": "1536:O1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC8:O1XW25VYnUjSGzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973874, "uuid": "3d8870d2-0565-4e40-88ea-930b22a64ed1", "value": 88112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973874, "uuid": "aac7b638-39c3-4c1a-8ae9-dba0ac8a2f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973874, "uuid": "a47b418e-4911-4f19-b377-95fcbb53c938", "value": "0005ead0e5bc5ed7d40c6f2c90c0f8d1574c6039feeed79c7e78b967ccf8652c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b864a9c3-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973881, "uuid": "00716942-7376-4a2e-9378-740c2371e00e", "comment": "Malware payload (Mirai)", "value": "d2da446473f2937e6b06f132eef54a18", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973881, "uuid": "9acb3b2f-97bc-4dfa-b5f2-aae73189bd0e", "comment": "Malware payload (Mirai)", "value": "0005fd9d848f23865b785b03ce6e6c127b451321a0c6c047d77ff6926e19cae8", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973881, "uuid": "df070641-ef61-4a80-adaa-6ebd64afbced", "comment": "Malware payload (Mirai)", "value": "2e224b78e82869b400ca2fa39b81fab61dd60748", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973881, "uuid": "5f328d3b-912d-40a9-af5e-bda21a03979d", "comment": "Malware payload (Mirai)", "value": "7a044e3d5763a2dc086c7cfe8f90ade25fa69f781d4f5e522859e04c347c9dc0c05f72b002af7afa09d5981601be7ed5", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973881, "uuid": "2de26f94-27f1-4719-bd96-d33838961379", "value": "T1AD635CC5E4019E3CF99BD6BE84160A08BA34635456A30F2BD6ABFCD77CB316C9E42D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973881, "uuid": "ea6b711f-ab01-40c7-8817-3e98d8813a1c", "value": "1536:RDUL/1TtgFyrsYQCOe6xxPEzoCBK20IgY8ld:OL/vclHP1/Soe0f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973881, "uuid": "62d5ac43-7499-4447-8ef5-389a99ae4f82", "value": 69588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973881, "uuid": "ede70f97-fc6c-4c30-89fa-b64ef86aa7f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973881, "uuid": "6b53feb0-ef3d-46e8-921f-8d6ed54e6888", "value": "0005fd9d848f23865b785b03ce6e6c127b451321a0c6c047d77ff6926e19cae8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c45546-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973975, "uuid": "1c588370-e8a8-4d6b-9513-08e761468ad9", "comment": "Malware payload (Mirai)", "value": "f82690f7cef8365e3aa5877ec9892375", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973975, "uuid": "206cd5ab-4fb3-41bb-b32b-a35a426d6a4e", "comment": "Malware payload (Mirai)", "value": "000643f6cc436583fbe0ce5deb5c16eb2ede8924baa089ff064e6ec69d9f0ab4", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973975, "uuid": "301d67eb-9b5a-4ff9-9174-e661a5acc0b2", "comment": "Malware payload (Mirai)", "value": "4dea83e295f45bb461abc86b06c6c4cd3913e969", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973975, "uuid": "d272d148-48d0-48fa-8b7c-c2b82207f0b0", "comment": "Malware payload (Mirai)", "value": "3373de7509268f8f69d399711b23c5ab0f68f88b9a3aad6c56ef6c61b115dbd036c072919ded29d5463153c9194c0f6a", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973975, "uuid": "494a0394-8b37-4466-b9fe-da659ff605e8", "value": "T149A3930ABF615FF7EC9BDC3709E92B06288D551621A97B75BA70D814F24B20F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973975, "uuid": "38714dd3-7e3d-49e8-aa43-68ec1f7f3560", "value": "1536:hDoRpyISwB53eUEwI0ooPMTLoLWDNrYZrpiG5yR2:tSpyISnUfsrY8R2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973975, "uuid": "0cbd8f7a-6b5b-4c88-842c-616f02153d11", "value": 101540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973975, "uuid": "59fd7731-5aa8-4969-8fa7-914396a3831b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973975, "uuid": "cefe0c69-07eb-413d-8fc2-388a85b79782", "value": "000643f6cc436583fbe0ce5deb5c16eb2ede8924baa089ff064e6ec69d9f0ab4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a4b5c2-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973982, "uuid": "5d3b2d26-9b9e-4bcf-b606-e7c795a9f1fb", "comment": "Malware payload (Mirai)", "value": "68933ff0ead688099653de1518632a5b", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973982, "uuid": "ea875ce8-329b-49f5-8518-043cfac7bffe", "comment": "Malware payload (Mirai)", "value": "0007581d15dcf7b43d9e19e50e83771b5f70eb98a5b6a97696485b8ddb3ce594", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973982, "uuid": "43c26699-0894-4569-ac91-da3ed8c3dfe7", "comment": "Malware payload (Mirai)", "value": "957b2c418a6499252cf39a9aabbf5c10f5ad93dc", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973982, "uuid": "6705d8e6-5a92-44fa-bb8e-6b81b2f48547", "comment": "Malware payload (Mirai)", "value": "6fd8efd01564e2a4d3da18986a25fd2229b1f90d580d1886ebb0820706feff84960d7a2ecf1c80f3bdf2440725be9d9b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973982, "uuid": "06fe11c5-2d14-4010-b3de-67664f7e0ad1", "value": "T14E530792BCE28A16C5D422BAFA2E418D332663E8D1DF3207DD215F1177CA82F0D77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973982, "uuid": "43b122bf-d1f9-4b87-ad54-b3f7886abc5c", "value": "1536:hyx0HKhxiO6Js+j3xgA+p92RhrL2yBCECt5DvG2xozk:hyCciO6q8hvBCbDO2xMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973982, "uuid": "19f24bf7-d797-4f42-a7a0-1759ec791321", "value": 60744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973982, "uuid": "264115cc-08a8-4ec0-ac4b-21e8e1b27589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973982, "uuid": "50e0b0bb-29a4-43d7-82e7-d16316edbfb5", "value": "0007581d15dcf7b43d9e19e50e83771b5f70eb98a5b6a97696485b8ddb3ce594.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8853aae-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973988, "uuid": "f01da104-280f-4fd7-8104-162f7cb5dcb5", "comment": "Malware payload (Mirai)", "value": "e70e417a29c4f98727bbf9c7a015a9b3", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973988, "uuid": "0d960c27-00d8-42f9-ac05-5bf20fee3c96", "comment": "Malware payload (Mirai)", "value": "0007ebd156b06fa1eb5593762263b506f979c32e669972ef8b441f01f1264d17", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973988, "uuid": "735416ab-6949-4190-890c-77ae6ff05217", "comment": "Malware payload (Mirai)", "value": "11c3f1b47e1481d61f4d8e437cc33c74dcd4028d", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973988, "uuid": "93a0c982-6ff6-4201-aab7-1f22ba5c311f", "comment": "Malware payload (Mirai)", "value": "8fb2018aa916f140ede1574d7dcb657413d32634de7df00c790dd7ba3e174f152c14606e3eaa8240948f134811f389f9", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973988, "uuid": "65f4fe37-0b8a-475b-9873-de4108435dfd", "value": "T14E332942B22C094BF9E65AB0353F0FE093BFF98024E4B585695EEA458136F335586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973988, "uuid": "d5152084-dc0b-47ff-9697-63d2f772f1c0", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdyzq:k6HAt1ezbnAXZUBt33tbC/3Xwyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973988, "uuid": "056897c0-207f-42fe-bb48-4cc45e731607", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973988, "uuid": "0b817f6f-f7a7-4227-9fed-f028fd774688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973988, "uuid": "03b155ec-6581-4b0e-8757-3c6ee946c933", "value": "0007ebd156b06fa1eb5593762263b506f979c32e669972ef8b441f01f1264d17.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7333a1-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973995, "uuid": "ef1b59d2-c416-478a-955a-6bbc8eedf14b", "comment": "Malware payload (Mirai)", "value": "dbbebf323b7bba367f03d9ac2b873268", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973995, "uuid": "c0a61582-9638-48fb-8264-745f61588d78", "comment": "Malware payload (Mirai)", "value": "0007edc2bd1af15dacfe156f6cbfaa0368fb81b6e78ec1a7e3c4e120a73b9bd1", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973995, "uuid": "ec7570a4-59eb-441f-96bc-f567cf813224", "comment": "Malware payload (Mirai)", "value": "774af72d3f95b0e35f099888605de427254cba1b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973995, "uuid": "a3cfe9c3-ddc6-43fa-99d5-fa1c90b0fd8e", "comment": "Malware payload (Mirai)", "value": "183453f5795fdb31f4642a9f3ae2f460380ebb2198c5727f4e700c7ad15fa84cbd82a247aff64b6147f61814e26aa9a7", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973995, "uuid": "b0e02e5f-cace-4ec0-92d5-ce580c84618d", "value": "T163532BC4A5E3F8F9E811197C706A9F71DEB7E53BB476A98AD3C96433D901302E20265C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973995, "uuid": "7a65c67f-4378-4fe8-91d5-814c96d704ac", "value": "1536:1HrH/PZquoWKVaEXZWrAdr6aGj4CYY4IrOZDC:trfPZquoW9QZiur6aGMq4Iq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973995, "uuid": "ddc1771f-e307-4bfa-bf1e-61c3cabc6ded", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973995, "uuid": "fec8ac68-95e7-47a3-81e7-bc41cf6b0421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973995, "uuid": "fd7a98fa-2e5b-4619-8cdf-66ded25ed0c0", "value": "0007edc2bd1af15dacfe156f6cbfaa0368fb81b6e78ec1a7e3c4e120a73b9bd1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005dda0e-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974001, "uuid": "e19b3bf2-d3ef-4013-97b9-41b6d3fc190b", "comment": "Malware payload (Gafgyt)", "value": "f22c57139ea66113a0136d78c66f85fd", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974001, "uuid": "ba5e795d-b249-40a7-bc42-05ca82b743b3", "comment": "Malware payload (Gafgyt)", "value": "0007f81bf3f0829f7bce9c16f1871c290a1ea6401c21e0f7c2763d830652cbeb", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974001, "uuid": "ebcb9f37-5dd1-4db4-8e1b-de8dbce3b29a", "comment": "Malware payload (Gafgyt)", "value": "b90cc777061a030ac647b9da8ba2a18476cdee26", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974001, "uuid": "392a5030-435f-4b28-9204-7b9d8d1b1c39", "comment": "Malware payload (Gafgyt)", "value": "b9357ae6ec4e11e71a27b6f430deba20792ea52fc4dabe677a541d9a940c03f8bfdd51cb62fd20ac81d57a4bdedee249", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974001, "uuid": "271ac99b-f945-4cdf-965d-e8067d5e975a", "value": "T1C39319377B230E23C0CA147111E30732ABB5D79538B95397B9E02DAC6F16AC43956BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974001, "uuid": "c190f6cb-c316-452b-92e9-c6c575b0e381", "value": "1536:YeTIHuNvxItj55/tBitNc3mkO0FPXjDTfQCX:9IONvxIxzjitNc3m50FPXHTfQCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974001, "uuid": "4adc1289-abb2-408d-b026-9b488b5d657f", "value": 95914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974001, "uuid": "1dc65685-e308-41dc-9e95-201945125f80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974001, "uuid": "c2732762-dce8-4ede-8df3-716d3eaecc28", "value": "0007f81bf3f0829f7bce9c16f1871c290a1ea6401c21e0f7c2763d830652cbeb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043d862d-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974008, "uuid": "d431a0da-f12d-4646-9620-a8bf8f7e352d", "comment": "Malware payload (Mirai)", "value": "263c7f78d76f02c293a453798682ca71", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974008, "uuid": "3136537a-c959-4212-b2f3-7f6a4c895826", "comment": "Malware payload (Mirai)", "value": "00086f0430284109783541481fd4021522d56c0ffcd34d279e1f73f17fca32ab", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974008, "uuid": "b069c251-0820-4db1-9e89-2545d576c68e", "comment": "Malware payload (Mirai)", "value": "7d54c3cecb4b6518808387bfce75ebff221a9d96", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974008, "uuid": "0cf7f1ac-2562-4e7b-b58c-c647a142576c", "comment": "Malware payload (Mirai)", "value": "03cd59a6d06b33bddb7ab0e4e578a7e9b2b7402a12f09d28e72083036a9199d4387603fc407ac70ef51f4248e982b2b2", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974008, "uuid": "fee72792-8e44-4eb4-9f03-f4afdacf02b6", "value": "T11D432BC66953DDF6D80208B111BB6B318A32FA3F146AE5C7E39DAC93ED015C2A1176DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974008, "uuid": "6b49e029-2f64-48fd-8f90-a3a2cf3237da", "value": "1536:LoKwvorRB0s36U04h1xJr80tMHdqbSU/yDpxRUdhQzT:yvkRB0s36U0M1xJ4UMHdqWUqVbUdhQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974008, "uuid": "9c54dd14-28d4-4df5-9a21-fa2f391252ee", "value": 56824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974008, "uuid": "c652e575-fbe0-499b-8eb3-7003db4817d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974008, "uuid": "eb1d8608-20e5-432f-a580-ff016c6b4769", "value": "00086f0430284109783541481fd4021522d56c0ffcd34d279e1f73f17fca32ab.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083c286c-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974014, "uuid": "06e498fa-1cc5-4356-858c-d57b32f3504a", "comment": "Malware payload (Gafgyt)", "value": "d49d8531f279252620a56d3eacc532db", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974014, "uuid": "2e4e84d0-99b5-40fb-9dc7-a6561d51423e", "comment": "Malware payload (Gafgyt)", "value": "0008f8b55a790ef597926a7da4b65a30b9f4c3f347eedff9ab2ffbccb9f67b20", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974014, "uuid": "23b915c8-96ee-4079-a0a8-0337533a8536", "comment": "Malware payload (Gafgyt)", "value": "501bdcf3f4fefee649d308e42eae778af356700b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974014, "uuid": "619bc24b-bfdd-4a4a-a4ea-97fc2319b51e", "comment": "Malware payload (Gafgyt)", "value": "2ea99127c43fe1961a6ac43c69ad815036d8ac420124b4f258847d438e00a9a74ba381a44c7b9fcd7fbca213406eda30", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974014, "uuid": "6f956f03-9076-4ebd-aec9-1ce3c8246f62", "value": "T13FE3094594A32EF7C012697535BF6F640719FD912F0F4997653DBAA003AF0DBA00EEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974014, "uuid": "3f2fe58a-32f9-4a3f-8fdf-a8a295643b3e", "value": "3072:QhtNe4dHU3tcc+zOiT38RVuGi7XCBoPie/JxHegDfF4PrDbaJaF:Qh64ZUvg2+d/Jx+gDfF4PrDbaJaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974014, "uuid": "07b38565-8dfd-47db-ac84-e60cb7ad7fa1", "value": 149654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974014, "uuid": "0c0a2c72-f42d-4167-9ebd-ad9dabba6404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974014, "uuid": "1c7d0690-f95b-4060-9ffa-906493bbe6fd", "value": "0008f8b55a790ef597926a7da4b65a30b9f4c3f347eedff9ab2ffbccb9f67b20.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2b2204-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974021, "uuid": "6f080215-243c-430d-bf82-1863c8749ae6", "comment": "Malware payload (Gafgyt)", "value": "5ff2e58e55605674f71d5a533bbccc12", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974021, "uuid": "6d777d50-fca2-4e22-bde5-c72192f9c7f6", "comment": "Malware payload (Gafgyt)", "value": "000a43a528055f8eb373bc1d26dcf0a417d33fcdc5b4cd9326b8e057bba6a785", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974021, "uuid": "c2fb9214-7b47-451b-83b0-477ac1e13237", "comment": "Malware payload (Gafgyt)", "value": "47eb4404c8a6b9bd79b752c1d0d0812f66f86c76", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974021, "uuid": "269fcc91-6188-4793-a52d-1429e335616e", "comment": "Malware payload (Gafgyt)", "value": "009dae84bdec2040dc83c8242158046a2d5e6b6002fd6729c3e4b2c8ee0b5561abe2d21eca0944468fb54893d7b67587", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974021, "uuid": "d5f65ab8-d12a-49d4-a0a1-75cf30258b87", "value": "T1CFE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974021, "uuid": "ab536e58-d8a5-4fa3-af5f-cc362403b03e", "value": "3072:JW6dm9tS1aRGQdK76t/zCTI5mrThPaLEnvPrNb:c6IG+LC0mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974021, "uuid": "73273b87-29ac-4d8c-b39a-dc31cf238f6c", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974021, "uuid": "e26dfc04-93ac-4dba-8ae3-ec6fe8eddd24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974021, "uuid": "9ab88a28-4532-412f-a395-fd882f81541e", "value": "000a43a528055f8eb373bc1d26dcf0a417d33fcdc5b4cd9326b8e057bba6a785.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10105c55-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974028, "uuid": "d1149c66-7814-472c-850a-d4c4cdc02f4f", "comment": "Malware payload (Mirai)", "value": "a473bc84564688b6194c767def9698b6", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974028, "uuid": "e1eb52e6-7ba7-40a0-9318-93b51d724ed9", "comment": "Malware payload (Mirai)", "value": "000abccf991307ca36d4d410c78ce6d04ccccb071a4e43ac65ddfcc2d7bc8ca1", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974028, "uuid": "98b1097a-8964-41b4-8c87-8ea49db03610", "comment": "Malware payload (Mirai)", "value": "3606e6f960fc0e2d7f5219da6c80196c059ac559", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974028, "uuid": "0cf44c02-07a0-4691-aea7-e3cc083598cd", "comment": "Malware payload (Mirai)", "value": "6bbfc4aeb120c96573fdb60e0c98dbf96bb87e8aabd4795ebab98c0794fc6c10a6004bffaa31b088ac888e716cc7ce7b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974028, "uuid": "3e465a8b-ce36-4204-a081-941826dca525", "value": "T153D2E1F88E6E47C9A0DFBE798E5E84AB758CB4630F6C85584B0107866633E5375F4E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974028, "uuid": "6196b20f-bbb7-459f-81f6-9e8c2cd0ad6d", "value": "384:MaiMzN8f05Rpjk5Yfo2xZUzKmQAHHOvgm0PtsgV9Jz8Uaux7+fqSB+figWbETRIO:VpN8fWlfowmQA3V9qFmSBtboMAQ1cWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974028, "uuid": "4e628f11-0374-4f81-90ae-bec7715c87fe", "value": 29920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974028, "uuid": "679341e3-09e6-45d1-bc87-80badd4e02a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974028, "uuid": "61cad222-6ea0-4729-b1c4-b9831dc43980", "value": "000abccf991307ca36d4d410c78ce6d04ccccb071a4e43ac65ddfcc2d7bc8ca1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e23ffa2-5a64-11f1-a769-42010a9c0008", "comment": "Malware payload (GoProxy)", "timestamp": 1779952227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952227, "uuid": "f1784681-0838-4b0e-a5bc-297c30e1ffb8", "comment": "Malware payload (GoProxy)", "value": "b2b757b852590645d8e40c6ae784a031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952227, "uuid": "43e52565-d4aa-4fdd-b6fe-59fffe144eb4", "comment": "Malware payload (GoProxy)", "value": "000b49c27bca1e50d61085abf2e4ce4b7cc63b48d55368cb08e7b9894556a148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952227, "uuid": "ea14045e-0433-44b4-9412-d0105814f72f", "comment": "Malware payload (GoProxy)", "value": "53803882e90ccbf02aa84962fec724f98522292e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952227, "uuid": "da914cfb-41c0-4f9c-b6d5-d40755d3615e", "comment": "Malware payload (GoProxy)", "value": "37bdd8c67335068c988f99624b723d2f637dd1451edbac9a4e776e0d48469d0bb1459d9776286dd99c29b001d0f4211d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952227, "uuid": "2710bec7-c4fe-4653-9623-5ba4ffbafebf", "value": "T1D4665B03EC9555E9C1EEE2308A629152BA717C486B3123D33F90F7382F76BD06AB9754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952227, "uuid": "5cf94d33-815a-4f86-bca1-7bd8121274e5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952227, "uuid": "f889f2d3-c083-46dc-b9e8-9fc7fed5c23c", "value": "49152:Lqqzb2CmV/hIAUbty3zrpvc//WgRutV7jWLGvTdPrGEnwjN9ri1wKeK9KtIB7zHD:L5AlpcpRujKc9+e6U79EqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952227, "uuid": "2d72b2f9-220b-46a5-b2f0-d38816a75e40", "value": 6527544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952227, "uuid": "f4b54188-208d-4f3a-9bae-f3c0363ea2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952227, "uuid": "3d26fcab-f431-45a1-b42a-096d00141c12", "value": "000b49c27bca1e50d61085abf2e4ce4b7cc63b48d55368cb08e7b9894556a148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14027bed-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974034, "uuid": "14c39dd0-dd4f-4b92-907e-a1e823a283cd", "comment": "Malware payload (Mirai)", "value": "0f63d91af89be249b5b107958e4c7856", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974034, "uuid": "3a44c022-3914-49c2-8e24-7c83c042173e", "comment": "Malware payload (Mirai)", "value": "000b7a6edad313848002761d0bda643c455da7f65a37f1ef5603209da7b24d59", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974034, "uuid": "fd24cfbe-b912-4886-92ed-59a0b988b467", "comment": "Malware payload (Mirai)", "value": "4747d40fee944da0c03ea80aa6c182da371bbdc4", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974034, "uuid": "ec7e1f06-e325-4089-b278-1db8cfc593c0", "comment": "Malware payload (Mirai)", "value": "5c168ead4caf48639dd9a0c8f97fe8e134bcba1a9074cb2bedfa4052061e668a74c599de2c88f756cfab8f29c33993b0", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974034, "uuid": "826bf202-ef5e-43a0-90ec-1a311be34df2", "value": "T1AC339E73C42E7DD4E65982B8B9204B785B63D40296837EF59A4AC6974083FECF5093F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974034, "uuid": "6960cd23-feb8-451a-b2c5-9a4d61c2e502", "value": "768:7/zz/6Ozr+52iMka8wtAi7I53qlDIBPQ37X5QoDXeB74eXC6Aoa4CC0SE:7/v6a61a8wtA1qIi3zmQXsXPbCC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974034, "uuid": "fd85771f-6b61-45c0-a2ab-e2b36165859e", "value": 54708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974034, "uuid": "c60d3fe8-438c-49b8-a696-a79ffc9892a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974034, "uuid": "f7b6116d-48c5-47c5-a60a-d4a6ec95a240", "value": "000b7a6edad313848002761d0bda643c455da7f65a37f1ef5603209da7b24d59.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fa00d2-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974041, "uuid": "6ec30f3c-a0a2-4ec9-8276-4f6723b2a875", "comment": "Malware payload (Mirai)", "value": "33e6ff460c16f6c33c02d402eeffb1d8", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974041, "uuid": "b2663ac4-7cd6-4781-b6d6-401f2b532056", "comment": "Malware payload (Mirai)", "value": "000c2393c3ff08d2a4144969580c1fcb2f6783423f35eb47ca8b23ae50a726ad", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974041, "uuid": "edccc63b-e5cd-4b10-8aa4-0f39182c77ee", "comment": "Malware payload (Mirai)", "value": "6ec6f6aa2fc5fbbd8ea72809f9da0d5900d57a89", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974041, "uuid": "4862a3a8-6c78-480e-883c-2e6be2c548a6", "comment": "Malware payload (Mirai)", "value": "d00aa1b0d69ad905c172b818c94da85487393ee3b9c26d50351cc69e385d8e5e9123357ebdd6ed5bef71b2be799a5312", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974041, "uuid": "b2118ee6-afe5-449f-bdd9-76fa239e2c9a", "value": "T1C5434ADAB401DE7CF98BDABAC0224A0AF932731194930F2B6667FD976C720554D3AC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974041, "uuid": "eddb7dff-5463-4310-aeb0-003a77bc9510", "value": "1536:bdacy0knw3gA9GjQE6D5zBa0HR7inMUCyc87:bRgmGmrLxHUDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974041, "uuid": "ea2da36f-6968-4376-884f-de22cc42ca88", "value": 59344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974041, "uuid": "7da46a35-f8ea-4234-8953-8825b4da5ac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974041, "uuid": "6f4a3ace-43bd-44b6-bc08-6a9780dc8660", "value": "000c2393c3ff08d2a4144969580c1fcb2f6783423f35eb47ca8b23ae50a726ad.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcd1473-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974047, "uuid": "eb23c70a-acd3-4e3a-a644-724936d30843", "comment": "Malware payload (Mirai)", "value": "d88198a5c8cccb0453ea7f1b74bd2289", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974047, "uuid": "8a1eb5fb-a064-4e22-bbd9-548783b12a3b", "comment": "Malware payload (Mirai)", "value": "000cbae6e7ad5f4961efeba229a594a17581b4a57a58909952aa781d1abb235d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974047, "uuid": "d9cd6d50-1f63-4d2e-8745-56166dbc445c", "comment": "Malware payload (Mirai)", "value": "219ee3c167f4dea7e6d97098c6c19bf0732407b2", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974047, "uuid": "eee62a54-93b1-46e1-b98c-45cb19021539", "comment": "Malware payload (Mirai)", "value": "75905b6bb038f55e19fcc145a175f6b745a9bb3faec32882375f8b0e4590f6f35782cd1c17ca3f77949acdb605eda5fb", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974047, "uuid": "647e893d-c965-47b9-a863-0406e09be012", "value": "T1E2D2D070B3B1DCA0C7F08C30AE7ACA4A27E101B991DB30663A5159B479E8653A7F5773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974047, "uuid": "727a1c76-2767-477c-8405-23ef6f068681", "value": "768:XsUBacyByf/2KXyaeeDpV6JxY3BGEbOorjF5s3UozC:XsA/20yalvRBGEb5dEzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974047, "uuid": "c917c6a3-fab4-41d5-87b9-7e05d404c0b8", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974047, "uuid": "e7325c4b-55d2-467e-9816-491f2382200a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974047, "uuid": "0e9e26b3-33c4-42b3-a821-a7a334263e05", "value": "000cbae6e7ad5f4961efeba229a594a17581b4a57a58909952aa781d1abb235d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb0495d-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974054, "uuid": "1e1509f3-d424-45b6-b11d-2249d30f4407", "comment": "Malware payload (Mirai)", "value": "ab89d3bbae02064bbeacaf0bf541ee7e", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974054, "uuid": "1281423e-6020-4db5-95aa-2695dc0740f6", "comment": "Malware payload (Mirai)", "value": "000fa1fbefb41269a54cfca6c8479c806f88e2a15fc5d10673729420106fbd93", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974054, "uuid": "2e7eef52-beb0-4c97-96e6-f8f9645d1f23", "comment": "Malware payload (Mirai)", "value": "c9ef2e8b1166aec3f18ce5a5172f6aeb3516c7b6", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974054, "uuid": "5e1933e6-c1d1-42c0-9ecd-a64beac24897", "comment": "Malware payload (Mirai)", "value": "ec80087913faae04d4b6ee1971e4be2b6ac8471911f65f64c863d1d7fa3a7c167f3c3976633bcf5ce9f643150be46be5", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974054, "uuid": "18090233-9a35-48d6-b6bc-b8a7ede568dd", "value": "T1D0232A42FC91CA05DBC06376BE6FA0AE331163CCD1EE3617AD145B2436CB60E4E6BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974054, "uuid": "2db2fed2-c2f3-423a-8682-548d0e654097", "value": "768:mYBuwZKNB96sOJjkBi6BK93gnwVjPEuOaxLdIbMPeB2rurW+ork8jWkDff2BNZ0:wwYawK93TbEuOa5dI4E2r2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974054, "uuid": "67e5a833-6280-40e4-b693-b89a12a0a2e9", "value": 46304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974054, "uuid": "76107502-9627-47bc-a98a-8a4ce17d7cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974054, "uuid": "f6e84fb9-7d0e-480a-a5c1-003e3bba9a3c", "value": "000fa1fbefb41269a54cfca6c8479c806f88e2a15fc5d10673729420106fbd93.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23932dab-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974060, "uuid": "c54a811f-cbab-4b16-8478-f845bb2d6d57", "comment": "Malware payload (Mirai)", "value": "e62aee268bc616e45efc79f5b6beabf6", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974060, "uuid": "fc0165d1-1d9e-4bf7-a132-bb26bb6956cc", "comment": "Malware payload (Mirai)", "value": "0010a27d070f0d18747b0588fe94caad3bd25f5f694e4d2247d9d964de92a558", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974060, "uuid": "9ddacfd0-ce5b-4b5b-bdff-264d88433de0", "comment": "Malware payload (Mirai)", "value": "4ff10fb9aba0b096fda924016d67cdd3907f50df", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974060, "uuid": "9b4d3a93-a91f-4b87-90a2-51a9f9afaaf3", "comment": "Malware payload (Mirai)", "value": "5492bd595a79c7d3db5b41027950dc15b559a869264c4aada3a9d40be21be39c067273b6de0d539969bc86c2a040e7ce", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974060, "uuid": "b1a7f672-cb19-4fea-8763-92691d1e7530", "value": "T19BE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974060, "uuid": "4881fa80-2cf8-45da-ba44-37c124d0baaa", "value": "3072:Cv/WwsLgaq353qHiCOvhOp+qkDQHbeskmhxQwoVSUNu:KPLaq351hOp+qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974060, "uuid": "6c40157b-5622-4fc9-8c0b-d8064c0a8ad1", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974060, "uuid": "9c6dbc59-c4c2-4e29-997f-53ae94dd98c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974060, "uuid": "04445fd1-7983-417a-a6e2-78f469df0027", "value": "0010a27d070f0d18747b0588fe94caad3bd25f5f694e4d2247d9d964de92a558.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277c18aa-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974067, "uuid": "e7690354-77b2-424b-8021-0df896757b04", "comment": "Malware payload (Mirai)", "value": "892ac10a8237bff90924f71470a4a3a9", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974067, "uuid": "a00acc92-255e-434b-b677-e56e15f6dccd", "comment": "Malware payload (Mirai)", "value": "0011786c55ab4205487c87b2f07727c05a9635bafdc9bb4922d7ed1a21d29358", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974067, "uuid": "d1939da9-c378-4db2-b7c3-c8432060e406", "comment": "Malware payload (Mirai)", "value": "e5e102dab821009983f33669797bfd9f1b063649", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974067, "uuid": "41cb187f-9030-413f-a6b2-c873b1734e47", "comment": "Malware payload (Mirai)", "value": "31eb6b2f8f477b3a297b66fc0c84fe6bc02d9c17e6a84b19d41775651c0464e284f28e6727e63b4a7fe060a21fa4c628", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974067, "uuid": "0bdcd4c4-2e1f-4fc8-a420-03d1e9207ba4", "value": "T11263B70E2E219FBCFB6C863587B74E209648339A27E1D585D15CEB011EB034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974067, "uuid": "5e294807-6f62-4bdd-81c8-60df34b89e09", "value": "1536:6UKXOt6iq1icthKLhE0is2SZ2qhajSmE4ofHdndU:BKXO7yhKLwuxajSm89y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974067, "uuid": "e1391cd7-7f23-467d-a649-79d4ea64634e", "value": 67720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974067, "uuid": "1da5dead-c067-432f-ae3f-85b23ae44ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974067, "uuid": "0c89dc9f-4a3e-4566-81d4-fd93587d82f3", "value": "0011786c55ab4205487c87b2f07727c05a9635bafdc9bb4922d7ed1a21d29358.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5f9e2c-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974073, "uuid": "d4a74f59-f623-4fb0-9eeb-3c76005fc83e", "comment": "Malware payload (Mirai)", "value": "922f70d4e443127da51a26b74ede4599", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974073, "uuid": "59e4d06a-49bf-4e3c-ac2d-b80287abc763", "comment": "Malware payload (Mirai)", "value": "0013579ad969d846c00a31030cd7dc6e90e5538ed4a28c5e839777b9acd8ced0", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974073, "uuid": "79f86afc-1d5f-4c65-bb01-b294717382e9", "comment": "Malware payload (Mirai)", "value": "ba37e98863b98d761a57801b35a93e1da7894eba", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974073, "uuid": "1c34a2e3-392f-4ea4-aad1-4fa26950c6c5", "comment": "Malware payload (Mirai)", "value": "5df7f4cd0179e99db44d0a94f9751d7786a592daa52b4b794d3f9ac88a16448be8c293e96a66307cbf36c2e4f2b9b154", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974073, "uuid": "fcb26d84-b2df-438d-ac22-f5db9dc0026b", "value": "T139332886BDD2A66AC2D423B6FA6E418E331173E8D1CB3663CD244B1477C9A1F0D73685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974073, "uuid": "3df0ba2f-c3c5-4bed-afb3-334e2d6fe191", "value": "768:DYPOi1rFiA+K1z7JIoS78f1ntEpWMXVpnrLLUBHjdNV9WFTagXyPzoOeuHzBNWd8:TAH7c7snqpVLLoHLV9WFagCPjHqdDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974073, "uuid": "97af1640-d24d-4fc5-9e4f-c0c8bdf3e636", "value": 51196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974073, "uuid": "a003af75-2443-4592-b55e-ec587464ef61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974073, "uuid": "3715a9f0-456f-48d5-9018-1b682c29cff7", "value": "0013579ad969d846c00a31030cd7dc6e90e5538ed4a28c5e839777b9acd8ced0.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f42543a-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974080, "uuid": "157c2788-70a7-4db7-8fd5-d84f4e01c2ba", "comment": "Malware payload (Mirai)", "value": "941aab76eff01572d66f008ab72ead73", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974080, "uuid": "67a0db37-0fdf-404c-a07c-3808d4235d91", "comment": "Malware payload (Mirai)", "value": "00137f81c18dc59ba849382449279293a057e7c49a84dae415d427495ec3e0bf", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974080, "uuid": "617ccebf-0856-4abc-83fe-8cecbf68add4", "comment": "Malware payload (Mirai)", "value": "28ac997a05d69c1fc390d81deaae54becebb1929", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974080, "uuid": "222654af-324f-401d-9dff-573499189a1d", "comment": "Malware payload (Mirai)", "value": "b24454ba1485969107832538c3632557023c94815135b28efe7d6721706c659bc70c976db3a296f46aa20051b83b1725", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974080, "uuid": "42ed0e32-77db-453f-bf6f-082b2f22d8c5", "value": "T1DA630956FC818A12C5D513BAFE1E018E33136768E3DFB2129D146F647B8A92F0E3B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974080, "uuid": "6d74d867-b74c-4a19-9b5a-e9f47b4bac1a", "value": "1536:+tnTn0GPP1j9AvXaXDrEiRm7NNy3v1TGuX4L6bIIizvW5aPTdL:C0I15qXyDrjAQvo5vW5aPTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974080, "uuid": "67264b74-738c-48a4-a373-a73a537d96eb", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974080, "uuid": "be795288-6285-479b-ba81-03cf70e5221a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974080, "uuid": "823acaeb-f256-4e88-8378-a2f317833712", "value": "00137f81c18dc59ba849382449279293a057e7c49a84dae415d427495ec3e0bf.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33365030-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974087, "uuid": "28d23dc1-f1a6-4022-83a5-6ff3766e72df", "comment": "Malware payload (Gafgyt)", "value": "c4c8301f3f0a185199f31cdfdc134634", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974087, "uuid": "b9aa0770-6949-4a9e-a62a-7bd6cc100f93", "comment": "Malware payload (Gafgyt)", "value": "0015efb82aba39f40a2c6d7dec0d03738176c605fdd0a89bbf8f1324e6ccc4b7", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974087, "uuid": "96031e3d-84d6-4691-b446-f63c5f4f841d", "comment": "Malware payload (Gafgyt)", "value": "d2bdd9241a0360ee443c159d0ae243f46c1d99e9", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974087, "uuid": "c5dced48-128b-4413-98a5-f042d07d2c4d", "comment": "Malware payload (Gafgyt)", "value": "664d21e3d9c90ef80ef640efe30efe2165d6ea91703da32fdbf74d58bd5f76312c8e45f8cf9963cbbcf70cf55916fc69", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974087, "uuid": "79c57cd7-7b44-4ea9-85b1-3ed354352aa2", "value": "T109D30970F904432BC2D227BAE79E468D3F351EA767D733116A3439B42FE57982E29510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974087, "uuid": "5449a5f5-5697-427d-97fd-9a9fccefcf69", "value": "3072:NX7UZkmBcOhsfGHKJW4Vf0A51CDOYS/SQvPyiiXNg:vlOhIkOjVfHCDOYS/SQvPyiiXNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974087, "uuid": "e4b766bd-1f1b-4bef-ad7d-f6a1b444b987", "value": 131673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974087, "uuid": "ffb8b3fa-7351-4a13-9b2a-291abf79ad1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974087, "uuid": "8e1d9048-c0a9-4c07-9651-3a5fb39e591e", "value": "0015efb82aba39f40a2c6d7dec0d03738176c605fdd0a89bbf8f1324e6ccc4b7.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372448a0-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974093, "uuid": "5b90af1d-ee37-4fc8-b08f-0fa8e097cea1", "comment": "Malware payload (Mirai)", "value": "3e41135400153f456ff7d926a80f7e8a", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974093, "uuid": "b2b9324e-6ad5-496e-b2a7-5485b28a7efe", "comment": "Malware payload (Mirai)", "value": "00165f9cdc28b687828400b46b9733ecbad72391eec8c1da16c2cc8f602b823c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974093, "uuid": "7f674138-5d16-4595-bd0f-e02000c8bc14", "comment": "Malware payload (Mirai)", "value": "0fb8a986373785221d19c52b3b5761969e80fbc9", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974093, "uuid": "28bba6d5-aee9-4f86-917a-910cecc1b0a2", "comment": "Malware payload (Mirai)", "value": "65618aa1b03ce76f6b0025b8667ae21f7b7d51cbca24ccdd5b66c85d787a7ebdcc810c34a21914182707fc47efd88c41", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974093, "uuid": "a9f1a32b-a085-4886-ba78-7fb218b02850", "value": "T106538DA5C8A8ADACC6654978F6118839AB13F00C61A32DF6DA47C352945FDFCF0197F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974093, "uuid": "1c855715-b23c-4824-90a8-75936cfb2dda", "value": "1536:v/pdlyGkBa9atiFxKyQ8MZsortUsgfs3mO75IkDTnCxri:vBdH4PtiFxKyurtUHf+jqkXnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974093, "uuid": "701850bb-558f-47d6-8fbe-4e31fe347e07", "value": 66372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974093, "uuid": "f6741ff2-ec13-4428-8c6e-3a68225f63f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974093, "uuid": "1cf462cd-f68e-4203-9580-6fbd1d032d15", "value": "00165f9cdc28b687828400b46b9733ecbad72391eec8c1da16c2cc8f602b823c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1955f4-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974100, "uuid": "172ece34-c7f1-4559-8029-85f31a911730", "comment": "Malware payload (Gafgyt)", "value": "ac7eb9f36ff1bbc8d449b2abcd4a180c", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974100, "uuid": "5a4a5256-f87d-4158-a6e1-d06c2de86c78", "comment": "Malware payload (Gafgyt)", "value": "0018c8962adb4e9f85982b374574befe0bac5db5cd0862b372fb4d872a1d338e", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974100, "uuid": "0f3e21c2-7906-41ca-8d2a-f95d422ab422", "comment": "Malware payload (Gafgyt)", "value": "a47a80014c45e90de14393b2a3d80ff7cc761ef6", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974100, "uuid": "99e07b07-d552-40e1-afdb-04351de83b9c", "comment": "Malware payload (Gafgyt)", "value": "113ed56b26efdb9cbaf432be3ece359b0908ade0f921f604c352b12edb8db35379b722d50d81ffa04b671f0787a89125", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974100, "uuid": "18ceb561-d742-44d8-8d00-743818ca0b21", "value": "T1E1B34B37B561C63AC08752B127DB9A519C13BCBB1F72320B73987DA52F358C92D5AB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974100, "uuid": "4adc3b11-a733-44b7-beae-d51176f50020", "value": "3072:uirTfgbMXJfIcReqb3OD6HVNVhRRjOHlm7FnVqfJXFdbNb:NsMp0qDCs5RjAm7FnVqfJXFdbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974100, "uuid": "84c2897c-8785-4ff2-91f9-b2969f2735ca", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974100, "uuid": "a9211a7a-6e78-4e12-9df8-9ef7d94d3c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974100, "uuid": "4bb9ff41-1984-40a3-a0ec-30a5ba0c3f1d", "value": "0018c8962adb4e9f85982b374574befe0bac5db5cd0862b372fb4d872a1d338e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f12ba90-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974106, "uuid": "d003d8eb-cab1-4c2b-98fe-c7eb803b8653", "comment": "Malware payload (Mirai)", "value": "033c099927107f368814907bcd6bff19", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974106, "uuid": "ab025e4a-9acd-454c-b00f-212a858a9582", "comment": "Malware payload (Mirai)", "value": "00190f67783c219b0460e203630d7f99957391ff5672372fec9ec0b8927e8ccb", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974106, "uuid": "a72ab732-2113-44ec-852b-d20b68040aa0", "comment": "Malware payload (Mirai)", "value": "bcac7817e8a8b900511c57cdf0a05eb1316e9914", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974106, "uuid": "782a70b8-1102-47be-8bab-057c0c883939", "comment": "Malware payload (Mirai)", "value": "d29a661e4e07267e9a1bd42aba97067b120e2fa2495d40c5d662454fdbbfc8cc623a58b1741508e60b0a89191f0dd42f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974106, "uuid": "6c38a147-d1f4-4108-8a8d-00e67a4a9286", "value": "T11B331A91B8829A12C5D4537BFA6E41CC331563A8D1EF32079D266F507BCA82F0EBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974106, "uuid": "26b29ac8-b934-4ded-a7cd-868c2a4014b8", "value": "768:w7Mc+v+wcWDEKmxmmEBa4OmdiC8saEbwzRgBCEVeHmYMvYPfjA/hcl3D8NRRZPNI:lcBnWDFx8sHeHbMIfU5tGlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974106, "uuid": "e146019a-e980-4e1c-be5f-0f9a08a1e027", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974106, "uuid": "26e77fc4-c67a-423f-9543-88256a1bd19c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974106, "uuid": "fe833edb-84a3-4915-8f5c-3b783be0d5dd", "value": "00190f67783c219b0460e203630d7f99957391ff5672372fec9ec0b8927e8ccb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43098806-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974113, "uuid": "c1354cc5-d268-42dc-a345-e9bb07c6fc48", "comment": "Malware payload (Mirai)", "value": "f6778442b08d956109a6fb16f88f11a5", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974113, "uuid": "812d7edf-3a2b-42c8-a46d-325fe7d9a2ae", "comment": "Malware payload (Mirai)", "value": "001b13bf1889bb034e70fd8715a193a2df52c91a7b4e7a0f3cc21083ca8138e7", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974113, "uuid": "fbfb9194-1195-4ec4-bc96-2baeba50da21", "comment": "Malware payload (Mirai)", "value": "a71545eaef8869199422eb9baf37615e4c6a5384", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974113, "uuid": "7dde0af8-5619-4a4f-9478-14e08d712706", "comment": "Malware payload (Mirai)", "value": "c1defa04c715ad7c2d6a8c613b532cd905d34e429d58fdc93250c469086a293d53184b66179d3375cec60f96cf6fbfbf", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974113, "uuid": "3e8464b9-0fb4-46e3-a898-7bd0824f7583", "value": "T192135C42736C0547D4662EB0383F0BE0A3AFFE8122E1B5856A4FDB498235E735546F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974113, "uuid": "195d3982-b7a8-4b37-af79-2ef3e0674b70", "value": "768:b04uNZ3lqBs8AKHGRxwB3+o4cKz1odYRuyvJC7nJW:bJu34L4RGN+NcmSdM/BCDJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974113, "uuid": "378c8e76-f89a-4765-b241-762207ebbf2a", "value": 42044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974113, "uuid": "389ee7bd-8c5f-4742-b715-747955b4c2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974113, "uuid": "dbafc3d1-4bfa-4b5e-9094-38f1cfda6df9", "value": "001b13bf1889bb034e70fd8715a193a2df52c91a7b4e7a0f3cc21083ca8138e7.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f07c28-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974120, "uuid": "2ccb2765-3d32-4525-8c8b-bfaa0416f79c", "comment": "Malware payload (Mirai)", "value": "c9fb058b57e1c6ab41de5d18d0b046d0", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974120, "uuid": "9e6584a2-366a-41f5-b1e3-8fe0d1ff4152", "comment": "Malware payload (Mirai)", "value": "001c086bc9a6e35554b3056597597d8d40f01b88028b202b6d3899172d527d82", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974120, "uuid": "1fbf9bfc-0919-40cd-af58-1c97ee6ddda3", "comment": "Malware payload (Mirai)", "value": "fec74e696187209e7bfa49eec47f2d16b5b0b8e3", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974120, "uuid": "169e30e4-4748-4131-8e3a-70f63b0b7822", "comment": "Malware payload (Mirai)", "value": "8f8e6eb4ed6e526d2a320bb566168be3db847ec1e6ca4f3cfee9065d2c97e5115e241d1b090d4008d90f7b9430f80f06", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974120, "uuid": "caee71fc-e310-49d4-8387-9552cbe0cf33", "value": "T1DA435B02732C0A47E1525FF4393F27E083FEE9A021F4F589660FDA464276E77158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974120, "uuid": "f57a17ac-c205-4f96-a798-53147b29bb12", "value": "768:kEXb8zi7fiBN1XbAMS9RfMBiPOTb2qCzqjZGMxCuNyTSZ3rY3k6Wt5AIs4s9Jpc9:kfu7iJbAMqJP2b1PGYzqSZ3r3TsDpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974120, "uuid": "b387dff0-22a3-46ce-99b5-78c6c5da0e95", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974120, "uuid": "9016848d-1e89-42c4-b2a0-8d7b4671822d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974120, "uuid": "27c933cf-05e6-47ff-ab70-9e5c4ebd4b68", "value": "001c086bc9a6e35554b3056597597d8d40f01b88028b202b6d3899172d527d82.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad9d6a0-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974126, "uuid": "ee7d5e45-89ea-45c8-8443-bc06b1731109", "comment": "Malware payload (Mirai)", "value": "393731434fc1f35fffc12657b7f60b93", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974126, "uuid": "4ced906c-285a-40f0-93dc-eabece58f4b3", "comment": "Malware payload (Mirai)", "value": "001ca7c3c2727fa61e21c319c3a6e2ce393ef5b991f1ca684129009d4544f465", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974126, "uuid": "72c62a0b-60d9-465e-adb1-29ec43bf2054", "comment": "Malware payload (Mirai)", "value": "70b3d5bad46c10e715efacb47a5b23826eb152cd", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974126, "uuid": "6963eb6a-485e-4f47-b4ea-70e6d7671781", "comment": "Malware payload (Mirai)", "value": "60145bf7992d5cdcb0a0aa7cdb37f0f5025454a470553b56d3b3f730f915bde332cb9891199954aadfde730189e136b2", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974126, "uuid": "43b2fbac-0805-4b5b-b5c2-dbd76376e25d", "value": "T1F8533AC5A583DCF5DC1209752077AF32DBB6E63F2119EE87E399A9739A43502920738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974126, "uuid": "08c28286-a181-41aa-9f06-db99370aebc1", "value": "1536:gAkxQPWMSLMHJqw4CIlTJd/OsGeh2+zzQJT:xk+PWMKMEVCIlXpTht3QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974126, "uuid": "b1252472-4e95-48db-99c1-f147123960ed", "value": 63728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974126, "uuid": "9728a6e0-c929-43a4-95ab-6d9c3d6adcf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974126, "uuid": "527164db-b9f1-4e57-8475-5302cb507eda", "value": "001ca7c3c2727fa61e21c319c3a6e2ce393ef5b991f1ca684129009d4544f465.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec60084-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974133, "uuid": "bf781803-4e77-4b1b-91cc-2e50ad040400", "comment": "Malware payload (Mirai)", "value": "684c1933db86fc33a69521a0901c2045", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974133, "uuid": "3b8cca28-8061-43d6-8082-d1ca69eb43d1", "comment": "Malware payload (Mirai)", "value": "001cf9427a1b4a59ee7a04e047928645dd21e196ab033b23c3a0b6b68cfa4c6d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974133, "uuid": "6d5a850e-c57a-4fc3-8aed-c6defd617a6b", "comment": "Malware payload (Mirai)", "value": "80daa25dd2499fb08f3fba0ee0903c7ed7dff157", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974133, "uuid": "e2eae1bd-079d-4829-a391-99af3ba9361e", "comment": "Malware payload (Mirai)", "value": "88e032f3c2bececd74714b746d4a8b5eb633be639dab8cf5143cf9bdc2b9f2867e9dd1b5092947f26d8441862dd1b78e", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974133, "uuid": "81bdc377-c1f0-45c5-9fd2-aaf85d3a6a04", "value": "T1EBD2E114A7A0E870DEB4433EEE7C8142231723BBF8ECF5AB12948D1CB69C507A735285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974133, "uuid": "515a399c-56f5-4d08-bb97-71f5f32728f8", "value": "768:TFoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZMas3UozK:TF2+IoXVeNIlzpzAozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974133, "uuid": "accb6911-6c57-4953-8605-24d2d7b1cd3b", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974133, "uuid": "a71af39e-43c1-4196-9bcf-ac12b0902df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974133, "uuid": "7214701f-c697-4729-a2ee-ffaec743269f", "value": "001cf9427a1b4a59ee7a04e047928645dd21e196ab033b23c3a0b6b68cfa4c6d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b2cda9-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974139, "uuid": "8cf5acfa-dd11-49ff-aa7e-8de20a95e861", "comment": "Malware payload (Mirai)", "value": "c29f79f5a0f1621fa4a50ae82f4a46e3", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974139, "uuid": "ee1628f5-28e7-42e3-8d9d-ac2b8f6dd51b", "comment": "Malware payload (Mirai)", "value": "001ff3d5067b7f43e342178dd499a2e00178eb1d3deef1e0125f181ed32eda79", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974139, "uuid": "916f68ea-6e2d-4681-b3e8-0c97fcb41de1", "comment": "Malware payload (Mirai)", "value": "021d9bb1dce03f063cfbeb7be2b4ec14661942b5", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974139, "uuid": "8e81e585-dc59-46cb-99cf-cd1df9c57f32", "comment": "Malware payload (Mirai)", "value": "ba8dea85d8be3a375244272e6d259839adda7288e84bc3ab68b2a085e18895d5bdd3176b3557c582c71e8fd8ae7b2e40", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974139, "uuid": "3e514554-e605-4685-8607-e8391bbb92b2", "value": "T1EF530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974139, "uuid": "72c236c7-746b-463b-852a-1143ad7cbb57", "value": "1536:wdnIYoZXnYkTAcASlquASBAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqCuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974139, "uuid": "98f243f2-6bbe-40a8-b932-5579d17afb02", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974139, "uuid": "3609c725-b3e5-48df-9824-f32cb50b44a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974139, "uuid": "8c71f678-f8cf-4149-8975-9179e6f3b011", "value": "001ff3d5067b7f43e342178dd499a2e00178eb1d3deef1e0125f181ed32eda79.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b99cc7-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974146, "uuid": "411e6af8-42b3-4546-bb2b-9341dc26b9b3", "comment": "Malware payload (Gafgyt)", "value": "0fe1161acdf9c530dbf74e83f164f877", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974146, "uuid": "2519dd5a-c6ae-4fe7-ab8e-c2364be81d87", "comment": "Malware payload (Gafgyt)", "value": "0022d01fd0f0ec2f8dcb0cb2c13830018a17d9e4df155e436ab24e8230e5631c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974146, "uuid": "60877fd0-242b-4da4-8308-1b05a343ab1f", "comment": "Malware payload (Gafgyt)", "value": "52783c0e12c15e490472fa895dbc1d4b95800ecf", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974146, "uuid": "c3c2b6c1-ccf4-430c-a176-c33b6d30ee39", "comment": "Malware payload (Gafgyt)", "value": "63a906dbcbdf942c11ba4f91877302d4a6d35e77ad3e7cebff2470210b4afaff45edccfc50ddd57b529b24e683b9acac", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974146, "uuid": "a4f840f3-3d70-4680-a9f3-48e90d9b26ea", "value": "T16A24B83725232B51C4D1DFBB42A24338B4BED9AD345A0BD3A98D6DD93D30DE135922E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974146, "uuid": "7a2f0f50-138b-49d2-83c0-30d7fee9b775", "value": "3072:X8VcYOZNP/jm17BmzPGdc5X/HEEaq8UtEiX:X8VD6laKzedsX/HEEaq8UtEiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974146, "uuid": "871aca9f-31ef-4c7e-bbb9-b2d8a32482df", "value": 211785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974146, "uuid": "c8a91335-2f64-41ab-addf-49a86e813e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974146, "uuid": "c70521c4-8cf1-4795-b2a0-de1c28e660ff", "value": "0022d01fd0f0ec2f8dcb0cb2c13830018a17d9e4df155e436ab24e8230e5631c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac41b0f-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974153, "uuid": "b3fe5744-b0bd-432f-bc23-b4855ef3c0ba", "comment": "Malware payload (Mirai)", "value": "2438b1608669eed7fb5cc4de1eea9d70", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974153, "uuid": "42f683a8-3b83-4750-9ead-3786151610de", "comment": "Malware payload (Mirai)", "value": "0023d9c09988e6ab8d814b26b1101244b29d327467e75d057933e2fc2d7d5086", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974153, "uuid": "ec1a1541-45ee-45ba-869b-507e17d1b616", "comment": "Malware payload (Mirai)", "value": "ccad9060b931c754824e47e2e4b28ac9c1794f16", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974153, "uuid": "80274ba4-7c69-468f-af31-bfdaad50e2d3", "comment": "Malware payload (Mirai)", "value": "71fc91fd42c7666dbbf9877f8732999b58ad082bd539bb712ce908247cb65b446cb6e4376ba2bd351bcdee9a1798ab62", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974153, "uuid": "34e94d2b-6f5f-4ff9-bf60-53dffdb24c68", "value": "T1D1C32A46FB818B13C0D61776BADF424533229790E3DB73079A286FB43F8679A4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974153, "uuid": "065a16ce-03df-484c-b8f1-15e030a80193", "value": "3072:dsXZqFlEYOLzCUl7++UPMwcIjXLWrwTrxVwS+R3:dsXZqFpECUl7++Nw7LWrwfxVsR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974153, "uuid": "09b4f24e-8572-4eba-96c9-5150ddeb5cbf", "value": 122464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974153, "uuid": "2a7becc1-4b83-42ed-8c86-04e26f6d4be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974153, "uuid": "c9c00401-e7cf-40fe-a993-ec91e0817631", "value": "0023d9c09988e6ab8d814b26b1101244b29d327467e75d057933e2fc2d7d5086.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eafda5c-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974160, "uuid": "02dc9ffc-7a85-4d76-abe3-6c9c5d347656", "comment": "Malware payload (Mirai)", "value": "0f39cf2c0b4e4270b1eaa35c3ea59f03", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974160, "uuid": "94d0356b-f6c1-412b-87f2-6bcfd5efa545", "comment": "Malware payload (Mirai)", "value": "0024b6df9502d9ac81b1d9c2547f69721385733ffd6030b9728d584ec53cf57f", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974160, "uuid": "4294841a-f28d-4032-ac05-23832034adcd", "comment": "Malware payload (Mirai)", "value": "fd131dd9660b1ff0af95ba6cf2eb58543e2e64cd", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974160, "uuid": "c1bd68c3-3920-496f-aac9-8d183d10b768", "comment": "Malware payload (Mirai)", "value": "17c2a2aec5e9810b5aa8981909e21ee16951836e1c18d64dd41603ffdd5cab4da1b39ed8843acb3f5ac6178031a2a3d8", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974160, "uuid": "1e8652e7-43ca-45a9-851f-28b12b6593f8", "value": "T18DC2E09191755C70DB720D7CECB88887AC248578DEFA385A987545D82EB019BBDFA303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974160, "uuid": "37c00cb1-1ed1-45f3-8e0f-2aadcecdb119", "value": "768:Q9xM13LhisPUZ1rVdM+hUmqL0kVSL9q3UELxP:Q2hbMZ1XM+hUHVXLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974160, "uuid": "fe6e3ae7-0400-480a-9dfa-a7524b6c4388", "value": 27460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974160, "uuid": "d5a127de-fe2e-4c8e-a743-dc18f2731702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974160, "uuid": "bf963843-3fa2-49df-8ec8-38cad1b48bf7", "value": "0024b6df9502d9ac81b1d9c2547f69721385733ffd6030b9728d584ec53cf57f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b7cf19-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974166, "uuid": "677b7ffd-25eb-41f6-a34f-03fb397170f7", "comment": "Malware payload (Mirai)", "value": "5abb78beee83a1ba50e20566323b6fb5", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974166, "uuid": "a3e5b668-a7e7-4e1e-9e1b-c39aa2b54b3a", "comment": "Malware payload (Mirai)", "value": "0024bb675ed3f8eaf05820b302ca4762b17cc459238a0a735916be6ab0db05ab", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974166, "uuid": "1ad1d378-54cc-4667-b653-d200240c78fa", "comment": "Malware payload (Mirai)", "value": "b1a36b5d684c39a6a9e2ab5551d874097f9ede03", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974166, "uuid": "c8d6e391-f7a4-4100-b4d2-86ed72800d58", "comment": "Malware payload (Mirai)", "value": "4cccf25eaab0b522d9fba22919a5d1dad748237da6119cd4160f4de8985ecc36967b3fe843b51bce28a241f8bd0ad6a4", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974166, "uuid": "57a5a73b-8e8f-4daa-b899-e165b9c224cc", "value": "T136F35B42A642DAF3D5831FF512A797210633E83A1B1FDE45F32DBCB45E09588F21A66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974166, "uuid": "a1c58897-50bd-4789-8216-8ad1859aba64", "value": "3072:BOmOUR7rtPjPo9+tu6RIq79vlZGMZCY5T4k/2/PoZ:BOtwJoV6RIqRvlZGMZCY5T4k/2/PoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974166, "uuid": "5e936ec9-d67e-40c5-bf5a-b315904017e5", "value": 160447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974166, "uuid": "89a0074d-36a4-4b0b-a84d-36e6deb95d11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974166, "uuid": "087b3a6b-54e2-4951-917d-acb3f873f8a3", "value": "0024bb675ed3f8eaf05820b302ca4762b17cc459238a0a735916be6ab0db05ab.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bcaffc-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974173, "uuid": "8d368b11-aceb-4067-91e8-1bcc19410aef", "comment": "Malware payload (Gafgyt)", "value": "ecd5080b37ee8ed508248aeb382f1490", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974173, "uuid": "0252ac86-869f-4535-bf64-edbe93e65396", "comment": "Malware payload (Gafgyt)", "value": "0024c4398c0f028147f0372ae7cb87158ce8a478640dad4dddbaf698fb325a46", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974173, "uuid": "a187c002-f562-4888-b0f4-16ed7658bc3f", "comment": "Malware payload (Gafgyt)", "value": "5f9fa8c558aff77fc6f6f5535d1bf3a5d74c326b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974173, "uuid": "05a98765-d816-4bd5-b376-a9d44078b8bd", "comment": "Malware payload (Gafgyt)", "value": "9ad0824a6356718131bee0172b09568d2273a0fe06bafdfacc426aabf065830d8f5bada20684d319e1566750bd802d95", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974173, "uuid": "f1209d23-4e2f-4f65-aa30-6569c7589c88", "value": "T1ED043A09B95AC1F3C5520FB202677AEE0B6ABD354ABEED44F3187CB01AB14E97D1D604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974173, "uuid": "dff35bfa-5a53-460d-be2e-2b243db91b6b", "value": "3072:OzBkOcEea6cRXuYuG/w+lUyFajqW9mbcLNL/yYArnCWsmTv:OzBRh4+5ktmbcLNL/yYArnCWsmTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974173, "uuid": "64384553-9f65-4c11-83ca-16c2efdc027a", "value": 183150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974173, "uuid": "abbf2bc5-6646-4b87-b6e6-106cbe463a57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974173, "uuid": "c0708254-bbdf-4f34-b4f3-8ce373d1ad16", "value": "0024c4398c0f028147f0372ae7cb87158ce8a478640dad4dddbaf698fb325a46.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac18686-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974180, "uuid": "570626c0-ae82-4c00-b505-55564a5182a6", "comment": "Malware payload (Mirai)", "value": "74f420e69ac8c36e3ecfb519862e5b18", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974180, "uuid": "6b2076db-552f-4132-a3df-4a89e5a4a77b", "comment": "Malware payload (Mirai)", "value": "00262fa4b02548a2824cb09acf44112f8727fcfcc94015795af1c985e5cf60eb", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974180, "uuid": "684bddf3-f4e7-4949-bd19-31c033841f9b", "comment": "Malware payload (Mirai)", "value": "3dea4865f9810ed6fc42d2d79eb831082899c930", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974180, "uuid": "58b43270-aa14-4dd2-a4b7-32a3aa3568a3", "comment": "Malware payload (Mirai)", "value": "d51acf1c45dadaa9694c4fcf0cc7f25d078f837e911268541451359fdb542c22d15835add6fbf4571db6ab8608450518", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974180, "uuid": "8ec35c68-de45-440b-b0c6-34fdf110e5d7", "value": "T1CB83C52B7B130F23C0D610B152E30632A8B9DF5938FD5697B8A07DAD5F36A8431526ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974180, "uuid": "2a972289-b081-4c5f-89c8-15fc7491f76a", "value": "768:X9O7rOa5CzCuOCCqD2LM2ytYPHAw/G80thn2lnAkbD5i1O+N95VIlQ40HDq1iF1+:kvO7YuuC61AkblMN952O4PAtO8t/sZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974180, "uuid": "6fb5a1a8-55bb-4d7a-b97b-c56d5ed9fdfd", "value": 87524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974180, "uuid": "35c84f05-5ece-4f60-b297-4d2df296b0b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974180, "uuid": "e3958819-b452-480e-86c8-cb1c39466296", "value": "00262fa4b02548a2824cb09acf44112f8727fcfcc94015795af1c985e5cf60eb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb1d303-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974186, "uuid": "bd054238-7e37-4f34-a364-f07c19723351", "comment": "Malware payload (Mirai)", "value": "50d8f401d19d27818c33f69b0fe463e7", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974186, "uuid": "00e1125b-5069-48b5-a072-98e6f9c1c1cf", "comment": "Malware payload (Mirai)", "value": "002683b78b498f0026d08ffc0b0674b44b7111c8a424c801839ecd0f67d8c54b", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974186, "uuid": "0c8fb3ca-bfd6-4318-8ba3-c0cef3b74540", "comment": "Malware payload (Mirai)", "value": "ddd29d9268ea83fd4dd3e0ffc3ec4287d6a7d6f1", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974186, "uuid": "f30f4149-07be-4525-a010-98f4c25b7480", "comment": "Malware payload (Mirai)", "value": "54f4a82527512a5a7b407e325d71f3c84207c63a703d6cf6a967b36c729cd3c8acb04dcd96b7a7e56a457183baa0c32b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974186, "uuid": "88ebfa25-a783-49c5-83aa-e16690fdd929", "value": "T128338DA5C4B9ADE8D2148E74BD258E788763E100C6932EFAEE4486599047EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974186, "uuid": "8a46385f-367b-476a-abd5-31c8dbcc0d6c", "value": "768:waIwqwtOZc5p3hnYep3v0Gjdn/fAPs3g58cAlOSpE4rC/oIaNCy:wanqwtYduZxAPs3gvAlZpEyvLNCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974186, "uuid": "c572ca5e-535a-49b8-bae7-fa67a565a452", "value": 51072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974186, "uuid": "14c8f3aa-2b37-43a3-8afb-36b1de4496d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974186, "uuid": "f11c06c4-109e-4704-8a5e-a8ef7ba8ade1", "value": "002683b78b498f0026d08ffc0b0674b44b7111c8a424c801839ecd0f67d8c54b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b09c42-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974193, "uuid": "e41e22de-9e02-497f-9045-ba85a1439eaf", "comment": "Malware payload (Mirai)", "value": "1576d3ae9fcd39c299a422cd2430875b", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974193, "uuid": "17fd8cf3-7f94-4ba3-a2f8-c314be45d31b", "comment": "Malware payload (Mirai)", "value": "0026c823e07f94cc2bd4d11488dc0a6dc446884f3c73c84b8cf80c05c9544f47", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974193, "uuid": "db9b86fa-cf44-46c1-8bdd-fafd02985f2d", "comment": "Malware payload (Mirai)", "value": "997bc45b8a4d13df3bca563e2e0244639351b155", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974193, "uuid": "7422a1dc-a1f0-472e-b60f-3d232857d5d5", "comment": "Malware payload (Mirai)", "value": "f07aa2886821041e603f30ff511328bed6cab7b42037ed0f25fd386baf7fa0004040bea115eef10a587462b262c35532", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974193, "uuid": "51f5eb10-cb4c-46fc-9e68-affc53046b92", "value": "T16EC3A61D6E215F7EFBAD823987B78E21924833CA26F1C585D15CED011E70389742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974193, "uuid": "a41615f7-73e9-45fd-898b-4a158bfd7d82", "value": "3072:j27nXTv4NxJxo3/TmYgyubAUSx1ug+PnA4uFY3/e:8r4/noPaYgyubAU4ug+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974193, "uuid": "ffcd4f11-700c-4c10-bf16-b7e3d878ae2f", "value": 129492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974193, "uuid": "dd485e56-4561-4b32-a998-e98d76f2d750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974193, "uuid": "f4296c6c-297b-427b-983d-25667579ed92", "value": "0026c823e07f94cc2bd4d11488dc0a6dc446884f3c73c84b8cf80c05c9544f47.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76af569d-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974200, "uuid": "afc4bb0a-83f3-4e07-92fa-60a8298acac9", "comment": "Malware payload (Mirai)", "value": "1a32f2028f844db73ba661c3021a441d", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974200, "uuid": "12b8da18-0683-4b0e-87e1-14bd6306e18e", "comment": "Malware payload (Mirai)", "value": "002936cda8c99d2f34a7dd5063a9a135cf71d9e442cd0d80c56a2724061e0a0c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974200, "uuid": "743f1565-c4c1-4785-9ef5-1bd7cf897234", "comment": "Malware payload (Mirai)", "value": "06f7b0ce4c864f8f810a4ef1e0e025616bacce5f", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974200, "uuid": "df4a9455-c678-4311-b830-e2c6e53befbf", "comment": "Malware payload (Mirai)", "value": "97da929f38829da2606d73c9b8ae3dc49a54586e902db2e36e8d074b1d862aef87119861b1b8ee3460d43f7c467bddc2", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974200, "uuid": "e90bc3b7-4226-44c4-8d56-40bb27b18249", "value": "T15FC31977A61C0783C49B55F03CA73BF18F69BEB312D61184A209BED41B72AF12522F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974200, "uuid": "fbddd8e5-1731-43d3-9b60-e1e2a5a596e8", "value": "3072:OJvK1YrOqmoThXSG3W+ZmPWmqYQcuLwHnFSNb:OJvKyrjm4hXSwWcmqYQcuLwHnFSNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974200, "uuid": "b891d594-bd4c-4d21-b97d-537b6ab99381", "value": 121095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974200, "uuid": "e9d70c6c-289e-4fda-9a6b-e1cffe1f7612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974200, "uuid": "3970d17c-5f34-4b4d-92b4-6e5a77dfad4f", "value": "002936cda8c99d2f34a7dd5063a9a135cf71d9e442cd0d80c56a2724061e0a0c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9024b7-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974206, "uuid": "b5a78a79-eb7a-459e-9c0e-7b43fcb83cdb", "comment": "Malware payload (Mirai)", "value": "d2fc228c13bea28f191e3a265a1c9f47", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974206, "uuid": "2fb64716-2a65-48c8-a795-63deb299ea7a", "comment": "Malware payload (Mirai)", "value": "002cf64953d20dae077980108b5651751035cc1f5ab5f72d6d63bfb0cc276bfb", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974206, "uuid": "f58f77e4-3568-4feb-8432-90c01e5d374c", "comment": "Malware payload (Mirai)", "value": "55ca99b3422e52999ff754d3eb2670d4e32af721", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974206, "uuid": "bb407b6e-eece-484c-8c80-e2ac68e6a3eb", "comment": "Malware payload (Mirai)", "value": "e3939a87c4300ef3e815ec5c3fd5e8f7744129f9afcd10b76a4469efd6ae331871becbbb2b1ef4a3ef48e05c1604531b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974206, "uuid": "150e4641-5669-4570-a323-58d2d1ad98d8", "value": "T138E2E1BE121934E8ED1AC4BFA35B07902DB50BB7B053E84EA460EB975752071B487D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974206, "uuid": "fdb2cebe-f108-4491-a5df-91f19c8c7cc6", "value": "768:BYEBdwBvNB/M1ND6Gb2n+HIeSnEMZZ/XKh5cHvQk/88JgGlzDpUYsC:BYpvNBE1ND6GvIdnEO/6b4vp80VqY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974206, "uuid": "dd96f7b9-f45e-488c-9fbb-31c84b027fc1", "value": 31436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974206, "uuid": "54d31e43-73a1-49ef-97aa-5080c204d5d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974206, "uuid": "8663adfa-cd8d-4629-b491-09c6d115d872", "value": "002cf64953d20dae077980108b5651751035cc1f5ab5f72d6d63bfb0cc276bfb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efa4596-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974214, "uuid": "33b6ca8e-277c-40cc-9ccb-0c3ea5bdc2bc", "comment": "Malware payload (Gafgyt)", "value": "30d926ad448981e3dd2ca40c29b0a46e", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974214, "uuid": "9ae2327e-6b06-4925-8158-6f66605779b4", "comment": "Malware payload (Gafgyt)", "value": "002d94ffbf0671426860b10668f782e09869bf7e89061cbc414f669448e3b284", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974214, "uuid": "dbc42f7a-fa44-4c1a-a948-4f2061715d03", "comment": "Malware payload (Gafgyt)", "value": "7a8637024fdf1fae27a2837865b843fb691dd8f8", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974214, "uuid": "bbbf7420-8b7c-41b8-8f07-1dde9897a9f0", "comment": "Malware payload (Gafgyt)", "value": "0a80ce85a6a2e94daaf16febd0f22b7b09e34b96eac2c6e1fdf352d1d658772a8e2c07af77d507a8b9b4016d2398183d", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974214, "uuid": "93e1885f-ca18-4392-a61c-63273ab94e45", "value": "T132B34C4798609F73C045AAB126AB5930072AF9120F4F1FD9757CABB44B0F5CEB50EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974214, "uuid": "0c6e382a-1d60-4327-be53-8a59a48fd393", "value": "1536:5HGGT5UKn1CDx1KLUrMrh8FLGXAVwU7COe5hQxynpELnke0PEkjgQIoQ:FZUXDxcL/8FLv7E5hQx/Lke0PEqgQIoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974214, "uuid": "ba50c6db-7246-4dc9-bc42-31f2b8ae73c2", "value": 112299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974214, "uuid": "1c1e09f7-fc09-4336-8127-c17847d6d56e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974214, "uuid": "6242280e-2538-4748-93c5-f34bafdfb99a", "value": "002d94ffbf0671426860b10668f782e09869bf7e89061cbc414f669448e3b284.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e68d64-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974220, "uuid": "e2672b68-d01e-4d04-a94d-d316adc7f21c", "comment": "Malware payload (Mirai)", "value": "62704230c407f9b264764b001a0e9473", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974220, "uuid": "2ce6c72f-d60a-4bf5-974d-baa52d79e14b", "comment": "Malware payload (Mirai)", "value": "002ef31de78d34188fd86b1b622c9498ad5a5a2583c5c9e7d46639249b5eefcc", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974220, "uuid": "146603cb-6190-42fc-b77b-1863ce6e0fde", "comment": "Malware payload (Mirai)", "value": "a03c3edd69e52d11a5ac6ed16c321da1da70b67b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974220, "uuid": "339f632c-eb46-4b64-b22a-c47e0f7f65ab", "comment": "Malware payload (Mirai)", "value": "dc566eb83f878b15158625c36c92ee714c06b1e0025160c76e51b9d918e5cf6ae4aeddf680d90000728b987483af2206", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974220, "uuid": "631e3e35-775a-47ef-9f11-d43d68dc6d80", "value": "T15793D605BF610FF7EC6BCD3709A92B05198C554A22A97B367A34C82CF65B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974220, "uuid": "f4209eef-0d49-4763-aead-606034322c10", "value": "1536:M+0vBLpALWKp4z+TLw0eQ7KsRp/Bin0ZaL6LTA:M+0vVKWBALfVnin0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974220, "uuid": "0b583ef4-5afa-43a1-abd2-efd9a6822da5", "value": 97572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974220, "uuid": "5220f978-aeb8-40fe-ae89-771bec6e9c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974220, "uuid": "26c21a02-b061-40fc-b82f-8fa1d73603a6", "value": "002ef31de78d34188fd86b1b622c9498ad5a5a2583c5c9e7d46639249b5eefcc.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e4c1c0-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974227, "uuid": "05ca4ee5-ea27-4736-91e8-ff4989849884", "comment": "Malware payload (Mirai)", "value": "8d3b744715ce2948301fa65e3fd1696c", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974227, "uuid": "97e38b40-6b72-4cf4-a0ed-86fc776a1fb2", "comment": "Malware payload (Mirai)", "value": "002f880220481af536b9561cccc797627331339c90e5ed19b0da93997f800180", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974227, "uuid": "5c4ca258-4477-4eb8-a4a4-3a9e04e523cd", "comment": "Malware payload (Mirai)", "value": "67133c9ae3d0957d308d56a610557e76e171ac04", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974227, "uuid": "abce07ef-9082-4d27-b48a-fddc586767f7", "comment": "Malware payload (Mirai)", "value": "9a6a852dbc4eb42803c717214229f45fe841fcecc95f4e342bbf060ed7f3592da67a2ccbdc46ced5a2bf0bb6015d4941", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974227, "uuid": "1c343283-cb36-4bec-96ab-03d93633d4a0", "value": "T13AD2D164278C79B0EE204C79D8598247576B8BF9B98E706267C013C11A83EC7FBF5663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974227, "uuid": "ef4a417d-f15c-4811-9d5b-d4a0d4f8e917", "value": "768:2jTm1J5IOtTGEB3dmH56We6cLGQgyo3Spfos3Uoz4:WTgJ5vTnpdmH56We6cLGQvASrz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974227, "uuid": "5ab64895-5f83-42b6-824f-503093cf443e", "value": 30704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974227, "uuid": "1526a612-1821-4d0a-93a5-31dbbb1db0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974227, "uuid": "edb9a75b-11b7-4347-ad84-a9e3dd33a16a", "value": "002f880220481af536b9561cccc797627331339c90e5ed19b0da93997f800180.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ace251e-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974234, "uuid": "14639fe4-c6b1-4114-8170-1779c08995ff", "comment": "Malware payload (Mirai)", "value": "5d5e796322367ca7e5db5dc20a27034d", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974234, "uuid": "ced21870-f626-4148-a2e1-fb2f27ad753f", "comment": "Malware payload (Mirai)", "value": "002fdc5c8546fce39c14f2d6fc8e95743b62d578a367f100e3daaf661023e45e", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974234, "uuid": "54c449dc-7790-4c7c-a28f-cf17d056fa7f", "comment": "Malware payload (Mirai)", "value": "f378245b5fa44a0b1e429f30ee6f84d6dca2f955", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974234, "uuid": "11a88d88-01d6-4f48-89e7-275a0235e549", "comment": "Malware payload (Mirai)", "value": "9c9a583852737f833814b8a5929dc6fa60224b32b6495cdf4937004faa9c3ddfe269a63c80970e758f543f90d8ca948e", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974234, "uuid": "2301570f-5bd8-48ef-a568-4c926d0167a0", "value": "T1FC634C02721C0A97D5671EB4353F17D093FEEE8025F4B688694FAB0A8635E731986F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974234, "uuid": "8f5da37d-ee18-4ef2-b308-db472a45d40e", "value": "768:g8Gcrbyuf189rX8FaF62M4+JgFby/E+RmhfpHBkqa404hp1CAzsDUOLXdEyrUN15:JGluf1vaxfsqTOLXyC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974234, "uuid": "3498d6ea-8e66-4b16-9992-4a4f99253dea", "value": 71100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974234, "uuid": "5308dbff-6cc3-4634-83eb-ad7e6b45bf6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974234, "uuid": "474bbe40-ef89-4917-b47f-04b93d12b436", "value": "002fdc5c8546fce39c14f2d6fc8e95743b62d578a367f100e3daaf661023e45e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebf939c-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974240, "uuid": "f0e102c3-b463-450e-be35-b229763d9c61", "comment": "Malware payload (Mirai)", "value": "e21a64d07c2e0602da5ea368d6af67e0", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974240, "uuid": "30334721-62a7-49bd-a869-ca0b9b23c804", "comment": "Malware payload (Mirai)", "value": "003048345e910a255e544ed3068ef7c2f323bd0e8add45cc0e2b26bd69c99fae", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974240, "uuid": "cfea62e4-4314-488d-885e-d04929782298", "comment": "Malware payload (Mirai)", "value": "7341de5adc1dc7a54c27395e5e9cf0b716fc0370", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974240, "uuid": "51e4fcbc-1743-47ff-9a2c-60d7e64b0732", "comment": "Malware payload (Mirai)", "value": "5990b5fae022134dae432b1df52c4746962cd086aed6a7433d6afe488382fc424e414e2187a0031d2f92f1c94fac848a", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974240, "uuid": "9ef69c95-d625-40ab-af75-91ead9cac535", "value": "T11A639409BF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F09E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974240, "uuid": "cca30c14-3d5b-4cd5-9056-33d47de1821b", "value": "768:K+xGiJEEYlDIR99LYkLUAJtw6OC5f2eaeyWecfkoN3pkavdE5tXirnM+ufp:K+xGiJxYlkTpJJOCgvjWrfgrAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974240, "uuid": "34e9ed76-7b88-4dfa-aa2f-a56fceaf42be", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974240, "uuid": "cff8e085-9989-445b-aa79-fb1dcb39c48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974240, "uuid": "84f4dfa8-013b-4672-a9e1-ac8470b80295", "value": "003048345e910a255e544ed3068ef7c2f323bd0e8add45cc0e2b26bd69c99fae.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b5fcf8-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974247, "uuid": "11fb0ab2-cc54-4dc6-b266-717431788500", "comment": "Malware payload (Mirai)", "value": "17c0791e621c762d1613b332e3ad4fc4", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974247, "uuid": "1924aee1-541d-453b-bb8b-05b270abc590", "comment": "Malware payload (Mirai)", "value": "0032479048da1d3773af696082680738a1116170f19d82e4efa14996a3cab1d8", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974247, "uuid": "7e9fb4cc-fbc9-49fb-88a4-f228927c7a53", "comment": "Malware payload (Mirai)", "value": "7096774a29110699fbb771feaea231c7451c5b9c", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974247, "uuid": "fc0bf231-4ffa-4452-8b75-6ba7c27dd49a", "comment": "Malware payload (Mirai)", "value": "68df3889f667fc35669ddf0618f2609bc7f98376cb6198e0f91df1240718c31a61a50a634afcdee56385835ca4151521", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974247, "uuid": "bab1988c-93b4-4b0d-9f6e-9c0670546317", "value": "T1ECD3D93B37170A23C0CA507101E30732AEB5DF9B34B95397A9E07D682F36A943956BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974247, "uuid": "8a94d664-8b01-4fad-8102-a2d260cab319", "value": "1536:m37DR+gZWz+SY81Zk4+rN95KxXtw/CtfgZJcT4sX5mqH4QMurWC1ndFdNb:gZD8TVwNPKxjOZWTx5mqYQMur/1n3dNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974247, "uuid": "fcda0d0e-9ee1-41a4-ae16-a8aab27debb9", "value": 132253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974247, "uuid": "700bf9f8-6aca-4304-8d04-524fe528135a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974247, "uuid": "9872eede-b85d-464c-976d-e122b718703a", "value": "0032479048da1d3773af696082680738a1116170f19d82e4efa14996a3cab1d8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a69d64-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974253, "uuid": "cbf21667-1baa-49b0-a49d-84e8ce875e51", "comment": "Malware payload (Mirai)", "value": "25bc49e7d577e5e3a7a676c66bc711a0", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974253, "uuid": "7ad8b11d-3270-418e-bd07-14309be6ccdc", "comment": "Malware payload (Mirai)", "value": "00325fcc368c7b667919a9cdbfcdbe3475772f25edba3d23cd562d9e20d9a8d1", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974253, "uuid": "db4fb464-8273-4169-9555-0ff1cf64d1fc", "comment": "Malware payload (Mirai)", "value": "9cfe40ba6e3c7efaf0e89a9127bbd367c4e6a183", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974253, "uuid": "77c1de41-18a1-483e-a7ff-a4c9d501d689", "comment": "Malware payload (Mirai)", "value": "80b68cf4c4820cfaa02ed90fe3f2e37e9b9b0799a4885fd679b003ecb09ac4a79638cdbf6f88d483090b482cdc537fbd", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974253, "uuid": "ab1a91b9-de25-46f1-b44d-fecf2aed1317", "value": "T1B4E2E1AF9FF67584C8AC9C7A70EA03BA0654728473DCD71987606C46372AA47F8DC4C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974253, "uuid": "7cefb38a-1707-478b-b9ac-36202b244b19", "value": "768:G4JlYBuDo6erp03CeIpLuoxfEZBZXTYLgcpP7B3GWF:G0KBuGrp4CexZBZj/eP93x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974253, "uuid": "3aa57564-cdd4-4d87-abb3-d709533094b0", "value": 31992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974253, "uuid": "b9910e42-9d8c-4052-96fc-58a5cef4d52a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974253, "uuid": "ff4ebc7a-2344-4061-bcce-b9c87932495d", "value": "00325fcc368c7b667919a9cdbfcdbe3475772f25edba3d23cd562d9e20d9a8d1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa50a57-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974260, "uuid": "e09169a8-58c3-4488-84c0-753371ee9297", "comment": "Malware payload (Gafgyt)", "value": "9c909f68a4d6047f58fd4a900fa960fe", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974260, "uuid": "a1592240-cf58-4a8b-928f-547f6c3b5357", "comment": "Malware payload (Gafgyt)", "value": "00339f44fd80f379d41c33c968c2cb0a5984d33888bc2ff5436e81b28f180598", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974260, "uuid": "b000b446-0b27-48a9-a594-9e019d750632", "comment": "Malware payload (Gafgyt)", "value": "7d88b60d1e89842b59b80d19083e5d0cfda24c45", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974260, "uuid": "add2ae9d-3bf9-49e3-91c3-30909d3ae5ed", "comment": "Malware payload (Gafgyt)", "value": "2a3a2b5d54905c1bff2c5244c3f5beedb677fa292eb0d42672670ca7e86ca1a1a390ebf77f4f271efb1b1a0f6d667e10", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974260, "uuid": "aac82752-3838-4009-8dbe-4f5fcde8a1b6", "value": "T1C8B3A52A7E22ABFFE168863107F35F70879521D227A19386F26CD7181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974260, "uuid": "ba27004c-6fac-442b-bb80-22e829d9f1a2", "value": "1536:Z7j+1T6Bq+bkYQE2rKhpWx5nZLTv8LrGV6e6No+4sFlR7CimWt0zFufCy/02vI:kALOnZHErGG2+4ulgimWOzFufJ02vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974260, "uuid": "a57826c3-3281-4fd1-a815-b5e28a3b9a48", "value": 113279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974260, "uuid": "997653d7-b950-418d-a698-392b96fbd43b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974260, "uuid": "9b64c252-70cd-4ca0-b8cc-e588bce9446b", "value": "00339f44fd80f379d41c33c968c2cb0a5984d33888bc2ff5436e81b28f180598.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7ad51d-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974267, "uuid": "e066dccd-33f7-4135-9490-5f12c943716c", "comment": "Malware payload (Mirai)", "value": "86579dce87e2edeca7cf8a31a062e8da", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974267, "uuid": "0ab111f1-be72-481b-ab75-ba3897dd67ec", "comment": "Malware payload (Mirai)", "value": "00344d7683ea901891c72d83e75965770c67ea7208e176962ecf0d2e12be95b2", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974267, "uuid": "2bf0959e-b9bc-4b76-9094-2f985e837675", "comment": "Malware payload (Mirai)", "value": "8c80b2c6174d6435538efe414b3912bae4f11f46", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974267, "uuid": "7ea3a4bc-3b1b-446e-8743-4996239e7081", "comment": "Malware payload (Mirai)", "value": "b1d1449c5c40cd02d8a4b3d2fd39b2633e525dbc793a2211bdbf9439d5d7c890e579ebe0858d94f3e07fa7147d0250dc", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974267, "uuid": "85f206b0-f72f-4d69-b754-b92e6a76ca20", "value": "T134B2E114AC1A9DA2DF788836B99D8BD3739715E4B0F939100C8D88D825CBA0F06FD2D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974267, "uuid": "ceb5f550-680f-46b3-99b5-03703e8fe9c9", "value": "384:oIdlsEBnv+tZzoF00WDubhMvseGLm7WnIP6KIKsiiXA2q891hymdGUop5hq:hdlVBv+HoyvPGLVne5siiXXqq1s3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974267, "uuid": "116eff1f-e0c2-4ac7-98d5-cfe37fb1a1f3", "value": 24408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974267, "uuid": "b801f19b-3e03-4ce4-900e-8ae56400bd92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974267, "uuid": "48641ed4-8d76-4d20-92f3-332551663d3c", "value": "00344d7683ea901891c72d83e75965770c67ea7208e176962ecf0d2e12be95b2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a276aaa6-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974273, "uuid": "5916be1e-63c5-4f2a-ab98-33bec3444208", "comment": "Malware payload (Mirai)", "value": "d53c0615be80456bd49efa4c138fba7c", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974273, "uuid": "a4154f92-1e2c-4f24-9353-ce716cf65579", "comment": "Malware payload (Mirai)", "value": "00373718f3b033fd2158b9fadd8fa7c7d20dc81931217f0c752d28f5120452bd", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974273, "uuid": "499bd155-af0b-42ea-b3fb-abb8f7843e17", "comment": "Malware payload (Mirai)", "value": "58ba03ee200a8fa2394de25d1eb5534bfdfcb474", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974273, "uuid": "d5129878-819b-4724-8b61-8842ffb08953", "comment": "Malware payload (Mirai)", "value": "c75d6145cb8ea39c50cd004bf70b9784e5209b08dc9ccec0f5ccfb2e0249efaac6aaa4ab8d70e86c0a7130405e7a106c", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974273, "uuid": "a52ac263-33b3-49a3-9280-5b92f0468757", "value": "T12A63840D6E315FBCFBAD823587B74A20964933DA27E1C584D19CF9025E7024E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974273, "uuid": "64040285-a25e-45a4-8978-477b00ec964b", "value": "1536:OjN6hrDuLen1rJMpGfvQ7rMy8F320OCUbB/rJ/nm:usuL2mpqvQnKF320OCUlRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974273, "uuid": "780ec10c-3216-47eb-a2fa-474e06a5fe43", "value": 71808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974273, "uuid": "3d2bd9da-6315-47a9-85b7-d7ba78126dfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974273, "uuid": "6a1d5732-5b89-4d02-ac0c-f7067f751e96", "value": "00373718f3b033fd2158b9fadd8fa7c7d20dc81931217f0c752d28f5120452bd.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b57d5f-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974285, "uuid": "b1af6d3b-bd85-487d-92ae-ed220cdfbcfa", "comment": "Malware payload (Mirai)", "value": "55ad53d3e92518b7ec44d37034adbfd3", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974285, "uuid": "5cfa5f3d-9cda-44c0-9f55-4960a37b6ba1", "comment": "Malware payload (Mirai)", "value": "00390c33dc5097f0a1964e3d40f6776835f745c3c747b3499e8967fdec096a3d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974285, "uuid": "382ff555-7411-41b3-aa49-ab5fe598b29f", "comment": "Malware payload (Mirai)", "value": "819cc5c0bda6c0dbf119dac7723d475bd66d2d41", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974285, "uuid": "2f882346-4cb7-4f00-b6fc-06bfd174fbb3", "comment": "Malware payload (Mirai)", "value": "1aef6869b2ac9b5ce13d435b678da82e63c1f93eaa4a322a26a0afa7b6cccd0243199f7bb38ce8e21e70689c048e2acf", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974285, "uuid": "0a4bd1a5-b4c7-48d0-b3c8-d68a52739349", "value": "T10EF3E844EA04872BC2D377FAEB5D028D3B391F9477EB37115A3479B427E5B682A3A110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974285, "uuid": "e6341416-85b0-4c21-b0c8-5b2c728adc2e", "value": "3072:GZebdhVe8siEfunGViQDLgO9OOeY65kQ4WXUmRAZaQhSCWizvBNU:GZQVV6PViYL9OOeQtCUmRAZaQhSCWiz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974285, "uuid": "0a68ea63-efc1-4fa3-b8fe-40231ee363e7", "value": 166568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974285, "uuid": "fe9dd846-b503-4788-a0ad-849476c168a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974285, "uuid": "eb554b45-4fa9-4294-a38a-6fe5f5652604", "value": "00390c33dc5097f0a1964e3d40f6776835f745c3c747b3499e8967fdec096a3d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc01c46-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974292, "uuid": "f427e06a-e482-4826-ad1a-b9cee645869d", "comment": "Malware payload (Gafgyt)", "value": "24327c58e1c5f0465fef1ce3409812e4", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974292, "uuid": "08ea0116-289e-4698-8341-a08c01460819", "comment": "Malware payload (Gafgyt)", "value": "003af394126e6bb1b7fed7182a0a13d1ab81a5d23c56b9a3ead97090be8bfecd", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974292, "uuid": "376a996b-f0a1-4205-bf23-2da660d290ec", "comment": "Malware payload (Gafgyt)", "value": "23c0f34010985b26626ca297ba991ffad9bd66ae", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974292, "uuid": "d93ce7ab-7787-4d0e-bbe0-7724cb398ace", "comment": "Malware payload (Gafgyt)", "value": "1df8e887843cf7280fe358f63833b343b3890141bddefb80d31d95d94197d27d592f7b0dddaf1a5688a2de9be7bab1ea", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974292, "uuid": "86b7f661-ceee-4b2b-a67e-cebe6dc9787f", "value": "T107B34B37B561C63AC08752B127DB9A519C13BCBB1F72320B73987DA52F358C92D5AB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974292, "uuid": "5d8bc2c2-b5f8-46e4-b119-b041deb0bda4", "value": "3072:uirTfgbMXJfIcReqb3OD6HVNVhRajOHlm7FnVqfJXFdbNb:NIMp0qDCs5ajAm7FnVqfJXFdbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974292, "uuid": "b23fd26b-69ce-4821-be12-788b69df37ca", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974292, "uuid": "211a20fb-b652-42a1-8fc3-dec027694c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974292, "uuid": "85b2540e-9b1a-4604-8e23-a3935c357be7", "value": "003af394126e6bb1b7fed7182a0a13d1ab81a5d23c56b9a3ead97090be8bfecd.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a6e7be-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974299, "uuid": "072f9f0c-2f87-4d3c-820f-4699bb9a53e1", "comment": "Malware payload (Gafgyt)", "value": "30a47d9504cb0700eba1394830bf21cd", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974299, "uuid": "66ec9c38-7f77-4779-8362-8dcd15001dc2", "comment": "Malware payload (Gafgyt)", "value": "003afbf4ba311870e63f8e091013ef0636077824e98070c1a5bcf2d422fd852e", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974299, "uuid": "24a26bf7-4bf8-4823-bba5-eba3707ef6ab", "comment": "Malware payload (Gafgyt)", "value": "d55dc67619c186b829937d63c0a46abdc4b5820d", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974299, "uuid": "227fc0cf-69e0-45d4-b364-bba7d201a75c", "comment": "Malware payload (Gafgyt)", "value": "2b4ed50510d3594b9beb921c1378d1164fde83ec468810bd8fb12a7359e365933c0fdf1e15c78c228807c520f04d3c10", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974299, "uuid": "82221727-f680-4b2c-9581-1053a72aba71", "value": "T1C3934D81E640C6B3D09F0BB9019B5B112533F6BA6A5B9D57F31C6CF0CA07941725AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974299, "uuid": "bcd362ba-5af3-4497-a29a-cd041672b69f", "value": "1536:0WbDP7BRUVU4e/izb6C/Qdk5cc/z4d7J2cNU5mZ5hrV7w882PM37K8PN2UrYe:Db/LUVUTqbpQdScc7M7JFp5hrJw882Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974299, "uuid": "74809d80-bf51-4c23-a11d-1b14258c3710", "value": 95107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974299, "uuid": "2eb7fe80-7e2e-427b-99f0-bbb4b91a65d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974299, "uuid": "c21eb965-8f74-454f-8a25-be5f393c25af", "value": "003afbf4ba311870e63f8e091013ef0636077824e98070c1a5bcf2d422fd852e.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f14e0b-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974311, "uuid": "3bcddc9a-ad35-41d1-8c66-699bb9717c9f", "comment": "Malware payload (Gafgyt)", "value": "6a81ec2a4509b2a5f8db6ee5d9a7c935", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974311, "uuid": "7540829b-9eeb-4039-b130-1fac29920d5b", "comment": "Malware payload (Gafgyt)", "value": "003b15d63aff5224a2186fd5f23dd308d5a472953245199fddd93d4c8fbb23a6", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974311, "uuid": "9b5afaa5-bf48-4e98-a229-f2fe5663cc6d", "comment": "Malware payload (Gafgyt)", "value": "be17ecf27426c8854d6f09541c6959b5e1a9170d", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974311, "uuid": "bc806c32-6471-4759-b764-9d50c44da286", "comment": "Malware payload (Gafgyt)", "value": "2384980d74d68de569ea1aeb1c4496e2f783b79c63041e340160efef96ddecd3ba8c5455e6bc1406486363e4807f8037", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974311, "uuid": "b7236139-3830-40a9-8bb0-2489a81fb482", "value": "T1DF735B456280D6F7D14316F1069BAFA8033AFD3A1ABBEE85F3587CF48B710847A25719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974311, "uuid": "9118ddb8-191a-45e7-bf61-27d5463a961a", "value": "1536:8W4lw16yastO49zyje4MkJLwDnOD8B52rf3BstzWT/O/sraozh9FLZ5:8Wx6R+x9zyje4MkJLwDnOD8+rfRSzO/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974311, "uuid": "f5472dee-ac80-4610-b3d8-665a57dff4bc", "value": 74501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974311, "uuid": "087a12d4-fce9-43b3-b9e5-a39e903f7a28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974311, "uuid": "5b9a28f5-736b-4278-8018-70869b0474f4", "value": "003b15d63aff5224a2186fd5f23dd308d5a472953245199fddd93d4c8fbb23a6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf39db3-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974318, "uuid": "a30259de-ebd7-4526-aae1-7d5525317004", "comment": "Malware payload (Mirai)", "value": "2a0b7f16db5aed804c69c300b55412bc", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974318, "uuid": "76f6cb99-a2fe-46d7-92f3-c4b65a247a88", "comment": "Malware payload (Mirai)", "value": "003b259b6f830d298aee6b380471564fa37d9e222c6552d383a4138217e36dbf", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974318, "uuid": "ddc8491e-48be-4c32-bf92-3ddbbd0b98b9", "comment": "Malware payload (Mirai)", "value": "ff96a4a08d3a4a08f6fbf31ecf1d2dc2bd8b4806", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974318, "uuid": "256d1a2d-78c3-41ef-aa26-988576294c6c", "comment": "Malware payload (Mirai)", "value": "ba2df01850a48a026a816ed4c691cf6b87293eeb5ed25b66f050b7a9460573e7851e22da069340b265e3e53f0e862ab6", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974318, "uuid": "e812bb47-bc08-4d28-9967-9b1d981910ce", "value": "T1D0E34C86FA408A13C5C61B76FAAF424933229B55E3DB73068D185FF43F87A5E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974318, "uuid": "efb33e6e-2431-41b5-ad89-2dd4bd36d363", "value": "3072:Pib6EdR0WkEZJYqNopEjuvMuK/U6YQXOaXWZ2M/94/r:WnRpkE73uvMuK//YfaX9M/94/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974318, "uuid": "e3d611f4-63cd-401b-81c8-8dbee5386aee", "value": 144087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974318, "uuid": "48a71c14-727c-4aa2-822e-16c97b4fbe85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974318, "uuid": "86b31c31-59cb-4dfc-81f8-1f402a742d6f", "value": "003b259b6f830d298aee6b380471564fa37d9e222c6552d383a4138217e36dbf.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e79296-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974324, "uuid": "15b3c955-debf-4a0b-a002-d430ef3d3e3f", "comment": "Malware payload (Mirai)", "value": "fdff25321d6d6fde18dee9dfb5c595f2", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974324, "uuid": "e9ffacf8-5fd7-4c7e-826c-6309267c4a69", "comment": "Malware payload (Mirai)", "value": "003cc7e4bda9dc1bda94a52cb57baaf3e32a6fe0ef7988655f26ff890bf99a2d", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974324, "uuid": "27fc419e-3df8-4fcf-beb0-2d69bd6d024f", "comment": "Malware payload (Mirai)", "value": "4dd52ff94c2e32189592c9710ddf9c5ac313c81b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974324, "uuid": "1cd3d00a-3c8e-4eff-ba22-09660a9eb53c", "comment": "Malware payload (Mirai)", "value": "b4963c2246a8df09bf3b48dace0540a8f057f340174c1da8959d5ee1bbd43e486974d1f6632de3f024bbc4190c4982ab", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974324, "uuid": "523f18f3-cef0-4d3a-87fe-316567d89f96", "value": "T10A534B22A8B92E13C0E5F57B22F78324B2F5170E24A8C66E7C760F8EFF1855065576B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974324, "uuid": "d5d11008-a768-4d42-842d-3607994430c5", "value": "768:o7TS61ooq9fg/po5FCIQboIVT+5JPdIei2py6WlxOO+hBCNFEI:gTS61tSfg/peC7boIVTIJPdId8h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974324, "uuid": "939a3e0d-50e1-48b1-9564-e1aa7c6a837f", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974324, "uuid": "af60bc70-25e1-442d-a818-7015a77b0de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974324, "uuid": "4ec014fa-5bab-4fa1-ac10-78ce3073b603", "value": "003cc7e4bda9dc1bda94a52cb57baaf3e32a6fe0ef7988655f26ff890bf99a2d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d9bb17-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974331, "uuid": "583b1e2c-39c5-46b0-bc78-7dde72c8d0b1", "comment": "Malware payload (Mirai)", "value": "e323c4fb4f7e9f552bf951d98652cd9c", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974331, "uuid": "202b3533-5524-4db1-b207-18c975b00105", "comment": "Malware payload (Mirai)", "value": "003d37839b46afd4ca20570bfc520f8425906e56185682265b6c81bf4c15bbb6", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974331, "uuid": "c3871c88-298e-4948-8235-4b508363d6f7", "comment": "Malware payload (Mirai)", "value": "a9c6076fb5082156239919c8ffd240e106c89472", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974331, "uuid": "df0ce01c-bdc6-4ec7-a18a-825e37bd482b", "comment": "Malware payload (Mirai)", "value": "0271bab199b4d6b97fa4c12466714c5fdb71f0aee0a9eb4753e08b661d0316fcec2a6d3dac725628859c973b26e87a82", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974331, "uuid": "0e061eeb-1f23-4109-880f-8cf4656b5c94", "value": "T1EF539EB5C4B8AE99CF699678B61488389723900565A33DFBD742C796D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974331, "uuid": "5773a9c3-9483-4196-a051-615673bf2a08", "value": "1536:c/bivQhunGauwt4IduUaosjT1Rw+XUfs3vt2jtm1BY3CJj+s:cjiBGFOdx4T1RMf+lv1BY3ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974331, "uuid": "d15758b9-8284-407e-8f5d-29a1a44b5780", "value": 64412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974331, "uuid": "cf0ab60f-2143-42c6-b7ae-b6fb934cc7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974331, "uuid": "23cbaa2c-3cbc-44bc-9819-11940441637e", "value": "003d37839b46afd4ca20570bfc520f8425906e56185682265b6c81bf4c15bbb6.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c561bf-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974338, "uuid": "dda305fc-22a9-4568-8106-17566a655292", "comment": "Malware payload (Mirai)", "value": "5daf885054595c9a7de3d175b16560b8", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974338, "uuid": "e75f9d97-e338-40e2-bfb0-935b5a427de4", "comment": "Malware payload (Mirai)", "value": "0040611ca75906dd078983aa19376168837aa4cf1882baaffeaa00ca6607041b", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974338, "uuid": "7ba9049d-4fd0-4a3a-bc14-9ad7e1e1ae42", "comment": "Malware payload (Mirai)", "value": "786941326f2781c882a101cbc3483580d0c2c9c4", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974338, "uuid": "410e0df4-a79c-4061-be67-ee0da5db274c", "comment": "Malware payload (Mirai)", "value": "71bda11b41f018979f57374fa3e73bcafeea586020e35af36d77484c41af6250a2f6fb9deeb432abc0b224e514617090", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974338, "uuid": "c7a3ecef-d2d5-45ed-a88c-23d01c749459", "value": "T15333028356D59EA0DF60327FBBB84A8E5BB237E6BDE3581A53251A704D10052077CF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974338, "uuid": "b1005a74-446c-4540-ba0e-52e465412453", "value": "768:9JomkQ+czIzxisfjo9tBJM9IgNuIq8gARmVb5YUCMt1oA9q3UELgCV7tn1BdSFzN:cmpgDjo9tBbgNuejSDCLJLgChajyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974338, "uuid": "1050bef8-70c2-447c-9cb6-c08d5be5b609", "value": 53296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974338, "uuid": "ea2a7748-7ac4-423c-beac-b7d729a7601d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974338, "uuid": "0c61d170-a579-4a3d-a2ea-a4024ede2b3c", "value": "0040611ca75906dd078983aa19376168837aa4cf1882baaffeaa00ca6607041b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb1bcef-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974344, "uuid": "f385fde5-e4b3-41c4-8fa0-ad5232d439f0", "comment": "Malware payload (Mirai)", "value": "7e9f7ce367c7502c8593fefa79c434d2", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974344, "uuid": "35133fb9-83c1-4cdf-b4d5-2de7a96cb3f0", "comment": "Malware payload (Mirai)", "value": "0040b0001a0a958248058163f089cce1b90d4a27f4280459ac18cb48336ae913", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974344, "uuid": "8b414cd2-6314-4712-adb1-d2b1a0710b0e", "comment": "Malware payload (Mirai)", "value": "7ecaf758a15de17ae1e26544d54d947d6a9c8fd5", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974344, "uuid": "71c1abdd-8aa8-4ed2-930f-5a089dc9c0fb", "comment": "Malware payload (Mirai)", "value": "b92ac60f85eef19b173153af8034df8cae860d5e10f8914fdeb1ca645282cede00cd02a0e54fa010c09f0a3f5face40f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974344, "uuid": "e12b4d14-f38b-442f-98b4-fa219189a2bb", "value": "T1AD83285AF8C19F01D5D922BAFE1E018D33135BACE3EE72129D255B2427CA92B0F77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974344, "uuid": "5637e735-7a2b-49ec-a673-252bfb4b9a35", "value": "1536:awnh2sDbKuWqZIObDnmVbqgyEcnCaxYsWULZohOB9l/8i5/srULY7Zw0x:HxbKShPhIcnCaxYsWULvD/srULuw0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974344, "uuid": "d4cabc75-5fa6-4553-83f2-a5d497e5bd5f", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974344, "uuid": "83a5eec3-8195-49c4-a99d-7fca40731692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974344, "uuid": "8eade6f3-9708-455d-8f39-cb0b3ad28962", "value": "0040b0001a0a958248058163f089cce1b90d4a27f4280459ac18cb48336ae913.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a5c660-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974351, "uuid": "5f542f5c-f32b-4bad-8b67-7dda85daa9b7", "comment": "Malware payload (Mirai)", "value": "d80c400a448d7847d9cda81c03b53b50", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974351, "uuid": "2b4b43ae-6171-4755-ab17-3d35ad2ebeab", "comment": "Malware payload (Mirai)", "value": "0040e2b7bc3e72ae73fdafc5d0a68ec1f5fd94d53bf4dedbb8b3d721a38b4cfb", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974351, "uuid": "db01c1ef-83d1-4376-95be-6a5f170f91ca", "comment": "Malware payload (Mirai)", "value": "b42dee963f6c212614303b5b26067ff8391678ec", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974351, "uuid": "2446e9b3-a05d-49b9-b376-051cc1008aa2", "comment": "Malware payload (Mirai)", "value": "729ac22be9489a2666bf55f94edb17b482f51defad809899a47c10abf172252bd75dffce46b45820b480f8536ad37a15", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974351, "uuid": "7727682e-352d-4fd8-ab8e-5c346efb1aa7", "value": "T1AF2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974351, "uuid": "92ab58c9-7628-45cf-b4ae-58b33f4216f4", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2ire:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974351, "uuid": "65977650-07b8-4115-97bc-fab399d97f6e", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974351, "uuid": "fdf86120-1e35-4ea8-8fd0-1f94373cf889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974351, "uuid": "fd528b88-532f-4503-a2eb-4362ade2c566", "value": "0040e2b7bc3e72ae73fdafc5d0a68ec1f5fd94d53bf4dedbb8b3d721a38b4cfb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bae6d4-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974358, "uuid": "a05b6b04-6357-4518-bcf9-3caf139b8b14", "comment": "Malware payload (Gafgyt)", "value": "57a88a838e4951db97f4f5928edb7beb", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974358, "uuid": "48e58592-19ab-467b-8682-4aa304f4b1ea", "comment": "Malware payload (Gafgyt)", "value": "00414bedd14dba0cf9eb75e6a9b548e908fbd4b1cc371e009f608da80a140ff8", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974358, "uuid": "3448207b-9d7b-449a-b51b-3e02b046f311", "comment": "Malware payload (Gafgyt)", "value": "58c49a2da3f63ac8f0d74ba95830a0f3f1f413ad", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974358, "uuid": "da9523a0-17c2-45e0-aac7-5598598e3bce", "comment": "Malware payload (Gafgyt)", "value": "b470f806a91fdc8f7e8d66cc3e394379e69ef39a5cce756debddd0d8515b695f36e6e48f4289dfe540d2e16a67bdb070", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974358, "uuid": "a7048359-2e42-47f7-a7ac-3f5898b836d1", "value": "T1E9F3D644ED14577BC6D337BBEB6A428E333A0B94B7E773154A342A703BC9B586A36110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974358, "uuid": "0ed2a6bb-852c-418c-ae99-2b48685f111e", "value": "3072:fasLG6l8hdNvleue727sekON/lOxFXtGvpiOUZvEfeJ:f4leI7JllOxxtGvpiOUZvEfeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974358, "uuid": "3548d29d-a02f-4100-9c12-21a6fc44d2cf", "value": 164810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974358, "uuid": "66732f1a-3655-4140-be16-8f8e916647c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974358, "uuid": "cc2520d9-e7b8-42ec-8a2f-00cfadd8ef90", "value": "00414bedd14dba0cf9eb75e6a9b548e908fbd4b1cc371e009f608da80a140ff8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8aae08f-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974364, "uuid": "6d9355c6-1d38-4824-b31b-dbb210ead0dc", "comment": "Malware payload (Mirai)", "value": "3166882771522f78d1062eef8f874986", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974364, "uuid": "4da2f3af-3b5b-4a43-9747-7c91439b1551", "comment": "Malware payload (Mirai)", "value": "0044057f31895491c6dc14f63a5a683ba9353125bf1bcdabbb74dd7b2fe331ea", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974364, "uuid": "daa97770-69d0-4eeb-81c2-d1d151d7a993", "comment": "Malware payload (Mirai)", "value": "90df0898e5517f20e2339e4a49a3c85f359409ec", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974364, "uuid": "c3c5b2cf-5504-4fb7-adb9-64de4f2552cc", "comment": "Malware payload (Mirai)", "value": "b8792df8ffe01f15276ab3b57c7a5f17a01cd93c9123237464f7860ca361f61b0b8062950ce2fda46c8529e64c240ee6", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974364, "uuid": "3224cb48-8db7-43a9-8726-bc7bbadf2510", "value": "T19A333BD6B500AE7DFD5EEB3A84120E0EF121B6A141A30B37B37BFD979C32194591AD06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974364, "uuid": "a57d1398-fa46-4a36-92d8-2d8743c541e3", "value": "768:KKeorWUYlgZxLsACblvKB4PPSu14Ej9tOtIQZYjM8zYDp6:v1KlgZpXUvVPPrGE/OtLZY48Mp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974364, "uuid": "a1b2dcb0-0a8a-4383-b6ad-cb598ffc1069", "value": 53308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974364, "uuid": "3ac5dddf-8276-4a60-80be-c07288213369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974364, "uuid": "95d22e37-550f-4250-a2d2-4d8c6b28d270", "value": "0044057f31895491c6dc14f63a5a683ba9353125bf1bcdabbb74dd7b2fe331ea.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb09261-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974371, "uuid": "44baeff2-95fc-4fe3-ba34-96552a15bc08", "comment": "Malware payload (Mirai)", "value": "62abc830bc8cfafc5a0a9286e5d28e59", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974371, "uuid": "8bbb8d34-7d17-4045-8586-fab98214d7a8", "comment": "Malware payload (Mirai)", "value": "00455abafa369b871acbe58704831ea8dbb24d7731c2daca580a133cac602070", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974371, "uuid": "91c1d4a2-79a1-4f0d-b154-76b8ac80949a", "comment": "Malware payload (Mirai)", "value": "31cd3efad99f63fcf8f33ecb918721350f14307f", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974371, "uuid": "11b3fad5-595c-45cf-845a-ee8f2f9df155", "comment": "Malware payload (Mirai)", "value": "15122633d25c45bf31a0be56700dad80a6c71826937723a29a050da332ba066e8b4cc7ea4913cba59fd795b468ead699", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974371, "uuid": "0ec4bdfd-bb86-4fa4-8b6c-c2bbc355b01f", "value": "T14104653A7921AB7ED2A886310BFA6F74CF5529D327919341E27CE6185F7128C1C4EF60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974371, "uuid": "49a16f6b-cbc2-45f7-84b2-6adc4cd6d917", "value": "3072:DgNCJtjECo1yFGQ0Q8vPkbT4nanibeDDTTWWDTSeDCNg:DLJJHogFvLc8T4naneeDDTTWWDTSeDC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974371, "uuid": "6658f70a-e267-4d28-b54b-0503ecbbcc5f", "value": 184717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974371, "uuid": "5ed20cab-e772-43f6-a8c8-04c13b396ccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974371, "uuid": "dcd94d86-0368-4a8e-93b8-964df4e4ef81", "value": "00455abafa369b871acbe58704831ea8dbb24d7731c2daca580a133cac602070.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cca6fe-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974378, "uuid": "e94c65ed-144f-427e-9840-0427f796150e", "comment": "Malware payload (Mirai)", "value": "8351648f4505c079837c85b01c0cbe0e", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974378, "uuid": "07aa7435-1510-4a32-936b-b2b627014895", "comment": "Malware payload (Mirai)", "value": "004635d8edbc4112be2a2a68e42d4eba6941ff634b3378918816c490b9139797", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974378, "uuid": "6270d682-463b-4eab-b4d7-411da04d50a4", "comment": "Malware payload (Mirai)", "value": "5ed6abd18d546fa3c0628d834987a5fd01946408", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974378, "uuid": "c63941af-b171-4129-bf0a-f48210d8550e", "comment": "Malware payload (Mirai)", "value": "c0ddac0348fca15876d07ad58c885ae5394454e18c94b59baaa21adf98415df96b4676e3da0d1cb37848ee0ed2a4ad7e", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974378, "uuid": "7f8091a2-5631-4622-92e7-09f2f21aaca5", "value": "T1EE042A46EA404B13C0D62BBAFA9F424533239B54D7EB73059528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974378, "uuid": "56c92c17-f7a0-4767-bda5-bb7a5f50b878", "value": "3072:lfmxwBnwyiKj6Xa1AQimt2NnvmA5gGjC+XPSorM/RTfmpFA:lfhnwB24a1AQimtkOAOGjC+fTrM/Rq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974378, "uuid": "9e226a18-e7ee-4f65-a554-c6cf607c38f6", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974378, "uuid": "87a92ae6-e736-499a-bb0b-3653e464a6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974378, "uuid": "eb568b3b-a223-4720-8360-a272d98b3896", "value": "004635d8edbc4112be2a2a68e42d4eba6941ff634b3378918816c490b9139797.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dbd99f-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974385, "uuid": "ad0f4b83-3776-4d2b-913b-18fa7e8ab9bb", "comment": "Malware payload (Gafgyt)", "value": "e41840b838fa980eef390e6b96a76ca5", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974385, "uuid": "ea14ad54-d5a4-4bcb-a653-e7f51d77113d", "comment": "Malware payload (Gafgyt)", "value": "0046d90a49a623fcc4e9875e65236bbf14007adabc66f8e943724a44f59e3715", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974385, "uuid": "ce877472-25a0-4235-9cde-b11d654443df", "comment": "Malware payload (Gafgyt)", "value": "44f18704eb78f63700d82261e09d82aaf1ce0730", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974385, "uuid": "27ea6c3f-b05b-42d7-84b8-b2bc4391309d", "comment": "Malware payload (Gafgyt)", "value": "3a238ef0806e3aca12398a12f2784d608b294de928d4acc9f266db353b34843d7d0fd91b72978558f03e9614c5ad2c81", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974385, "uuid": "9b43cebd-5dbf-44e6-91c7-3440981f0869", "value": "T13CC32947A8618FB7C042A9B129FB5A200B16BD511F8F1A957538BAF4073F5CEB40FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974385, "uuid": "bbf1fff8-9048-4a16-a4e8-f6f6b2d6d451", "value": "3072:jIp644mMnTuNVXh0CWY4MTj1mmhscB8aRatTNU:jIpH4mf0ZITjYmhscB8aRatTNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974385, "uuid": "05420cdb-65e3-4cdc-bbc4-ea2e7d13cfab", "value": 119017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974385, "uuid": "d68ebb95-0297-4fca-bb7a-c7cdf66b3b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974385, "uuid": "47341423-2bc2-41c9-b078-727a4fa521b2", "value": "0046d90a49a623fcc4e9875e65236bbf14007adabc66f8e943724a44f59e3715.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c10b47-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974391, "uuid": "16ddf9a1-08d5-4e9c-a4fc-c6d08eda1d59", "comment": "Malware payload (Mirai)", "value": "175ec53d2093cfa03fbb959f2211f03f", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974391, "uuid": "4fc12d3f-7a47-4e62-9911-c20e09c5693c", "comment": "Malware payload (Mirai)", "value": "0046fab8cf1569cc88691ec1c1d44adb439f49eca8c5fed1f826c02f45c9e1f3", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974391, "uuid": "13150b2b-ccb8-4ec8-979e-7c5a3123ff8d", "comment": "Malware payload (Mirai)", "value": "9ad84dbf249f155f05a07ac232bb5f76a0787f0e", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974391, "uuid": "9fcc1a50-b31d-40d7-b7ed-3e14cb4d97b9", "comment": "Malware payload (Mirai)", "value": "86c1dfa5aa579851fdaec2c9ea77bb37cd41546fe20b67590785c463c33baefa845eb1e98e7e4fdc416429a75beaea3f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974391, "uuid": "aa3c297d-edfb-46e3-b60b-1a0726887975", "value": "T12BE2E09EDDFA3488C42D0874B49D56722921B08463D19B2AD3116CC9AF37F87F4CD5EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974391, "uuid": "4d0a1d81-79f4-41d1-b79c-dee46844f8ad", "value": "768:P4JlYBuDo6erp03CeIpLc/xxE/ntczE0OyTPYF5w1OQWU:P0KBuGrp4CKxxKntWFOrHw1OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974391, "uuid": "369a3529-ddd6-434f-8e7d-8cf8850e307d", "value": 31992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974391, "uuid": "ff76b40c-aa55-46c6-bc58-eb1bf22a4dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974391, "uuid": "5121e4cb-7043-4b73-a9c9-ab75b93bd904", "value": "0046fab8cf1569cc88691ec1c1d44adb439f49eca8c5fed1f826c02f45c9e1f3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6fedc-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779974398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974398, "uuid": "19e177ca-5e1a-414b-b495-adf5f26db649", "comment": "Malware payload (Gafgyt)", "value": "26c9461e3825540a3dd786e97fed52dd", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974398, "uuid": "abaa7578-604d-4a93-ab4c-e2407042fd8f", "comment": "Malware payload (Gafgyt)", "value": "00472840f67610f40774d9568635257585716013d71ee83b613b6092c19ae018", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974398, "uuid": "a60158a1-b306-4556-a0c1-eaabbc4ebe74", "comment": "Malware payload (Gafgyt)", "value": "f500f5f1835019c4778ec1cd0ac84d4723fa33aa", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974398, "uuid": "b82a2196-4255-427e-a486-b6971a5c1c9a", "comment": "Malware payload (Gafgyt)", "value": "757ab25fa730e6cf48804d550d100af7189f154009cea47966633e0ab3beb75aa895386f7166181aef75b5bb09550f56", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974398, "uuid": "13710ff7-be2e-45d1-8f76-dc31aa16cb47", "value": "T130933B86E602C6B3C4431BF502AFAA5A0732FD2A4A3B8EB6F71C7DF45B119C53215791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974398, "uuid": "cdf968ff-1d8a-4579-a86e-a73d74d986a9", "value": "1536:WBkgu3kJOU4ZYz12zezKWQC8jIOlfPUEikuIP5hN8aaEGTWshe0QzUzJYQ2Wk:AuJU4ZYZWy98jIOFPUEuE5hN8aatWUez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974398, "uuid": "100f4f1f-b36e-44e6-a2ce-1ef78dda9d9c", "value": 91540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974398, "uuid": "1b274fc3-ffe9-45df-b7e3-6831563b947b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974398, "uuid": "840780bc-6195-4357-99cf-72f872480675", "value": "00472840f67610f40774d9568635257585716013d71ee83b613b6092c19ae018.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a0b828-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974404, "uuid": "11710c4c-daa1-402f-8937-49d1782bd1a3", "comment": "Malware payload (Mirai)", "value": "4a810cd3e4879e5833202479e6d524be", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974404, "uuid": "14ba1361-f31c-408b-a3d8-89911fe2e150", "comment": "Malware payload (Mirai)", "value": "0049ca86841634f1d6df8d9940f21b528155bdf0400613fd51d56d870169eba8", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974404, "uuid": "d96b571d-a064-4a63-8b5b-cf70e85f8778", "comment": "Malware payload (Mirai)", "value": "5ba85ec224e0f3ad8f397c0de72af120d8dbd1f3", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974404, "uuid": "4737a91d-c7b3-437d-b412-9b43ab97bca2", "comment": "Malware payload (Mirai)", "value": "ad2cb645aeb76c45af896b558e823d492d8f98417bbaed9679c0989a3fd59d5c574c9ac83ad3975fc6cc46d3532ec8f9", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974404, "uuid": "e8ea9f51-e72e-4014-8dcd-c24eb21f468f", "value": "T18433E746FD818F06C5D556BAFE1E118D331317A8E3DEB2239E106F20778B52B0E7A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974404, "uuid": "eea2e3e8-e56b-44c7-ab04-07333a438d62", "value": "1536:bdnv3K6+LA/B0xwfrAipj5ALxI7ipM1dIWMr:pKlk+xesQaM1dIWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974404, "uuid": "e5969568-3966-492a-941f-5f3e612287a8", "value": 50368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974404, "uuid": "9f1c6e29-7c80-4347-8ade-da5f136ea559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974404, "uuid": "9a20c076-8ecf-499b-a9b4-9ee62884b013", "value": "0049ca86841634f1d6df8d9940f21b528155bdf0400613fd51d56d870169eba8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4993b41-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974411, "uuid": "60b702d4-8abe-4e13-ae13-17910abeb776", "comment": "Malware payload (Mirai)", "value": "8c5d31243f169a7194f539bd47e9a258", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974411, "uuid": "e82072d7-7468-459d-b00b-03d0cebf45ad", "comment": "Malware payload (Mirai)", "value": "004b3dc6622a2a9374f6c289faf52d92c014452076d83648adf8e09d9ac82512", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974411, "uuid": "32fecfd6-4625-456a-aba6-951567ebb091", "comment": "Malware payload (Mirai)", "value": "8869668ba39ead6f0228a77e758376242927afb6", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974411, "uuid": "b3de927d-f214-4edb-bdd7-0eb30583876a", "comment": "Malware payload (Mirai)", "value": "af2fd13f11e38efd0263c8721a04591acb836a0e374ab92d8f3c42596fdd3e00ff4cedf96b6e78a3499e7305f2feafae", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974411, "uuid": "6269dc9c-59d8-40e5-b089-e57267e2896f", "value": "T17D534AC4B583F4F1DC111579307AABB27EB7F03A6036DE9BD3996873A903603911A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974411, "uuid": "555bc939-4374-45a6-9144-182c209e595c", "value": "1536:bPejgDNJPzkQg5dhrDTiT98d4M9rAr9fVb7B8RF+5mJ:bGjEdgX5dhrDTU98WnJfx7e7+5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974411, "uuid": "8ade9070-37b9-465c-95ba-b69fd007c60c", "value": 63804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974411, "uuid": "f1709f85-9e4d-4cbd-9951-c26b6cf35af0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974411, "uuid": "dc34adea-f2ec-463f-8953-e179ccd5bc3f", "value": "004b3dc6622a2a9374f6c289faf52d92c014452076d83648adf8e09d9ac82512.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8877e57-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974418, "uuid": "e6c73fef-0964-452f-b4a9-aeab8af2adb7", "comment": "Malware payload (Mirai)", "value": "3348756c027dff8a9e8f03efaf11573a", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974418, "uuid": "06053c08-178d-47a9-a6ca-924cfed878f8", "comment": "Malware payload (Mirai)", "value": "004d40336ae668cab149ffa67b04dacbe60d94fc78cd200cc237b43ce6516dea", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974418, "uuid": "51690e92-25f9-4459-a647-88da10dd0a13", "comment": "Malware payload (Mirai)", "value": "ae1a1030f65ee7cb862ae272bec2e4b4869d19c8", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974418, "uuid": "646be325-a2a2-4446-882e-a68ac383a6dc", "comment": "Malware payload (Mirai)", "value": "8617e4b636ba3a8a6da126799b55f010a57df328277a6960464aff183edfa231f9b87bb506807324a55710651430169f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974418, "uuid": "4c0a6a68-c2eb-41d3-9808-cbd73fdd7db4", "value": "T100435BC5D563D9FCDC1015393077FF725A76E93F1028EAC7D7A8A932A982A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974418, "uuid": "80a8149b-ba62-475c-8a71-105a70cc3e0e", "value": "1536:d6EwVWibZ6uzpNrmvFtWbFh9WCTZbt+xc:QVWYZ6uzv4FKFh9WoZbQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974418, "uuid": "2869454c-11da-4e9b-90a3-a390b3ccc41c", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974418, "uuid": "749fcdcd-fe6c-4ac6-bd85-21cf48bd563d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974418, "uuid": "c22a2363-45bf-43f8-9f41-71d1cd68f048", "value": "004d40336ae668cab149ffa67b04dacbe60d94fc78cd200cc237b43ce6516dea.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc83f0b1-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974424, "uuid": "91044867-f75e-4d9d-adba-97787a50e2e4", "comment": "Malware payload (Mirai)", "value": "6168357fc2bc07bf36f98c6ac6a2db7d", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974424, "uuid": "3987728a-d6fb-421d-b82a-7efc220631f5", "comment": "Malware payload (Mirai)", "value": "0050bff549456b73e43fbe780977534c1264b224d61ecfad5682da771eac5c55", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974424, "uuid": "99972a22-b89a-4ca0-ad70-c1b1d9eeaf06", "comment": "Malware payload (Mirai)", "value": "6c44fd066263e42ac29e98e33dea2be24d1a08e5", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974424, "uuid": "7d5d4da7-354b-4974-9dbe-5059894804ff", "comment": "Malware payload (Mirai)", "value": "3bbae74e20eae66443c170c7c2db95698392b4100ccfb00c50f1caec428392b3d309fdbc63a6c259cf59d026e06c3d61", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974424, "uuid": "f0baf946-430e-46b5-a9d7-d3dfa9a1f3e7", "value": "T11F03E15644F85C7BEC8DB2706EDF690C2601D962B369A2967F9C2113CE06FF58018B3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974424, "uuid": "dc1ba87f-6df3-45df-ad10-c3a7324a1da7", "value": "768:qWNDKp/aFkQ8TOsXPdyDODqWRizeI0Oib8O+zdxrvwnbcuyD7UoQRjB:qWNQaFufEi28A62ddxknouy8oyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974424, "uuid": "dbe3b165-920c-4db7-81e8-e342353168b8", "value": 39520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974424, "uuid": "ebc4d4bc-fa2f-405c-b21b-70ddd66560b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974424, "uuid": "7e1bd927-1890-43a7-9f3c-5b55d5fe6f98", "value": "0050bff549456b73e43fbe780977534c1264b224d61ecfad5682da771eac5c55.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007e2cde-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974431, "uuid": "609acc03-9c75-4985-82c0-0b88adb91b38", "comment": "Malware payload (Mirai)", "value": "10e65d4833f542737e39845a80f94005", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974431, "uuid": "1f842c29-2138-438f-ac20-37107031471d", "comment": "Malware payload (Mirai)", "value": "0051e31d99246db46f206f753bd544aa55173b480c509208d1fa8ecb8a2fedff", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974431, "uuid": "9fc32ebe-dbd5-4561-8d0f-b8766ee6f500", "comment": "Malware payload (Mirai)", "value": "7ca03e817a9c1686b46993b66d4893cd6931dd15", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974431, "uuid": "3356d08c-1650-4931-bfe5-02bcb26cd19c", "comment": "Malware payload (Mirai)", "value": "7ef88a0a2ad5282a943a11f8e8053f158d51c38207f7128f7f37d233df155e3dc0cdfc8a1ee8e15db3c70060572ff448", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974431, "uuid": "494c4538-ff94-41c3-8c37-442bbbc4fbc4", "value": "T15663B506BF614FB7E86FED3709E91B05248C541B21A97B3A7E34D818F64B25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974431, "uuid": "c64d5e29-761f-4436-b7e9-6d3229d2f6e5", "value": "1536:xic5msW0d/JnzwIFIzUP8UTtDOPHtb3cxS:xP53DlEOYtoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974431, "uuid": "ea5616a8-d79a-477a-81cb-551137ae2e44", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974431, "uuid": "4185c834-cf61-4020-b08f-f4fcf6907f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974431, "uuid": "836191b4-a186-4020-b8de-959830479e1a", "value": "0051e31d99246db46f206f753bd544aa55173b480c509208d1fa8ecb8a2fedff.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8907a4-5aa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779980974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980974, "uuid": "0be6032a-447f-402f-b0b7-1b0d0d1e28ca", "comment": "Malware payload (ConnectWise)", "value": "0abbfde3b1408ccca026d2b2ae8c6719", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980974, "uuid": "7c07cfd7-b908-4873-a535-9399aa96d786", "comment": "Malware payload (ConnectWise)", "value": "007872e9454fa9ea6c3ea27ed2fd345428297c02e64e9e516145ccc12d66af5e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980974, "uuid": "d9e36fd3-3c81-4c4a-b67e-2963dc94a996", "comment": "Malware payload (ConnectWise)", "value": "2fb78b71c38d49a190cdfba114e10e4851733104", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980974, "uuid": "b1c4118e-1a19-4b45-8bb2-b4ad140fad75", "comment": "Malware payload (ConnectWise)", "value": "ef5cf75f44a93e2258eaab5f0b89d6d2114ca058dc7bcd2ddc4e78c0be425bbbac84d932303e1a53a3445789c05f5d81", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980974, "uuid": "75c3e5cb-1dc9-4679-8fce-a5be9b4b8912", "value": "T11D836C43B5D18476E9720E3118B1D9B4593FBE110E648EAF3398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980974, "uuid": "6330b485-1346-4477-b471-f4d339500dc3", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980974, "uuid": "249f619c-b125-4f2c-bb78-a1ffef4c1795", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYx7FJ:wenkyfPAwiMq0RqRfbaWZJYYxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779980974, "uuid": "4f76440f-02aa-410c-8ac7-34cfcf34cc9c", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779980974, "uuid": "495e44ae-20d1-4fa7-b249-0f9fa5da5685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980974, "uuid": "97c67a62-7509-4e6e-9740-50907c0dd716", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96aab40-5a3f-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779936543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936543, "uuid": "c1988b84-f007-4a82-a104-af5b45b30412", "comment": "Malware payload (QuasarRAT)", "value": "668a2576569169db132b965366a616ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936543, "uuid": "aea4c8b4-df8d-4516-af0e-caa0cb883923", "comment": "Malware payload (QuasarRAT)", "value": "007c13a26d76a1281519960109bbf040ebdf5c497b00d4ffe0d0ac417cd8d33b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936543, "uuid": "951547ca-f3e2-43dd-b3fe-ef6d72924463", "comment": "Malware payload (QuasarRAT)", "value": "10e8977b8264fe39b478ff593713a62ad365970c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936543, "uuid": "702b6a0b-68f2-4d31-ae4d-5d5b2c14f76e", "comment": "Malware payload (QuasarRAT)", "value": "6ceb26112d7c4c1754ce8efad8dbea9eaced9331b7436e1ecc015483847b917fa1d73ff2e4a66e0bd14cf1ae312efa26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936543, "uuid": "b5a6b96c-0f75-4f6a-89c6-5d98b3c74727", "value": "T199D34A1433EC8E17E2BE6BB9EC7800011772E617E567EB8E5D8824EE197379191913B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936543, "uuid": "5cba071a-cc76-4eaa-aef3-53113a969ee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936543, "uuid": "6e3c5160-54dd-4e3e-9101-9f0c2ec37847", "value": "3072:5VizmsUsAdsc328EOzZnsXSKqn4iLaBCVZpb2Gmk6vMfWTJ5:XXa8hzZsXSt4oHZpb280P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779936543, "uuid": "3c2443a2-44d2-420e-9e4e-d50d622d8479", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779936543, "uuid": "19ef384a-bb4c-46fa-87e1-ad628f846ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936543, "uuid": "177b6106-8deb-4df5-b13b-01519b04f020", "value": "007c13a26d76a1281519960109bbf040ebdf5c497b00d4ffe0d0ac417cd8d33b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968474b7-5a3f-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779936457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936457, "uuid": "aac0bf0b-90cc-4ea2-940e-1a9737c8250e", "comment": "Malware payload (QuasarRAT)", "value": "867341960c8a98468b9ed2cbbde40bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936457, "uuid": "c05c2ebd-b060-4f30-9931-d59b8d1c293b", "comment": "Malware payload (QuasarRAT)", "value": "00f1da323b1e36d3d24e3a06378dec95306971fdb7f1e1a760b079db39b96365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936457, "uuid": "04f53180-9785-4be5-a52a-d785f55cebee", "comment": "Malware payload (QuasarRAT)", "value": "bc73074a57c1f829614be091844e71080de5773b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936457, "uuid": "6e1d1a06-9fb9-43b5-80c0-fc9554a88ae6", "comment": "Malware payload (QuasarRAT)", "value": "96a61324e5b19742ca4a62fe1d57a6cda2ba6b23b6ffc352399d5cf9e3389c3e917cb04a3fb99c7e683cbdc011a88d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936457, "uuid": "646edf3e-2395-46c6-ab49-7e010365a35d", "value": "T1C1E56B0437F85E33E56BD2B3D5B05026A3F0F82AF363EB1B519167BA1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936457, "uuid": "fce8561b-694c-417f-bbca-2a6f13605662", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936457, "uuid": "3024de5e-9699-4712-9f62-759f2450b5a4", "value": "49152:DvxAd23law6wGPAllX3SSLNUpy13/HBxWLoGdxTHHB72eh2NT:Dv2d23law6wGPAllX3bLNUpyp/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779936457, "uuid": "497c0df2-d26f-45ab-80a7-2e7d48f32af2", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779936457, "uuid": "7d16e023-a678-41e4-b77b-7bea743e51d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936457, "uuid": "2d4681bf-76b9-4382-9304-87e376ccfed0", "value": "00f1da323b1e36d3d24e3a06378dec95306971fdb7f1e1a760b079db39b96365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911dc193-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779970808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970808, "uuid": "9e56328c-cef7-4554-9a55-8045b1017cda", "comment": "Malware payload (Vidar)", "value": "61e4d7187062c6be4d41578c264e4bcc", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970808, "uuid": "67f22d3a-eb7f-43e1-888c-c2f3aaaed7cb", "comment": "Malware payload (Vidar)", "value": "022fe01a4fb8855747a4068de2131ceb7486cf846df6c18adbefe7564482adb5", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970808, "uuid": "17d87254-9255-495e-be3a-1096b1db3e58", "comment": "Malware payload (Vidar)", "value": "a4ca22dd652484a058a4af8dd92062c65f6f9b66", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970808, "uuid": "1e26e5a8-875e-4d2d-9aea-52f978984668", "comment": "Malware payload (Vidar)", "value": "b03b0e298ca8c5ff04626dd1fefc37e321210fd102bf3d2455da92c5c938ac9d0f35c8fae18947b0a9fcca884be3f568", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970808, "uuid": "d00a8800-b799-453b-8334-097762ea77d7", "value": "T16DD3F9C6BBC69CE7DE16123884AA8369133CFBD5178797030D3962351F23AD0AD9B647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970808, "uuid": "e1a513b2-024a-48fe-9a12-658155f78249", "value": "39d6ce531189b87393df0af9192c5532", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970808, "uuid": "a299f122-04f4-4bb1-ad02-1d5975b9d041", "value": "1536:KjPT6qYfWJSBjMJDEZa42/MXLo6Jquf5X5eX7Fjin74lKqEH24l8WqsmpYhY:KjPT6qYeJmKDrzqcxOH2+hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970808, "uuid": "b0acc253-f581-45d1-99d0-e93455e369c0", "value": 130825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970808, "uuid": "94923a99-863e-41dc-8577-556caf64a749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970808, "uuid": "d4cc6bb9-9e62-4f38-a688-42ed8787168c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbddd8f-5ad0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779998582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998582, "uuid": "91ca06df-5d1d-4833-92e3-93ea50d4a7c2", "comment": "Malware payload (Mirai)", "value": "fd9de68fa581cebadca120080883de52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998582, "uuid": "a586c347-fb1a-4b0e-a2fb-9eba8ce6f6f3", "comment": "Malware payload (Mirai)", "value": "0339ac92d51cbe9623981f0bd91b0bc4b2a369f609f668b14860d7a62166eec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998582, "uuid": "ad673e28-ef30-440b-ac84-35c7983cec1e", "comment": "Malware payload (Mirai)", "value": "ba5dfeb7490c6a87c7b831c3715e5e0307e173fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998582, "uuid": "6f6e7752-7bd0-402b-bfd5-66e0a75ae4c4", "comment": "Malware payload (Mirai)", "value": "a8f73340c03b0b8f2b932ddc9aaf2130e115b8af9337ea2b5f67940a289268259cafd37521e04229f875d3fd3b70b9c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779998582, "uuid": "cbdc92bc-8d3c-490a-85e1-59d4e90bcd90", "value": "T1BAF34A07B5C184FDC4DAC1784BAFB53AD931B19D123CB25B2BD46B222E8DE601E2DD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779998582, "uuid": "27312723-3332-4960-8e0d-815e05c2d2c1", "value": "3072:+tY8+/9wTRsbIhk6o5wpajjieu1/w3F7Xi4BXhyxPPM:+tY8+/9wTRUIhk6oqb7uEHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779998582, "uuid": "3496c306-1ddd-4436-8806-f30d90064586", "value": 170648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779998582, "uuid": "4937c405-e64d-40d5-90ab-5620b6993225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779998582, "uuid": "c689aa4c-6a1e-4a5f-aabd-3c36326261ef", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2a4b06-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779970023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970023, "uuid": "3d9666cd-992c-4bd3-8dca-9dc519bb9c71", "comment": "Malware payload", "value": "acff34bbe34b07351f5c2474aab6807f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970023, "uuid": "f38e6a6b-d593-480a-87ba-1743ee18b276", "comment": "Malware payload", "value": "03506b7c72a342fd2f266467a5d4abcb38900b6f7550b12f1e41574191dd91ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970023, "uuid": "6a88ff7a-56d1-498f-b82d-7c414367d1b2", "comment": "Malware payload", "value": "34f58e404fb73454f2340b3d4d3237b2f9b55614", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970023, "uuid": "4d32bec1-aa2d-4fe0-aa72-d11eb10c0bb0", "comment": "Malware payload", "value": "41977d5fc9cb889a72afed54fa2bb71c3da5898539abc783782817805320bfd9f2f4cb79dc8e8f76379eabac70219ce0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970023, "uuid": "26fc3f1b-9ebd-4cae-9075-f746993f1dda", "value": "T193B09B5841467456C48D95257562C14C744147CD146F16545D93047D90A05CF7031609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970023, "uuid": "9e03c975-caf2-429b-80cc-5eef6d9f1cab", "value": "3:TKH4oNmVjBZTLTeUWcgTsfyMvypszSa0H7mIFIXVTITh:hoNmVj/fWbsfvvyps3IyXVT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970023, "uuid": "cb14178f-8759-4dbe-819d-37460bec6c4e", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970023, "uuid": "7d217b7c-d339-4d4b-8d9f-d8b042df7184", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970023, "uuid": "c7c7206b-38ea-4aeb-98d4-905096e5688f", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9c1940-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000298, "uuid": "1bfbb617-0c70-4677-a53e-9a9d29a4d4d0", "comment": "Malware payload", "value": "7511f38c98e1718a758099ab0fb3480b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000298, "uuid": "c5e19a56-d5a0-4cf0-af14-0becde35bb74", "comment": "Malware payload", "value": "03ca36fadc267f9d36d5ed68c8bd68b4be2dbda64bd7e81af03f0ca8c27d1d5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000298, "uuid": "f5442c62-e94c-4b9e-8bf9-784389d5a55c", "comment": "Malware payload", "value": "4f2a33cf502dd0a6e1578753a03fa8384d2bafb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000298, "uuid": "1c2851ef-5100-4910-9622-e0c103fdcc0f", "comment": "Malware payload", "value": "cd82cf721d8b5dc1161db48af79cbb1ebb1647e1916826c8bd813e6d6f111df1953cbb162c9e13f2831f92546f397bc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000298, "uuid": "b52948ad-ac36-49c3-ae3e-aa1629265e93", "value": "T142953342AFDDA2CB60E4201A02EE763917B063DA8EEDCD744CA8E7F57D101494F5BA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000298, "uuid": "57ad6030-0949-46ad-899c-bc0b798fa37f", "value": "49152:44Nq4MUOmEGSVLPISx4g/uBVUPIUtTVDhFJb785pnEmaDXNLC62GkvC:Ho4MHbVLPceu3UPxtTVDhLb785gD9G6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000298, "uuid": "7920bd58-32c2-4df7-9ea1-9aa0372a9c89", "value": 2035252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000298, "uuid": "2e33533a-6378-4e93-a081-534316df556f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000298, "uuid": "027cc07b-fc31-4b61-9909-edb6a349e24c", "value": "vulcan_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e9923c-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970279, "uuid": "b170d447-9027-43f0-b841-895faf68dad0", "comment": "Malware payload (Mirai)", "value": "406a282231ac3cc563b619d92b6b791f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970279, "uuid": "ed849a39-5881-4d8f-ad5f-7fa5e4a978f2", "comment": "Malware payload (Mirai)", "value": "04564690038044d188d54d2954bef9f31d530f68d2838f6b8f1300edd2e4df95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970279, "uuid": "a0465287-0326-4b22-84d6-18321b74b5cd", "comment": "Malware payload (Mirai)", "value": "2aa08c23607e269a30c99387bf0fa8abc90f603a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970279, "uuid": "5d76a801-663b-495f-8ab5-3296b80d5161", "comment": "Malware payload (Mirai)", "value": "7ebd4c88d3b09c65f9a324dfb63c866e6dd04695e0ace483576db5103e856e30af037697daed947bc8a0eb94e80c21c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970279, "uuid": "80be3d3f-9621-4ec9-909d-bfe098937d15", "value": "T13B933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970279, "uuid": "e73448fe-f3b5-4450-9f91-697aa7fbe433", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2DW:eyxt7W+G+3QBBntmzg6d7WidDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970279, "uuid": "da17168b-ceca-4e0c-ae9f-997a404370f2", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970279, "uuid": "180dbd8a-cbb8-400a-9bb5-32e4ab8864d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970279, "uuid": "c01f764f-105a-4797-acb7-91a25239b242", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0183f070-5a40-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779936637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936637, "uuid": "47fd0d94-7b1f-4694-873c-b64755ffff98", "comment": "Malware payload (QuasarRAT)", "value": "3e79a671ca9a73063f21d0fbabd20baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936637, "uuid": "ec45e086-3a65-4767-9e59-e92775dc4c94", "comment": "Malware payload (QuasarRAT)", "value": "0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936637, "uuid": "692c7b9b-e8e9-4a65-9783-7c663ba6a8ba", "comment": "Malware payload (QuasarRAT)", "value": "6e2d116a23d966da68a94675005a9029d92c0535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779936637, "uuid": "b1e09ebe-1e0c-4176-b0d9-0db9de28d3da", "comment": "Malware payload (QuasarRAT)", "value": "72c2e4650d796f0981ceb0d9de09c9a340c42a1fcdcb6f5080d443382b367884d96812275b1ec76bcfbd648eef145162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936637, "uuid": "4598f597-71a5-465e-a414-f0ae7e1508a2", "value": "T1DEE54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936637, "uuid": "f8f2cb20-e696-44aa-9304-b4c4a14d1256", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936637, "uuid": "0b0dea8f-e6c5-4c8e-8a7f-943bacf2ed44", "value": "49152:XvOe821/aQWl8P0lSk3aKA3Z+nFFj3tarGLoGdF1rTHHB72eh2NT:XvN821/aQWl8P0lSk3DA3Z+nz3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779936637, "uuid": "5fddead4-9c62-4f55-97b5-b63710fdc8ab", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779936637, "uuid": "94edff05-abf9-4ab1-b65c-94329ef78d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779936637, "uuid": "2584e760-e60a-4f86-9243-e034faef5a9f", "value": "0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66a5faa-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961905, "uuid": "41391f52-0927-44d5-a925-cff8010bb0b9", "comment": "Malware payload (RemcosRAT)", "value": "d4e056d9cb2cb25321d4f9bd23b3562c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961905, "uuid": "0500f1ab-1039-45c2-9f02-ff9ad9e63806", "comment": "Malware payload (RemcosRAT)", "value": "054ee49a235357d3c5ad295db11303f903ab229b4a9d32293da51b6cd01c818d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961905, "uuid": "5707643f-7edf-4ff9-ad4e-8f0e6758357f", "comment": "Malware payload (RemcosRAT)", "value": "8c7d5f745ac7fc1bd998332d446a36b1eff7a449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961905, "uuid": "41b43fcd-37e9-49f8-a82b-54993746b300", "comment": "Malware payload (RemcosRAT)", "value": "07feb31212b3029e26edbaa1eef3753f13f1d4f1c34bf64d231081ac78d42e703fc83cb39294b1426f8131e3ef1fa57c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961905, "uuid": "825a7ba3-e72d-43b0-83eb-413b469b7124", "value": "T1AE748B61770CA4D7C4CF27704E639B64976FCE849D51C12352A0BE6BB4BD28B183ADCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961905, "uuid": "7d53d9bd-621a-4561-b480-5d05106216ea", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961905, "uuid": "e520da54-54ff-4ae8-857f-bc4acfa654c3", "value": "6144:MpMLtOZkoM9JPQQegIi5Ey22eltX28WntwSWUp9fWd8+bm:PtO2oM9J2gIXyurXMtw2pB68Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961905, "uuid": "390ccd9f-0871-4f42-bc2a-4b7c7952170e", "value": 351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961905, "uuid": "ade197b8-a06d-4dd5-b912-eb5d1fe4cbb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961905, "uuid": "cc1a31f2-95c7-4b8a-bb85-76b687a98043", "value": "PO_No._4300001762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e09892-5a90-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779971091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971091, "uuid": "e82a0da1-19d4-46de-8989-454e56085e5c", "comment": "Malware payload (ConnectWise)", "value": "ce6401b7e15e1c4b57dc934996e7f00f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971091, "uuid": "6218539f-b870-4b02-bbd4-30de077c4b7b", "comment": "Malware payload (ConnectWise)", "value": "0600f397e12f8eee94623728448eb6a39d3720ca9fed34499715caed8a42f481", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971091, "uuid": "9d22c5e4-caa0-4e4e-bca3-d306bb12cb46", "comment": "Malware payload (ConnectWise)", "value": "f1957d2ce27d4b7106f34abd71bfd3dedab7ebbf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971091, "uuid": "4148e5b5-0748-45ba-87c5-6d18d64edfa5", "comment": "Malware payload (ConnectWise)", "value": "b247b4a503340e82c972546388dc28c3324c7bc50e636ec7a13a2f41d510533f8b1e467d1822420a0145673ddebc2bea", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971091, "uuid": "805dbe39-9d45-4c2d-bae2-59ef1c7936a3", "value": "T15846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971091, "uuid": "3a409272-7031-4384-8c4b-cefe8cdd3f65", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971091, "uuid": "ad110c3e-b1b3-4a98-b43d-f683f6641deb", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779971091, "uuid": "df5f33e3-46cf-47bc-ab0f-ee986bbed7a1", "value": 5641496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779971091, "uuid": "aa1c9d77-8460-41cb-9b21-39d407aa69fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971091, "uuid": "9d0fdff2-991b-4e4d-9dd6-9752d193ed62", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71561264-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969037, "uuid": "e70e69f8-a2f9-446b-acd3-54fa5376e2cc", "comment": "Malware payload (Mirai)", "value": "87a1970f6974dd9411d1dfe006438cc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969037, "uuid": "26c047ec-e7fe-49ea-9b53-56fa7116be74", "comment": "Malware payload (Mirai)", "value": "08797a8534c6919f6622f9523a3b81af70f2a7a36842b6f4281c7cbd348ecf31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969037, "uuid": "8f56a416-3ea0-4bad-baa2-69bc8d4e9ccf", "comment": "Malware payload (Mirai)", "value": "42ea497ab03bd78908b8a9782107c8857b6a9fed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969037, "uuid": "20c4caf6-9c43-4756-b290-d7056493b21a", "comment": "Malware payload (Mirai)", "value": "efa53bda9efe98f2fbdef6c0d7c7552c9a47a112abc6dc0071a5c341605b114f31705855e58457059aa97e5902c984f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969037, "uuid": "0a775f2f-73ba-49d4-b2e2-d7a0b0858ff6", "value": "T1B621CB96A7E3AD17CD980273CCAF5B10F322BE44899EF443E35216291C3F31A1F22189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969037, "uuid": "a6f8aca5-d790-422a-b2b5-c059b9c7179f", "value": "24:JKR4llMRgP9qD0at6EoKGwrUlFSy40VzLCkIddgERGIUv9rNfW:JKqTFqDPtFrkFSy4CzL5IUv9rNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969037, "uuid": "500d1f8e-e307-4ef8-91b0-93e53ea3c901", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969037, "uuid": "48b448a4-57d6-4b1d-828a-aaac9831dad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969037, "uuid": "275c002c-2f15-49db-b131-4c11043b8a1d", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7e42c3-5a82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779965351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965351, "uuid": "3ab05541-46f0-4a04-ad37-9d2b9b32e528", "comment": "Malware payload", "value": "16c372776739980ffb756f9ffaca95d8", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965351, "uuid": "6b9099db-ee91-4dc4-ad83-cab51326ae4b", "comment": "Malware payload", "value": "08aa478ed2cefa279f779c5612d0238b82dc92018772fae7116065d93710781b", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965351, "uuid": "c80bbdd9-120e-4e88-855d-a17933024bd8", "comment": "Malware payload", "value": "b6366aaf9e45783838e8b1b172dfc901b0d2674b", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965351, "uuid": "5cbc9848-527f-4878-9ba6-f21bcc5f00ab", "comment": "Malware payload", "value": "6a72cec36533e72ff5da4bc36715db7265fe653d124e899732cdb2cc323a3486e343fccaec9d96f0a264836924fa7677", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965351, "uuid": "fccc0e68-9de5-49fe-8c5c-8a2a19af4449", "value": "T115B5D05667B500F9E167C278CA528707EBB2F45527309ADF07548EA62F23AF25B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965351, "uuid": "484c6694-f04f-4f19-b9ba-4c995f305a35", "value": "ccddf740495379a87b950796cd164c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965351, "uuid": "0a999a3e-ba92-45d0-b399-e835e6812900", "value": "49152:zdkKPaRAob7DSKEYxFj+oPZyUJo+14dVWqNZrU3z/oHKWFB6kAu:JLit7Dnj+eyVZrU3z/oHKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779965351, "uuid": "f3d8e46b-47cc-4a43-b7f0-5417121c5b34", "value": 2292736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779965351, "uuid": "73045c93-08b3-4909-b72a-41b541d2c60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965351, "uuid": "4716c7b7-ac9b-4640-b322-2584141d9b00", "value": "c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d71b7d1-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969030, "uuid": "823248f4-ff47-4d69-9372-95d85cfc6e52", "comment": "Malware payload (Mirai)", "value": "0ea40c00a383fd80efe230a6af288db0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969030, "uuid": "12b5aba8-21fd-4a50-a364-93e2208ba079", "comment": "Malware payload (Mirai)", "value": "08c4561ed74b479cd0dd404123ccc48b8066e730c64911812ae66239db9c73b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969030, "uuid": "f9ce62b1-7472-4601-b363-320679919f29", "comment": "Malware payload (Mirai)", "value": "830def71fa8c5492f9f4e263afd3487c6e909de7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969030, "uuid": "71b85423-3439-4023-a50a-e055e7d3bc29", "comment": "Malware payload (Mirai)", "value": "b4576dfa744081d7e5bc4c9a2b9c199bd559b15a35f80befa80825bea8cd8d72308a22ea75220543275faaacc12c98d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969030, "uuid": "9ec83396-112b-488d-8780-f952419df0eb", "value": "T18E31DF91B6D06D7DC8E411BE9E5B0315737B9F00E0C67123D70CB328AD2AE3D5E2645A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969030, "uuid": "9ef12193-22fb-4c5f-980a-0ff9c98ee5be", "value": "24:uTchKGpa7Urz/jlfxXK1hH9Vev3gRGaJ9iBBBuLlZdI+9gW29:ughKGpa7UrLZ2I+JCBuhI+J29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969030, "uuid": "30dfde06-c0fa-40b0-9bad-cda836efee19", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969030, "uuid": "192bb09b-591e-4370-a58d-16adfb10df3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969030, "uuid": "1604dcc7-ad6e-4ecb-8514-55c23cdfd77d", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0389eb16-5a82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779964987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964987, "uuid": "15263d8f-d874-4188-94dc-98b552d4d807", "comment": "Malware payload", "value": "f92af47aef5e48867dd2d166cd77b5c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964987, "uuid": "7317473f-e475-4cf3-8817-8e89aa3f69b3", "comment": "Malware payload", "value": "097d580b48397feb458bed57eceeaf89b6e0deff578f7e2a1320aeda8c98e8bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964987, "uuid": "15d1a966-e9b3-4fcb-a482-068c889a7720", "comment": "Malware payload", "value": "685f0f729f21b0b4fdea6a05448980ee2d8d9239", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964987, "uuid": "8f57f860-033b-4ed9-90aa-aa9c2298b32f", "comment": "Malware payload", "value": "a2d20d8de45a5e3776cf8ced4b4153fe4a67c3087585a2aeaf0efa58ed8bd1ce35cb75855a4663ccb47f4f31ee1524d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964987, "uuid": "1444d256-f6b8-4ba2-8cc7-a8578a702dd0", "value": "T137D3028738A45059C80BCD76F1C9D560CBEA77FA8F962A916C17D63C8CE33E2464C54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964987, "uuid": "e5f390d3-7c6e-4244-a4b3-16500dcf19b1", "value": "3072:ujdaJe79xJHKsinr638TFXs0ZvdFSlNc9eU:De79/HKsad5Xs0ZvjsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779964987, "uuid": "47ce5c3b-7d60-45ea-a972-1f5072d8f5db", "value": 139024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779964987, "uuid": "660d5bf3-af4c-4feb-bc44-d31109f76373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964987, "uuid": "bd2690f7-6642-4b2a-a6aa-b86a967eb4fb", "value": "netutils.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b02712a-5a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933029, "uuid": "6f5e18e7-838a-4164-b2a5-8d9d22d06ad5", "comment": "Malware payload (Mirai)", "value": "47b3e172cfb8ebc36c50c50e2235873d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933029, "uuid": "8247319f-43d0-483b-b940-7e31feef1b84", "comment": "Malware payload (Mirai)", "value": "09e1aa92276d645201b9eb640d3c9856972d52fb60a176dad1ba6e568beb6652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933029, "uuid": "6ab66b9b-4f68-4e3a-a824-4a074a5d9c65", "comment": "Malware payload (Mirai)", "value": "fcecac21208cb29d0d849ae99dc866a9c8c70211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933029, "uuid": "ef7af92c-1404-4bf7-a43e-bb83d64b2202", "comment": "Malware payload (Mirai)", "value": "20ac6c32009242053c476021e14afc1bd2ec98445110230e4a5ac12495c0f66b80c3e7ea052a5ce40c5d46fbf8c788fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933029, "uuid": "37e42156-ae4b-4ef6-8a8d-ed6624136184", "value": "T1D5D66C47EC5695E8C5AEC134CA7696237B317C495B3123D31BA0F6292F33BD06ABA344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933029, "uuid": "611a5362-73ef-4a6a-bb3a-857f34aef02a", "value": "98304:6GC9Fl08pQwOXY/9l/iOwKP++91nz+SG68GXOm1D5EEW:6XT08gw++91nz+SG6uKHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933029, "uuid": "35111701-f01f-4c41-8e41-2f08755b05bd", "value": 12767394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933029, "uuid": "263803f3-5863-4919-94de-cc6ed95c8c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933029, "uuid": "63767006-4aa8-4bc3-9cdd-55a47d05d8c7", "value": "wife.amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cde798-5a39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933777, "uuid": "180a0904-d714-4b74-861c-a3a9fb8ecf1e", "comment": "Malware payload (Mirai)", "value": "f48de7081b7b33e5490079dc3d9b275b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933777, "uuid": "6bde3e89-f9cd-4aee-8056-ed1fd4e25fbf", "comment": "Malware payload (Mirai)", "value": "0a77a7f665e2d89c1852ccd929fbf82cb7a3a5bb313a5252afa884afa3d8513b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933777, "uuid": "13aad838-3319-4f9c-a1c4-81685131c98a", "comment": "Malware payload (Mirai)", "value": "118b767169eb745765bbb4f76d00f15e294e7f2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933777, "uuid": "8f537a5d-b11d-4b98-8602-5ac9046676d0", "comment": "Malware payload (Mirai)", "value": "af69e12a3abf6e8e2f00167d4f5b935251d8efcbbd788b81532d7bf452abeeb3006af83bcccfcdeb8c23cbf055fe6547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933777, "uuid": "af89ae37-0f68-4388-88cb-de4d3d1b442d", "value": "T1AEE63913AA1CE74ED629213058B1CA957B3A2C8541D6D817A3A2F318F9F307D5E6ECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933777, "uuid": "bef92194-23ca-49ab-90b6-4bcc49e2f6b1", "value": "98304:4oOdwzAhCGE+++91nz+SGSpCdbc6Z3rf3YP+Rrz8CjE7:HOdwz/GE+++91nz+SGSpCNrPrz8x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933777, "uuid": "ea6b43a7-5373-4941-b537-a91d97fbbb33", "value": 13893825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933777, "uuid": "22b8b9ca-11f7-4968-ba3a-189e82385aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933777, "uuid": "1c24fdb4-da5f-4748-b6ea-19b920e49296", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39573a3c-5a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932865, "uuid": "81767f5f-411e-4ba4-a304-3102eade7c13", "comment": "Malware payload (Mirai)", "value": "68ffad04e2b214a2c9902fef1dbd69a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932865, "uuid": "a004d06d-d74f-4564-9c6f-340cedc26c76", "comment": "Malware payload (Mirai)", "value": "0ab2f79ddc3a9b128dfe2adefd2cdcc175669f79bdfd15b9a365418c47532e37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932865, "uuid": "49871c90-b3d6-4448-b333-3a4373026755", "comment": "Malware payload (Mirai)", "value": "fde58be4de2289f75d0e5e55a32695802f631c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932865, "uuid": "0bf807f9-f20e-49af-9dda-d78a7de84a69", "comment": "Malware payload (Mirai)", "value": "bcbfda2cf6f3f6faac9a83b30e43e80e6ecce706a8fca475a0bd9aab405cb82ac6846f7b8b25628e19cd9504d229113a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932865, "uuid": "e84303dc-c139-4d9e-8b8e-a347f7803bbf", "value": "T131C64B61FACB50F6EA431D3090AFA23F23311D058B24DBD3DA447F25F977A922936259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932865, "uuid": "0875764c-f969-4f0e-baa3-41c318741f8b", "value": "196608:lJh0SjHz0wPgdAwWShyKCrkH++91nz+SGht9Gybt:j9H0dAw94KCgH++91nz+SGhTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932865, "uuid": "f9c0287f-ab2c-49a2-874e-57765c1dc47e", "value": 12234914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932865, "uuid": "b303dcbe-6751-42f4-95b7-81d02679c169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932865, "uuid": "a0d957c8-2043-42a3-a2ff-ed2eaf70b82e", "value": "wife.386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c342b441-5a30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779930090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930090, "uuid": "e8aaae21-b99e-4e1d-8eec-5af18c7ba6c5", "comment": "Malware payload (Mirai)", "value": "b02450d2c40715e26344009d031cdd01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930090, "uuid": "d6f7e357-17cb-4b47-a7bb-3cbd4726501e", "comment": "Malware payload (Mirai)", "value": "0b0201000d608ea96f7ce1405eb05f29b44fbedfdd0e8dacd780ce872e13b6cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930090, "uuid": "7dceb4f0-b1df-4756-b2f5-64cff47ae68a", "comment": "Malware payload (Mirai)", "value": "49250dc5380f2c14fcc748bc2b391b8e8f6cbc93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930090, "uuid": "08309de8-8c06-4138-acf0-2263cb9ef724", "comment": "Malware payload (Mirai)", "value": "299cc8ba5838478947ae04247264b95d26689a474075dab0fc9882fa918f3a7c91900ec66b94bf714fb427592f8b3e1e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930090, "uuid": "a44f2c01-f683-43a5-ad2c-6bb465ba5852", "value": "T182A139F7E2740C383429E907F76D95A474830AA798D97A95DAD5BDE0020D8CCB295F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930090, "uuid": "3cc5c378-3b30-4ea6-8826-99b78220ae3a", "value": "96:H/Vv07q7a7xVv0nJmVv040nVv035WVv0l70Vv07317770Vv0MgLVv0aqBVv0Z3Yw:9yoYT5s1vy3BvWwavOBfAQgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930090, "uuid": "2d2dc290-5d16-4ccf-be26-bba729b84822", "value": 5067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930090, "uuid": "b23e0e83-3fb1-4986-b8ba-088f197a0491", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930090, "uuid": "0b6641d1-4c14-4244-b5c0-7b3ad28794e0", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d157cd-5adb-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780003599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003599, "uuid": "ceebbd90-2000-4997-a9e6-6694e549cf36", "comment": "Malware payload (SalatStealer)", "value": "30e9fb0939dd0e373cb1b90e477c397a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003599, "uuid": "554b1b3b-bab0-4b0f-8a82-d689dcf73267", "comment": "Malware payload (SalatStealer)", "value": "0b6c65cde50cae62eb3e15a9857193abd2ed130f8d73de6afc3e58ac2397c49a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003599, "uuid": "16323242-b5d1-4274-ab83-d3d7607d934f", "comment": "Malware payload (SalatStealer)", "value": "ed3d9f1378745b35ed2a7a737576f281f88f49a4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003599, "uuid": "818e3472-4563-42a4-856f-896a4debb9ee", "comment": "Malware payload (SalatStealer)", "value": "4c5f1cd07793838e0050c8fc2f7e3815468b6e5e97c2709a00df98d3cee3f06fd333c8d9352f54b5b2a1aee24e82a3d0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003599, "uuid": "67254e88-b577-4f07-89e5-d58d78091261", "value": "T1ABF533D054CAFB15E6D471F0E499A03F39ECB2A73A014C8ADFA51C6E18D29C1639ED8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003599, "uuid": "cd433663-af35-49df-86b5-f7a25f9e1455", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003599, "uuid": "52a9f1a8-203c-48d6-a24d-855a40b0d88a", "value": "98304:l4tN6L1X1x73xW0yBdkqVlDp0q12rnIwEmfcyUFo63:l4tN6L1jTxq/VlCpn9Z0Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780003599, "uuid": "7ab4b572-66a8-4d36-bbd8-368f20b15469", "value": 3595776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780003599, "uuid": "f3995632-49ff-444e-8820-11997a4d7232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003599, "uuid": "0223727e-cd11-409d-84b0-a9a2549cad25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a1f225-5aef-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780011938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011938, "uuid": "d7c0a89b-0084-4109-84b7-28142f80e5ad", "comment": "Malware payload (ACRStealer)", "value": "ca8a1f66345fc9bad90385e846ba87ee", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011938, "uuid": "cb97a831-da84-4c3d-b114-e23a3b9fccbb", "comment": "Malware payload (ACRStealer)", "value": "0bc8490a5870f5a734aeab818fa39e919c7c221ab1071d323740871c593c398c", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011938, "uuid": "1d139bb2-3aea-4f35-9f3e-24238b6ba429", "comment": "Malware payload (ACRStealer)", "value": "c004dc59c0f832e3c4a3848ee4fdf92385f809ea", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011938, "uuid": "dce2ad66-4720-46d0-805e-1713902496fc", "comment": "Malware payload (ACRStealer)", "value": "29705ca4590f74ad4b1f270218d9986b184ef878057a30e0aacb72aeb04c544b15b464e6748d95ff33ceab7710d0a63c", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "not-ACRStealer", "colour": "#FB3AA8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011938, "uuid": "811a6c07-e5d4-4c81-ae5e-81d310325d96", "value": "T1FB967C4A7CE108EAD0AA633289B761817B71FC150F7263D72E50B2782FB27E85D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011938, "uuid": "13fe1511-4770-41e2-a1ca-fee9f01cbf5c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011938, "uuid": "ce41de22-bf56-423a-9f06-0bf63ab4f850", "value": "24576:TJqDn0Sk74bfbAKIQ95Cu+DwWJ7zShY+zIQipnKnbVb25RC1fnBele5yK2tFQg2r:TJ4n1k+cK/98uswphjzkwnU5RCOXmgDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780011938, "uuid": "87af7d13-c0c5-432c-8312-62a5bb55a836", "value": 8625792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780011938, "uuid": "34eb4d26-320f-489e-ab9e-c776c602ea32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011938, "uuid": "a99089ec-18df-40c2-a720-69d849720615", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c5d9e8-5ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779995299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995299, "uuid": "57be3a6f-d6f6-4f8f-8a8e-804c2c6a2c8e", "comment": "Malware payload", "value": "6be3c779bfb70ca7fed4a9dd34049641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995299, "uuid": "71fe3bc6-0fda-47e0-8038-8b4723eb754b", "comment": "Malware payload", "value": "0cc106c8df18438edb88b8e1888c6df95b25e1ca3975d35b9af9f526d5bdf8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995299, "uuid": "9e650341-a763-41d2-98d3-c3b60c0e6132", "comment": "Malware payload", "value": "9353069a4267ed1550e3ff4a9bb550b548d9f883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995299, "uuid": "6b7bf464-f16a-40db-823f-ec953173dbf2", "comment": "Malware payload", "value": "cdb66878470c4fc1b46179a193829320f93feec5980684d21aff39d25427674d94915af0cab01a08ce56c0db53299b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995299, "uuid": "67ebebde-3f78-4928-bf62-72e5792b6568", "value": "T18E43F136757BFB74D8243637B8AA10B1AF4427402D52EDFF19C372BD6C660826C3A588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995299, "uuid": "cb58a085-7e39-42f6-89ff-6d910f5fbd99", "value": "1536:k3rIZ2s1N4HjmiDuIXZY9tivBMFWe7hHt5ucm:kUB+miaIXZwwv6FWAt8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995299, "uuid": "38023e89-aa08-4925-8637-4037dbad9380", "value": 55620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995299, "uuid": "d256738b-a8c6-49ab-acfb-faa9f20d1869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995299, "uuid": "c7e4f475-3778-40b0-9e93-3a156eeedd4f", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2b634c-5a53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779945161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779945161, "uuid": "54d58499-b4d8-4907-a1b4-429f418b5dda", "comment": "Malware payload", "value": "fe3d11c43b62757257b0c9ff3de7dca9", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779945161, "uuid": "895f2947-1840-45f7-af6f-ffd78b95d345", "comment": "Malware payload", "value": "0d855d26d9d12800bfc001ca860d1757ca566efba7f4e3dbd309b97702cc1302", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779945161, "uuid": "82131077-ee8c-4bcb-92ee-299b91d84226", "comment": "Malware payload", "value": "bcf31bf503c440ab50f88653a3a5c7c191dc7e33", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779945161, "uuid": "a0f7cf8e-921d-42a7-a8bb-afa657e6a51d", "comment": "Malware payload", "value": "b92bef41bf3c75e28711b588c084941b39834f2fa02ce3e9e55f3d281cbda16d704f2d7ecf7f3e57fe12144fc4b660b7", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779945161, "uuid": "8a43dea1-f195-481f-9794-29949ddc6a23", "value": "T17605298326DB1CFADED32B3864DB633A6735FE718B6A4B674614D1312C135C1AE1AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779945161, "uuid": "11227be7-3d47-4755-9c87-2f67e1fdab43", "value": "394207ccc80d68349a228a7af82f621d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779945161, "uuid": "8382ba04-b176-4652-bebb-88db749f7095", "value": "12288:JLfLnAP21k+EBfvQ0FOhf+YHAFgVQFrSHm5SjHKYoYl:J7rAu1vefvQmOh2j5SjHKYoYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779945161, "uuid": "7779f9f9-45ae-4519-9552-4ee5a0f98c8e", "value": 853625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779945161, "uuid": "050239be-8704-421c-a3a0-76b5a9bbba56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779945161, "uuid": "72c265c8-1dca-4c8c-8efd-baebe374a702", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e94520-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "ccfe2998-0e77-4f1a-81b5-92319defde67", "comment": "Malware payload (Mirai)", "value": "ddf837837342eeca4ce7f5454ea7790a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "e3b0af73-5e2d-4964-beab-3912d5067102", "comment": "Malware payload (Mirai)", "value": "0e05333b281336dfe7b914ed8fb331b13eec471958758cdd5ffdac440e41b5a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "7c99760c-8fef-44e0-8558-09e472dd125e", "comment": "Malware payload (Mirai)", "value": "782f60b57da9cbe511cffebc08df8118f7357ac9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "1461ddd3-a4d5-4593-901e-854787f5898a", "comment": "Malware payload (Mirai)", "value": "543367f2a0f7ab116ec403f06fc1b411089cca1882e12fd17247bc01ce4eb0bffa692900231021e0ec6f4a195d28e4fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "0ed12567-d0d8-481f-9072-5c167aae510f", "value": "T198C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "0536994f-515a-4daa-ab42-a66b154e2c04", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPqO:LzhWutxBaORaebXQd+mzBzlkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970283, "uuid": "8696f3e4-19eb-403b-b5fb-375260faf8e0", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970283, "uuid": "d1568cd6-ce71-4e4b-9b14-e8b0d4b59764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "d88d02ae-265b-4e54-9f1c-9d79f12828ca", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f9f0ec-5ac6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779994430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994430, "uuid": "a1421639-bcac-4fd1-8e7d-a36f385b3395", "comment": "Malware payload (Mirai)", "value": "e240dfc4b9bb82e7d20fccacdb62074f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994430, "uuid": "9927c2b8-c511-4999-b98f-91b7b508a8b5", "comment": "Malware payload (Mirai)", "value": "0f111c1b32b448b412c318a2f1ce2e0c6f2f68b9136dafa874889278c9702d88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994430, "uuid": "a8891a78-e1d3-4725-91ee-1e5e8aeff71e", "comment": "Malware payload (Mirai)", "value": "9857810c71a1337bb32db7cf7a8c0b29a2754752", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994430, "uuid": "6bf4be72-67b2-4349-8cdc-4b08b910215e", "comment": "Malware payload (Mirai)", "value": "054c2b20d99d005f9769c6929738f000e070a658ee6a34592f5e4eace79d71f0f042a2403f8cd0f518d3ea737d842938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994430, "uuid": "c212b190-7ae7-41e1-86b5-409c12cf6dbd", "value": "T15535336726854FBAEB91AB3CC054748EE3B4EF34293EE38975F097350693AD1C574824", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994430, "uuid": "81e19c9a-1b8c-487b-85a2-5125cd298932", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/z:EpCKabVQ+9qlNlpjN8H8Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779994430, "uuid": "8925c078-43c9-4c7c-9063-eef930cadd1b", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779994430, "uuid": "c0750c4f-3b61-4bc7-8208-2695337d8695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994430, "uuid": "8faa7bb2-e407-449f-af69-ef00c372847f", "value": "20260528-160619_sftp__root_redtail_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c37602b-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "9fc3a7c2-28be-47af-b001-39013c38bc80", "comment": "Malware payload (Mirai)", "value": "b35fd397de9750ed05e14a875bf0db0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "9897f7d7-7a59-4396-9fed-6facc81e3cb7", "comment": "Malware payload (Mirai)", "value": "0fa502dffe22a1a1713d12b54a034a17d96de2bd9c8a9015b6ea4bc21922b26e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "1dc4740c-fe62-416d-a0a7-5d87a9fa1f30", "comment": "Malware payload (Mirai)", "value": "936d03333091670b733d9aa32a6cb3e54c131c0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "2646c5eb-a63c-4377-905d-22f58f801205", "comment": "Malware payload (Mirai)", "value": "924b3c35d7382d9d7695881ba219f38e01ff2e3d29748d83152baeba77c66700778c4d9259ae216135e37d2bccf74623", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "3ae4fead-bd05-4b21-be3c-85e2ffdafe4f", "value": "T17BA34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "f7bda4c5-a3b1-4f3c-8d71-39f4024f843d", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0ogj:bbbmPTO930bkbRl886gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969082, "uuid": "b1316ec2-71cd-4749-87af-c44c835efd3b", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969082, "uuid": "7056a0e7-907f-4146-b8fe-ccdc224df25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "7850da2e-07be-467f-9269-c44cad3e8f81", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c64efcd-5aa2-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779978907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978907, "uuid": "dcdec5cc-46e6-43dc-8bc6-ce93ca16278b", "comment": "Malware payload (NanoCore)", "value": "d5055092da14cf9985f755dbec97ec01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978907, "uuid": "411ac530-5384-4b3f-8cd6-e3c4c71503f8", "comment": "Malware payload (NanoCore)", "value": "112d957b56a0ccec1e06defc317c8b7b169b6e74514d1a6f7bee8c2b32b080ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978907, "uuid": "d0561615-7dfd-4559-9331-c689ba9459d4", "comment": "Malware payload (NanoCore)", "value": "84a408c0eb3be359866255074448c1c67aa806ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978907, "uuid": "c954bfa1-bf51-447b-a0cc-21b4da54e6bf", "comment": "Malware payload (NanoCore)", "value": "c7c6a50f58cf7225aa6858330d32005250ecb0efada016bfc05280cc8fe51fd52a01df10ee8364bb6a8ea39edb1fb4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978907, "uuid": "2dff7a40-bfa7-4609-a89f-a720ba8eb7be", "value": "T1F014BF2677B94A2FE2DE8679711206539378C2E398C3F3DE28D855B68F167E1060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978907, "uuid": "8adeaf23-87de-43ec-99e1-94a59682ecc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978907, "uuid": "7b2ed41e-b031-4362-820a-ef2d4b4d4b93", "value": "6144:uLV6Bta6dtJmakIM57BGmPDZ1ZgJB6QUWv:uLV6BtpmkWBGmPDZ1gB65Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779978907, "uuid": "71398c58-f97c-47b1-baf5-c7763b035133", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779978907, "uuid": "d9030ad3-3537-4666-aef7-a35b41b27bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978907, "uuid": "e7dc52dd-c87c-4165-ba75-86be1704e3de", "value": "gwwsite.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e555fbe-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779969408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969408, "uuid": "49390e6f-b42f-4760-a7c2-504e6f485502", "comment": "Malware payload (ValleyRAT)", "value": "80bcc7b11644c9b1e1637e28c6844429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969408, "uuid": "6a0d99bb-15d4-4292-af65-d05c042aa123", "comment": "Malware payload (ValleyRAT)", "value": "11c3c7fd8b9fbb954a5a21af80f38414795930d63e8c6f5ea67bc92162359c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969408, "uuid": "a2542ffa-9b13-466d-8fe7-9890e209c79b", "comment": "Malware payload (ValleyRAT)", "value": "9a63cf63e089492e8a24cc37391568c32a327ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969408, "uuid": "7265a2cc-ec54-46b9-b813-97c2c0650ad0", "comment": "Malware payload (ValleyRAT)", "value": "e57cd80786f7512be86b5d94f964b0937cb4cbe81743216d8216ae43368859fe4de108b2e45203c2c672dec2d5f7c655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969408, "uuid": "48265b48-1ae9-424f-af73-464f96a9c240", "value": "T174F733022BDEEF72F2050E7E957A95D900566E0CF95AB82E633EB10863BE631D4471CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969408, "uuid": "61663ad5-602f-4d81-ad13-16a235b658fa", "value": "311d1e93d89e02a2908fe4b6d6a25ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969408, "uuid": "ecfa0319-e671-43dd-b90d-84b651e48ffb", "value": "1572864:1jtYoJIh1cemxWXnMsXfCQGjVm4fl6izMO+oVoqKrEuMbNoadZFfOTaA7jHta:1jtYoSWemEXd6QKftVzJV7Kp1anhcBta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969408, "uuid": "8fbe5d6c-16c3-4b42-a778-04c127e42a6d", "value": 70316002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969408, "uuid": "f5f80431-d9ec-40fd-9155-67d5455d429a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969408, "uuid": "4d72bb3b-45dc-4697-b7a2-630febccfaeb", "value": "testup-x64.6.71.9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfafce3f-5a4b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779941707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779941707, "uuid": "c9d6edb0-527a-48c7-80a7-548ae5631a6f", "comment": "Malware payload (WannaCry)", "value": "ec1b949932e8ecad1c2b8960d5bab8f7", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779941707, "uuid": "9f5389af-f9c8-41da-b226-0d315090ded7", "comment": "Malware payload (WannaCry)", "value": "122b5c3e98a3d2b7e91760adae349f3ba7aab78299684d61c369405515f61e4d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779941707, "uuid": "b5dbab87-7a22-42d5-97f8-4ff5350e6996", "comment": "Malware payload (WannaCry)", "value": "3b6040d4ec673dbd5ff637448e9ce3f8d3a73e65", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779941707, "uuid": "2cf48f8b-c31d-4aeb-85c9-b146b5950a36", "comment": "Malware payload (WannaCry)", "value": "85e22bbf89560da1af4c60552a001886cab79c6b4d73a015404c9bc4a27f03df730d72da8ae22136f3ab829f65d71289", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779941707, "uuid": "68e37022-8b10-46a4-b4f9-622a53423785", "value": "T17E36235932BC81FCD106267844F78E22E3B37C6A16FE5B0F8B40896A1E13B55BB64743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779941707, "uuid": "9a376b7f-c7da-44d4-9f80-718d00b7c04f", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779941707, "uuid": "bcc6bafc-d17f-4834-a2c6-077ee29e67f9", "value": "49152:jnsnxEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMyPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779941707, "uuid": "2721cda2-5e9b-490f-aec4-1d89bc565ddb", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779941707, "uuid": "0eb638f7-14e3-46b2-afd9-f43e94b9bb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779941707, "uuid": "a69f56bc-9a1e-4bbd-a8b1-138a788f33b0", "value": "122b5c3e98a3d2b7e91760adae349f3ba7aab78299684d61c369405515f61e4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579372a1-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974148, "uuid": "f5ee09bc-f068-47c4-a720-746bed124af0", "comment": "Malware payload (Mirai)", "value": "ff60c67a3797e8cfa381cafc70b2f283", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974148, "uuid": "0e46ffa3-1f59-474b-bc4c-5c516b60581d", "comment": "Malware payload (Mirai)", "value": "12a93b58747c06bec9784cc30e522b7b2775634b0e492b77b68b22d58a8e2c75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974148, "uuid": "ed0d5145-4ab3-43ba-a7dc-7afc2b870d70", "comment": "Malware payload (Mirai)", "value": "488a424d403d7fe70cf4a07223ef500439bce4b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974148, "uuid": "11c818d3-e32f-4af7-952e-060c99a5f22b", "comment": "Malware payload (Mirai)", "value": "a161e4a6270626f92e6f1420f047da9cceee204a5da8ebce630edfb29f8957a994dde1d4ca0ae832f8123938d60e7f80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974148, "uuid": "8bfa1869-f861-446c-a3c6-49caf731615e", "value": "T1FD5329C5B193E4F5EC10093D307AAB62AEB7E13B707AEE8FC7D954739942602910639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974148, "uuid": "4d54cc03-4b39-49e3-955f-761217f2a4b5", "value": "1536:8eqSu6GhlyN05vzpiSWk/nwNYR9ns9qzJfWR:8eqR6Ghlf5zpiSWk/n/R9ncqtuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974148, "uuid": "53fdf13e-a670-4fb5-898e-784cefbfa53f", "value": 63452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974148, "uuid": "2bc192e7-25e6-47ab-a67c-5e43b2037a57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974148, "uuid": "b6223b6b-cf0e-4076-9335-79127e961820", "value": "000abccf991307ca36d4d410c78ce6d04ccccb071a4e43ac65ddfcc2d7bc8ca1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1216ffcf-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001089, "uuid": "2ca8e81a-dbef-4282-8e42-a881c046d8e0", "comment": "Malware payload (Mirai)", "value": "d8ecf2aadde681f44f8026679f4f6594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001089, "uuid": "2bcc3e53-0ef1-420a-8dcc-f6c45bacf034", "comment": "Malware payload (Mirai)", "value": "131274332d7f0c7a0bea9649479478f2044f073d39346beb6f443c3a404aeacc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001089, "uuid": "d9956cc1-0f51-48e4-8426-0d1795234539", "comment": "Malware payload (Mirai)", "value": "6e369f61d25ec7d4a7863c29068659b86ed33a1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001089, "uuid": "f6e15823-c8a7-40f8-9b1a-01f513bef048", "comment": "Malware payload (Mirai)", "value": "670a39a85d5560d1f5834c5179b72e40697282dd808fa01a2d7508c9b8133609e3659db27ed3fffed479b11006c271f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001089, "uuid": "a31474d3-a869-4724-ae64-531d5bffefe6", "value": "T124D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001089, "uuid": "c1f267fc-e6c4-4e38-83bb-fb054fd9da70", "value": "3072:79eSuygEPjt6qkWqVdKmDnYMb0gBd/gQyVGsdqml6Raj:79eSuygEPjt6qkWqGeH2laRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001089, "uuid": "84f11993-8478-4ae2-9daa-fc9e3759f96c", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001089, "uuid": "1394f691-3bea-41b2-911f-2f6e439a3eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001089, "uuid": "602904b7-9600-46ad-a3a9-e9d97373b81d", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ab9b97-5a5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779948022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948022, "uuid": "2c67cc2e-ab2b-459c-9ff3-6a19a212de32", "comment": "Malware payload", "value": "6638c6b5cc4bf1ae43aea4920d81d0f8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948022, "uuid": "5b58e133-6212-4abb-b414-1319049f205d", "comment": "Malware payload", "value": "133eaa7631a5e2db1e09dfe8b8303013f6a267b36576136fee9692e84712830d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948022, "uuid": "cb89edc7-2ece-43bb-8eb0-2e0e8546ee6f", "comment": "Malware payload", "value": "8f9e04e73c5892ac19cfa00cd6020fd06a93888d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948022, "uuid": "b0a46737-6478-487a-9fcf-20444185b0ec", "comment": "Malware payload", "value": "5f1b16eb52282540a7ad541cf9f31a7958a5a7e7ad180ff27d9c608fbb71d15a5998510c38d96b05dc174c786d3c9f81", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779948022, "uuid": "2f6661a0-5807-4563-86e6-f9d74c56cd69", "value": "T185A31541F7F94119BAB72F442AB946B8497BBF92253DC9DDCA100D4E0B32518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779948022, "uuid": "f51314e9-35c4-4ea3-bc41-3b42e3fa2a8d", "value": "768:zTMaqWi8PTYUgzRQc30XjFJghTHu5v123xF82zuNTl3HxObN4/ByJ8E6M1o017mu:NBJJo7t03vMSVL4nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779948022, "uuid": "3f618104-9959-494a-a2c3-eb6c0d9bae56", "value": 105518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779948022, "uuid": "c426aef5-3b20-4f3b-8c10-88ae60a9835b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779948022, "uuid": "fac3c839-09c0-414e-aa17-399afc777f38", "value": "rbriefing_2658c7fa.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c853209-5a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934132, "uuid": "c8f1410e-674c-4c19-8869-3411fa890e96", "comment": "Malware payload (Mirai)", "value": "7b6002e04bd57edf53c5c8e61954fdbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934132, "uuid": "53008e7b-3668-4dad-9bd3-d0cb0602e23d", "comment": "Malware payload (Mirai)", "value": "1356b4bcb55023916682b6e44aeae22e04b3605d8692525b72dfce6ed327f690", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934132, "uuid": "6dec24ab-0c4e-40d8-bbae-9f0146a44af2", "comment": "Malware payload (Mirai)", "value": "911bdcef10b03bc48603853a39067e740a19e294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934132, "uuid": "a23cac22-eebd-49c7-bc9a-3e0bcbd17277", "comment": "Malware payload (Mirai)", "value": "2421799ca1c53fa02b07706224ab235e426b3352bb0a76990443f18ab758f9a4825d75527ad6c31e2f19113022ced34f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934132, "uuid": "2c025ec8-6f8d-44e5-9d1c-c314f0a6df36", "value": "T11D949713D9118991E0654CF3226B3245B94787BB8AE732D3ED1A4EB1BF2151F42BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934132, "uuid": "c5599b0e-4cbc-456a-8cea-32c73e39368b", "value": "6144:WkFEG2as5jz9YVqjiluRjoiH4XA/M/9fJx7M4:WEn2as5jz9YVekyjNHxU/nxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934132, "uuid": "5cc99e61-d4f5-4f11-be47-5a411b1cb69b", "value": 409485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934132, "uuid": "4fdab925-40ec-44cc-a693-bd44ed771105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934132, "uuid": "4afcc314-8b17-4578-a574-49bad1cefdf9", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2c0bbc-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969516, "uuid": "24cd3fed-520e-40a8-b888-c7d4dd6665ee", "comment": "Malware payload (Mirai)", "value": "36fbadeefe3209bc25c2f510ef98b080", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969516, "uuid": "360887bf-6ec0-48f9-8ca2-3b8579750c01", "comment": "Malware payload (Mirai)", "value": "135d9bece3f21f62f813ab7d6423049b160145fae93bea27f2cbd1951bf50e05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969516, "uuid": "2c2dadf6-458b-4de0-97ff-c3bee05bb517", "comment": "Malware payload (Mirai)", "value": "8e0f446c83b0ae404aa3c83a9a4736c13d08349d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969516, "uuid": "bae0f122-1c3a-49f2-b760-7fbe56c7c75e", "comment": "Malware payload (Mirai)", "value": "23d3e1ddf62ef12badf9973f1439d87f8517adcd0bc93ba91386639b44c5735909bdd5a19a4778c35e5a5f6a766c3c92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969516, "uuid": "3c833fc9-5976-437a-92fe-4204ba568f80", "value": "T1A5838E22CC785DA8F03A7D7420F58AFA4717A540581B6DFB3C468261505BECCF69BBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969516, "uuid": "a56992e9-7e8e-4c5a-9fbe-11f1b65643a6", "value": "1536:yqfJ3dTOIwm+KNToWguSM7nW34GwY5bf1PGIQ7VncCwkcBu:nfJ3dTOIhbToWguNntW5RPmZnc9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969516, "uuid": "a742e2f8-96b6-4f3e-bed4-65fc82a50ccf", "value": 86940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969516, "uuid": "fab0a18b-c394-4f8a-a0a9-0991369babd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969516, "uuid": "d7fc3467-f46e-4ed3-a4b4-ae4ea36cbbd3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60b5601-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970521, "uuid": "46774baf-cc95-4003-a16f-44fe9c17bfd0", "comment": "Malware payload (Mirai)", "value": "575e520deb45b25d19945d821de999b9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970521, "uuid": "24d548d2-e2b6-42d5-8a48-aa197494921e", "comment": "Malware payload (Mirai)", "value": "143b6f84da07ffae488b88482c2f7d28f8522c2bc489e1104c8f10585eb69236", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970521, "uuid": "3dd1c242-eb85-48c2-8665-7965a3c16692", "comment": "Malware payload (Mirai)", "value": "503a7fd60f638c61348e7a4198354de4d61dce10", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970521, "uuid": "6591ebad-7727-458b-ad97-b35b6d9a16f8", "comment": "Malware payload (Mirai)", "value": "98c190c0874c451ede5f3cc49ef8c13e8165d54bc199d98b32be03950544afacfca20c147fae3b975dead6c37227730c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970521, "uuid": "f3a801f3-7a10-4177-ba5b-5abe7ba09c44", "value": "T112B3AF87B2907ABEF0A45E3FC4135E26A6259F705583273D71FDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970521, "uuid": "bf03efca-a764-40e9-bd89-845e0d6e1481", "value": "1536:tdNSXAeuUGWnKYUqwaJ1Xq/3A5hcB57laZeCNjHWBOdiyWT15Ov6fHz58rSR:t3SrlGWnKTU83AQB5A5Liy36fVUSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970521, "uuid": "5d68ba8d-9fb6-4a92-893d-87ed41627b28", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970521, "uuid": "e4ea7794-88f3-493d-9b88-3f5abd759772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970521, "uuid": "85602381-9e27-42ea-bceb-86cc44a17c51", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1076cb61-5acb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779996362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996362, "uuid": "e95b355d-07fb-40c6-b480-1a8360520fa1", "comment": "Malware payload (Mirai)", "value": "e76f986636882cce0ba0c39bb6ef3073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996362, "uuid": "6f3b22c0-7137-475b-808e-af0835e5abc6", "comment": "Malware payload (Mirai)", "value": "151c3e4a2af7f10f6245d57811280665c8e7d18ae37f439190fb11933c82476c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996362, "uuid": "2173befe-0f71-477c-80b6-326fbefc8f63", "comment": "Malware payload (Mirai)", "value": "aae3405686a61821100a3b60bd7cc363c5bb1fb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996362, "uuid": "5dfe917f-c14e-4c81-9615-9ee2b96cb9c8", "comment": "Malware payload (Mirai)", "value": "f54e1e469997555281591e8ca5b895dcaf2d15d50c3d0e6584276e277f256b134ba3f642036080fb4b2c397612318e4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996362, "uuid": "1e5ac164-cffa-4996-8e78-0da6e709da30", "value": "T1D604C60AAF920FFBD86FDD3701A90A4235CC515722A43B757674D928F54BA0F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996362, "uuid": "538876ad-bf12-44f1-ab82-abc2e52d0a89", "value": "3072:oCqQUOqTAXxCGaLqFQLk2e26RMQjrLyYPISz:hqzAXxCGafYE6RMQjrLJPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779996362, "uuid": "8c68b6c6-04c8-4efb-b7e4-8e56eb33b22c", "value": 189760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779996362, "uuid": "e9ba1bda-9028-4a49-82b8-a81ad901759a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996362, "uuid": "40eefcf4-69a2-4d21-8305-8dd77f5b9c87", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8635b565-5a3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934712, "uuid": "d27576f6-20ed-4bf3-bb71-5193bc83ae71", "comment": "Malware payload (Mirai)", "value": "ade6ddd6ed2e6267a63d9baaf7bf66c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934712, "uuid": "7045dc3b-94c8-4987-a61c-b15d7225ca66", "comment": "Malware payload (Mirai)", "value": "15ae0ab0178c9a2c592d6bb4caaa16942020303398d50f1e6de591dbd4f9e746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934712, "uuid": "45b2dbc2-2900-4153-a9a6-d958831a9136", "comment": "Malware payload (Mirai)", "value": "12a380c4c368a391ae9c8e637f630ef033f051bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934712, "uuid": "632791f7-59fb-4890-805d-16eb9eb27c59", "comment": "Malware payload (Mirai)", "value": "b4bcdb004cc8c63055d104e88e316927401a9da1af972603579af05e4d89f43d54265ba26ddd45a273c954697a4ec8a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934712, "uuid": "b4024ff5-b278-4125-9ec9-3b6c7c89155a", "value": "T183E62C51ADC26B66CACD0334C4ED63AA62603E445695432313F4FBA83F7773DAF5A488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934712, "uuid": "02cc567a-f7dd-449f-bace-fd23f425cb56", "value": "196608:xS3NzIuOGOvCuqCNmmfIb61N++91nz+SGRUgPDo:Udz161N++91nz+SGpPDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934712, "uuid": "a0b533a9-0f82-45f2-97e7-687f13e6e446", "value": 14090402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934712, "uuid": "748f1be4-cb05-4caa-a605-189b622e07a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934712, "uuid": "97464d4b-068e-48c9-a6f5-16ac3c631b15", "value": "wife.mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afb82d2-5a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934076, "uuid": "306f5e9d-289a-4e6b-aed5-4610ebf48bd5", "comment": "Malware payload (Mirai)", "value": "6e162cf148979661090f567b9123d211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934076, "uuid": "0bbf65f0-74dd-420b-8d99-575e1867d438", "comment": "Malware payload (Mirai)", "value": "167bab02221cd3e0f1503c6702b68d13b6833ab2a3967d9e96c70a91ce05d66f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934076, "uuid": "89e68282-662c-4e1f-8dcd-6b95a48c5590", "comment": "Malware payload (Mirai)", "value": "87dc2bcb3b74b76b6b1b7f4ae2d5e7494e4ba1a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934076, "uuid": "8875f96e-6d46-44bb-9498-cba88fe78e9d", "comment": "Malware payload (Mirai)", "value": "296aebf14e5f67045056bc6b71a6aebf617fc666ed00f93cd649808de58b40b67db25da65183f6bf64ec5ad834514ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934076, "uuid": "5073e5bd-db25-43c7-b761-6ce1640084c3", "value": "T1DD930105B323A4A1C9710DDB29934351025D2DB791F6F22BE6BAD3384D058BBB935AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934076, "uuid": "80e8c2de-ed69-4f40-b8a7-9f05dc93a5e6", "value": "1536:CKm+Xod8JgOmOtoh5xHmP3xrWEj0dZA4MSO6xzXS97sy/WQo+:CKNXRNmP3W3hpYntS97d/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934076, "uuid": "5b08c798-6eb4-41cf-8091-80cf53f1a11c", "value": 91168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934076, "uuid": "0ab09073-9478-43c0-a184-07edba137d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934076, "uuid": "a1d01578-f2b5-4c19-be9b-d55e52bc8e9a", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780eb5c7-5acb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779996536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996536, "uuid": "85623135-49f1-4359-a876-8d95d71b735a", "comment": "Malware payload", "value": "2d28f53704845188bdabcae26705b13d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996536, "uuid": "de9371a0-303e-424a-bcdb-b98f9f47eff9", "comment": "Malware payload", "value": "16900542857f1c0984e36fcbba9e045a585f73d920f55a382c31493f0d4a8d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996536, "uuid": "17c1d8c6-a065-4592-ae85-54bf18838469", "comment": "Malware payload", "value": "f43d2d9dbef4396e774c19ad2ace60c586c4079e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996536, "uuid": "1afd3c7c-81ef-4b98-adfd-89f810abfc9f", "comment": "Malware payload", "value": "d2702babab54032cbe5d24bba14e8c1ca74f7aba26b819e698ca3fb7d0094c7bd32458295fa01d548ad717ca6131f8a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996536, "uuid": "b6738d3e-1a96-425d-a3a5-a98677a70c41", "value": "T18EE31956F9809B12D5C155BEFF0E128E33131B7CE2DE3212AD246B74778A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996536, "uuid": "1836979d-5d2c-423a-9635-cb36ce92653c", "value": "3072:6CCBogsBQ93lNtqanegC9qcgl2wAMlkDPrwbdJY7XVQ3:gyL6Ptqane39qndA4kDP0dJY7FQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779996536, "uuid": "b59db49e-dcc9-41e7-9bdd-a6b7eafef3ca", "value": 150164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779996536, "uuid": "aed51eb6-de4a-4c13-867d-0c7d3a2b05b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996536, "uuid": "6945c087-3e64-4e37-bd5e-d093dd061939", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97290dba-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779953638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953638, "uuid": "7a1b7141-65d4-4668-bab8-e3cadb1397a7", "comment": "Malware payload (Mirai)", "value": "a65f867e6e60e2132176d004799337f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953638, "uuid": "bf9272c2-fbc6-4c32-8115-cb5a148fc1ee", "comment": "Malware payload (Mirai)", "value": "16a5d5e88f244aa48753e865e58a2b012476f1f23369c1e30df94b95f2ff423d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953638, "uuid": "891a43e4-f7a8-4c36-8538-57b6e72b0c38", "comment": "Malware payload (Mirai)", "value": "94d918c62d1c3c57b0db7487313e98cfbaac709f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953638, "uuid": "6f47a2ab-911e-4863-950a-a0144418241d", "comment": "Malware payload (Mirai)", "value": "4e60709bd81a7447150b638bc0b9c4def452a161497ea616c79a9ffe78387ad47349875ed46120e1e4594df6aee8af48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953638, "uuid": "2309704b-3af7-412d-8223-ed70de55a36f", "value": "T1A03301D0407BAEBAD436E2B143999A45DFCA3329BA15BB0B0436E16E5C8FC2D3F11754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953638, "uuid": "3805582c-b026-4989-9044-4eafe43c897e", "value": "1536:mKc7rSS/hoKhpCPscoIpknrus4bzkGl4oPg53o0CAH:oX/hoKhpK1t+4bzkDWwFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953638, "uuid": "13495a77-4224-4e9e-802a-9447198ca2a7", "value": 54236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953638, "uuid": "fca98d9a-e65c-4cac-8fc9-d1681c000568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953638, "uuid": "c8b0c6b7-bf6e-41bc-926d-105bc43f7ce6", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83736ac4-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970785, "uuid": "0e57385e-73f0-4fb7-83ac-c451c7fc7b02", "comment": "Malware payload (Mirai)", "value": "8d1b6f8d7ead015b27412f2bc46d91bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970785, "uuid": "52e5af90-fbf2-4225-aaec-af57d1d97c2b", "comment": "Malware payload (Mirai)", "value": "16a9fe3a5fad1d2d5f3093dfa18f18c7d764256fb8527ea5af692a6093b1c619", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970785, "uuid": "78646aa8-a7a1-41ac-966d-94ba5d560c29", "comment": "Malware payload (Mirai)", "value": "a2ecc02454d86a18163943d991423aea4df37ff0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970785, "uuid": "7761fff3-bd29-4185-a6b4-8b1ca68c6532", "comment": "Malware payload (Mirai)", "value": "c762fd39d60d42203f5ce054533296fc585fe7600f893a5fa6001b6d934c151a9c23444c4f6dff5f7fdebb5df8101405", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970785, "uuid": "29128058-605a-4867-9b6c-a6f798e530bb", "value": "T144C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970785, "uuid": "e1948e40-158f-4883-a456-608aef290c26", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3a0j:IaOulLUUogcQ9BvMEWSWC2h3a0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970785, "uuid": "6a5deb83-8f57-4911-af92-30a57b4bec8e", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970785, "uuid": "6bd07600-4688-423c-902a-996d9374cd18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970785, "uuid": "ff7d7a36-976f-4774-ab90-0395a361afe5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f60713-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966439, "uuid": "5185ade1-dace-4513-8eab-bec4354ee6ee", "comment": "Malware payload", "value": "e05ae55033108876a12da45d54a4cfaf", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966439, "uuid": "418b0c57-d5dd-487d-9d99-600a6162e68d", "comment": "Malware payload", "value": "16ee9520e6afa8cce15f8bc5f9fed02ab855947b10b8bd388c56219006c102bd", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966439, "uuid": "80c562dc-d424-4a46-933a-ceaa3fe71311", "comment": "Malware payload", "value": "6bcedf4f0a70ceb4f4c502ad2098cddf2f7bdf27", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966439, "uuid": "2a99d54a-eecb-49bf-90de-de5440b1ec90", "comment": "Malware payload", "value": "76251950f6fe821d9dba26eb616e20321a3964b438936780bab61b499a3c31667d1f044f274887aa335b24a0ae4590c5", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966439, "uuid": "83bb3839-63e1-403a-a901-d4c982ea43f4", "value": "T1D5073315D2E8EA9AE64BB37D802CD75A492EAFC53401FD8E6EA411D95C4B0DCD30BC1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966439, "uuid": "94fa548c-762c-443f-b16e-d375699f514e", "value": "393216:xu9qUcTErl8BWVA0t8W3qJQlCJk2TMxYzF+lpT9oF+h:xu9PcTEJNVvhn/YzF+fAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966439, "uuid": "cdff7e26-f07d-447a-ad5a-6bc1210c3564", "value": 17879490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966439, "uuid": "01964bb3-be65-4b82-8c88-d6521fff0560", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966439, "uuid": "c15b26d0-010e-4a9a-ab28-f51448bdc0c0", "value": "Loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a3b787-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969556, "uuid": "42164f51-b361-438d-9b79-4b766ccb48d2", "comment": "Malware payload (Mirai)", "value": "9d4ff7749e2f65d2deac9dbbe4059812", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969556, "uuid": "7f5d7a56-452a-4af0-975c-27ba8083b21b", "comment": "Malware payload (Mirai)", "value": "16f5d05e40d19d12d15560e5328845308de5d18b34da8d415d105c5d0c4abd6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969556, "uuid": "4c64c4e8-701a-4429-8d46-12e056279574", "comment": "Malware payload (Mirai)", "value": "7e6ab24bd6a8349b6bc51d588326499867464e72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969556, "uuid": "40f4cc20-8508-4270-b897-492fd0a12153", "comment": "Malware payload (Mirai)", "value": "d7b60e99e5d0bc1cc58ffa44b75a22b58265ecddbb6c0a9c959ce2ca30b4fc154623a2bf38b9046231d9762eaea44848", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969556, "uuid": "3d063413-0632-4a0c-8adf-7e0fee044de7", "value": "T10983A64B6E539FADF32C82344BB38B3A6755239633B0C6C4E25CD9005D6024E596FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969556, "uuid": "3c67e8ab-f554-4c5b-82e9-b51e5d81b4c3", "value": "1536:iM8nDZ51z5yLWuN6uNY3NhZ12xnCb0pU+iTEI1nhBZg7:j0Z5aLc4xnCb0pU+u1Da7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969556, "uuid": "034530ce-7090-44a7-a9ab-e91cb9ee7e2b", "value": 85028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969556, "uuid": "e47228bb-8770-44c0-9639-d01464d06eb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969556, "uuid": "f8642b29-bb9e-4a74-8e07-8e3b42b2f023", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5889a7a2-5aeb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780010227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010227, "uuid": "e49eeb5e-56f6-4848-8a77-6ce205e79cdd", "comment": "Malware payload (Mirai)", "value": "050218d92f6ad022dcad86a890bbbd62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010227, "uuid": "4ede7fcf-aaa3-4ee4-8efd-ccf011e039df", "comment": "Malware payload (Mirai)", "value": "16fdf3b19cc83e90f1872622c6b1685844b22726f14871272ec0189d3b7102bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010227, "uuid": "8566d34c-46f3-4692-93e2-d1caeb5cfafb", "comment": "Malware payload (Mirai)", "value": "1cf3df17e03136aaea7f905a24f2e28e227f65e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010227, "uuid": "321ae8fb-750b-4cdb-b2c3-0b40c4c51524", "comment": "Malware payload (Mirai)", "value": "2114590ebc5daa1c45799079eb12abf14e143952cc7ccfbac73b3303d0e71d7256603376c6d51d15e07df93d8ec0d026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010227, "uuid": "6599a0ad-f63e-46d8-97cf-35a316f25d50", "value": "T13A731892FE81D951C5D529BBFA5F42CC339307ACC7EE72028D019A30A6DF5694E3AE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010227, "uuid": "345acb3e-6d00-4081-8d78-67a512b0bffe", "value": "1536:D1erNxDRykNubaJX0utdrp/x2c3V4ROTHMdaYD27:YfSOEQX/xvF4KBYq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010227, "uuid": "f8a8f053-f937-4bf5-a732-4f3ab6d63e09", "value": 75748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010227, "uuid": "3fc7515a-59a4-473d-bfe7-d2cd09befd42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010227, "uuid": "950a8fe0-7a90-48e0-8373-e39d85a4a8b1", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40902944-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "9ce32002-863b-403f-9a39-0ea8af293309", "comment": "Malware payload (Mirai)", "value": "e9ed08838b40efd594b8b82d37677c68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "43bc4ec6-c2df-4b1e-b1e0-8ca27669175b", "comment": "Malware payload (Mirai)", "value": "17301f1e0d4ede98ca64b92f57e6957a0e81a41a21c17cce1a82a2e835af2f87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "d5d909b2-1667-4bf2-a3a6-5ba5375a20e6", "comment": "Malware payload (Mirai)", "value": "0640b012f08654307c17e99074ee4fc0ed518d28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "11eab872-9c66-4490-a736-f82b5b535a2e", "comment": "Malware payload (Mirai)", "value": "36003157ad57b99d395f6292d4a558d32d4486307c235d3451a5e1778b032d49bf5d4afd177430a803727a738755e1c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "6e00ce19-7328-4ffb-838b-f3b0dd994e03", "value": "T1539308CABC818B10D5D525BAFE0E218D33538BB8E3FA7113CE145B2E678AC5B0A77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "6b7db6f2-906f-464f-aeae-882e609c7845", "value": "1536:/EnP+0YuRAE1E93pCATJeh53E3QhohgVQ09Uv6sfqrWn+9e0m3VLMClmDiJyywG:v0pRAE1ERUATJehlE3Qhap09E63Wn+9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969814, "uuid": "f51b62a2-2e6b-43b2-97b2-9b0add7998b9", "value": 91932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969814, "uuid": "1e354355-3390-4671-8e1c-18b34ecd8a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "193a341e-0f0a-41c2-a198-e030971fe813", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708ba841-5a30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779929951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929951, "uuid": "7ff2f758-16c2-4ec5-a4cc-fe69174ff254", "comment": "Malware payload", "value": "e106adf4803269bfa773344a143dd316", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929951, "uuid": "9ecb42ff-1ebe-4fc5-873a-46c71d277fc4", "comment": "Malware payload", "value": "18ba9125f584d1bc11d0c2954f506a58c497c3028918d51536c22c746a335220", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929951, "uuid": "9d5b6ce8-af04-4d63-8d45-2369eb4a7bfa", "comment": "Malware payload", "value": "3b439679efa7572e35e56599c28f31795e62804c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929951, "uuid": "ede4ea2c-631e-492a-abf7-567b04dec93b", "comment": "Malware payload", "value": "b5bb11eb45d35f507495bfe00f1be3b40f6c2d6679ccbc60942c5519d1656baabc01398515a1080e5e5c354aaf44fcfe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929951, "uuid": "b18a8fc1-fd1b-4db6-90e9-af04fc801ce5", "value": "T129138D6966817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929951, "uuid": "e5117aee-44b4-4705-8b85-d02d6eee1a58", "value": "768:/+YaV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:/+YaGcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779929951, "uuid": "77973dbd-21e6-4afb-9e75-23f32b8ea0fe", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779929951, "uuid": "a5baafd0-5da5-4434-8b08-011a42b1ec3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929951, "uuid": "e3c89f60-ceed-41a1-a54c-7199517ae9f6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db699cf9-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "a8303094-897c-4a29-8c6e-e51dc47f8249", "comment": "Malware payload (Mirai)", "value": "5cb9e89c7949040517f02f3f56ba2797", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "245ebc66-2b63-4430-a458-f0b92682c113", "comment": "Malware payload (Mirai)", "value": "18ee3cc97ff0241c7f86d74dbc2faa72b0365af5236ed8cae6a456883c8e12fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "7fabc215-d710-490e-b13a-6b4d671d83f0", "comment": "Malware payload (Mirai)", "value": "eab383dfa13ded6f34a2bd4231f82e6957e7731b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "a95fbaf5-ad9e-4786-add5-8638b2640b65", "comment": "Malware payload (Mirai)", "value": "95981b783da756f5c3763fc06df8b902b7417ed61c89d2aa0b567a3ec026290b4578f90eebc5c4b5cb436d98a68b14d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "821e48af-725a-4c83-bc7e-779940486387", "value": "T1BEC23C369BBDAE47C5C0233A10E3033295ED9F455064838F7D165C8B6E5A3910E7AFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "91fcf96f-a2a2-4276-8981-88155e93174b", "value": "768:m4xPK7/zdWWl5BYoAqt39zKAlVQiGLAi5:m4xPKj1lYoAqtNeQnIv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973939, "uuid": "0015cb41-054c-4b88-b5fe-448092cb670d", "value": 26760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973939, "uuid": "97e56b21-c927-4e04-aa55-e5c0b9a7b657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "f973c776-3d63-4080-8c63-8e3f3d41d106", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c661bb0-5a6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779955741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955741, "uuid": "884302d6-9658-4474-b4b2-c50bd83501f2", "comment": "Malware payload (Phorpiex)", "value": "17a671ae4a461b6fc7f2b9721e029e3d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955741, "uuid": "a523ff43-0b7b-419f-8c06-3dfb8b0e4968", "comment": "Malware payload (Phorpiex)", "value": "19b3e8d5ff3d3a4d42e40d28f1529429b33450b8a3a1bcaf505c4110f220f787", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955741, "uuid": "75609d03-6396-4b06-8ea2-dbd26697ca8c", "comment": "Malware payload (Phorpiex)", "value": "72b3ba53c5688203e0c677713d9d2a168c8ee5fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955741, "uuid": "0fabb289-c28b-4f12-b089-ef3cace9d235", "comment": "Malware payload (Phorpiex)", "value": "78d490b3939e3741da4dab1bb3381047b9f69b76282511482feaa58895d890361bb36c39c42ebe3ae478e2240c3014da", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955741, "uuid": "7e08a6cd-48f9-420b-a168-d019552d69f1", "value": "T193823A0FB9428216D1E210B05676863BD979987237C854DBFBD18AD90FA82D6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955741, "uuid": "f94c7c03-c1a1-40f1-9937-c538ef329f1b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955741, "uuid": "44f477cc-76bf-42dd-a225-79d767baedfb", "value": "192:VKSSCngTBv5/dVfTHD5DIS8qkle6I93fKUSvu9zw+ggSPCiMbO5Ot1EdkF4U93mm:bI5/dVf+jqk0RSu9JgPG7NWav8U9c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779955741, "uuid": "505d47a4-6166-463c-9313-da899cfe6381", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779955741, "uuid": "46f3850f-e045-4a22-9acd-55612ffd3e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955741, "uuid": "b6fc88fe-153d-42f0-b737-90482bfb3346", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19be76f-5ab3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779986432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986432, "uuid": "ce23abfd-b085-4576-a63e-4d1004407d6d", "comment": "Malware payload (Mirai)", "value": "94842ddf28808ac540180060be7e09b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986432, "uuid": "c3e78f82-9edf-4e2e-aed4-98f6c9db2d7a", "comment": "Malware payload (Mirai)", "value": "1a80857828205ad85ec5b5cec4309aa1eb3c6b6770286066cda16f1ffde0578e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986432, "uuid": "9b16e6c7-7f91-4b3b-b4a7-7231b662a9d9", "comment": "Malware payload (Mirai)", "value": "115a51ddf1e2d7ee7d469883d76fdfe58f10d4d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986432, "uuid": "e3b6e7c2-7a93-4ad3-b4d8-186efd92b819", "comment": "Malware payload (Mirai)", "value": "167d96f14a815f2ef12099e91a84932cd99075035054be167e7d76bede1d7f8aa4dc5869b813ac12637dd70c9dfa5c8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986432, "uuid": "0655331d-a6e8-4516-9515-c3d13e4324af", "value": "T1A734C70A3A12DFBFF56C863047F38A2047E5759626E19746F25CD71C1E2028E691FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986432, "uuid": "b3a551fd-c916-4fa9-9993-69e9fbe24ebe", "value": "3072:rtxpeoupHZyA0JX9crXF+DG290x8lQ0ib1eZyAHFIMZDfK/Xce:Rn+ekX0G2qxeib1eZyAHFIMZDfK/Xce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779986432, "uuid": "c6b7318b-e83b-4ee1-bee7-cb2f16b5ec39", "value": 245145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779986432, "uuid": "15c61940-408d-4365-bfa1-ef6ffa19abfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986432, "uuid": "c737a4a3-5e5c-47d3-bcf8-4767720b6237", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1209565-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970083, "uuid": "4d2ba733-cca8-4290-a00c-cfd85d43bcb5", "comment": "Malware payload (Mirai)", "value": "b85cf09d8d19409a369a121919b01596", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970083, "uuid": "f62c632e-0ae4-4e23-b2ac-9b0c242daa63", "comment": "Malware payload (Mirai)", "value": "1b7cefce1ed432496c70b0b92669ad247499506f23181ca61538b63c4638c229", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970083, "uuid": "a0ba62f4-2baf-4977-a247-368c6e48350d", "comment": "Malware payload (Mirai)", "value": "bc5646d549e07f183e6f4469c98ce84dfd5cb875", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970083, "uuid": "1efb4908-225c-46e4-95c2-3988cfedc17d", "comment": "Malware payload (Mirai)", "value": "07b1cc8371df1d7942bba62b880d8de27190078dae042bc0392b3d04705d9d5c47fee4d315f6fd252da56d57e0717ce2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970083, "uuid": "dc9dbc1f-47e9-4fb3-83cf-0d63a4454a58", "value": "T1D71133DC565478B28869E6957BA3C30CB14097CD28EF1E48DE940A3CCEF56CD7031A1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970083, "uuid": "29a5ffa8-afb1-48ee-bac7-8a36fef3ffaa", "value": "24:E4T6n4Tx34TU4T34TuRp4T34Tz24T224TN4Ton4TKJh:EKKKFKUK3KunK3K6KZKNKonKih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970083, "uuid": "80476e0b-6e15-44c8-a2aa-b5b1128b310f", "value": 996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970083, "uuid": "a6812c98-7a08-402e-b66b-2cc508c90be6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970083, "uuid": "dc08f009-90f6-4598-81ec-d7d6fa09aa9d", "value": "tot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8277f0f3-5aef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012015, "uuid": "005adde5-da23-44bd-aa87-9e44513b897c", "comment": "Malware payload", "value": "1023a85f02acea9cc59e6167884faaae", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012015, "uuid": "e4a27cdd-1b0e-45ce-be13-48b15e0a6b05", "comment": "Malware payload", "value": "1b98937b0559f1b27de90a7d5e767c3b11464d2b40db87608bf788f619b9832b", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012015, "uuid": "468f7f15-8d3c-4879-aeec-36f6abc0fd6e", "comment": "Malware payload", "value": "0b6e08608f905410da432ef8738e7a03e92301ba", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012015, "uuid": "f5c154e2-75a7-4269-8cf6-f4a74a32fb12", "comment": "Malware payload", "value": "3c4af60b2c65dcbc2df0dd1e435c3b0947b1e8675984bdbb45e78147f1efd782741a5231a7602f5de59df475ce154855", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012015, "uuid": "9ab88ac7-93d4-413b-bd59-deafc6f90ad9", "value": "T181767B01FD8749B6E10A133259A762FF2734AD065F369B93EA40777AF9372D40D2270A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012015, "uuid": "1a9c5fb8-320c-40b4-8fd8-0e3ef0e3a3ae", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012015, "uuid": "30a2842c-c6e6-4843-aa76-3ba3f760f7b3", "value": "24576:x5TVEZcvng/LSXo6MZQgcD6mlabon7AgxTDQVrVN8FuRPLGtCQiP7R9PAMTw6cLv:xZVipZA/buvJ19nP85OTO08bsOVzmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012015, "uuid": "40c85261-969d-46af-87d3-c9c21ae0cfc3", "value": 7762560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012015, "uuid": "d00f41d7-b16d-4262-8630-f65f29555e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012015, "uuid": "14ec8d04-d538-452a-8eb2-8d2510b4ae97", "value": "crz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a968345-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931069, "uuid": "fa40a2c7-8a2e-4cde-a947-fc79a64f7c4b", "comment": "Malware payload (Mirai)", "value": "1792a00a7f5dadc76c0d9d71c7a348b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931069, "uuid": "ef8ce312-3184-4d1a-a585-ae643d5451e7", "comment": "Malware payload (Mirai)", "value": "1bf5c0a471e81c81dd1db44a291cd4e9999c583cb4837a24dae1b4c0c63a647f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931069, "uuid": "fa67f89a-e065-4e91-ad6c-66765e43e4e3", "comment": "Malware payload (Mirai)", "value": "19ce781f10e1f4ca5ce893aa7b4684e65d26f1ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931069, "uuid": "34f69715-19fd-4fd6-9ae3-cc0b14d8361b", "comment": "Malware payload (Mirai)", "value": "a2e034e244d29468b36464a300fbb7c7c3826a502a88862c1549e73e177589e451b93693b289cb4015f6eb7e69e69d70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931069, "uuid": "2fe76278-ce2d-4911-8c1e-95904fa2db19", "value": "T1123301AC82E93EF8DBB40C36E01A6A30B39DDF6470D0356513A94A6C45CF2C776D6724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931069, "uuid": "bfcc27c8-2312-4792-9765-177675075565", "value": "1536:DR5m3fi4fSpznwRCMc6fln9m/Ft4hdOjNDVz3:DRk3fdQzhx6VaQdeDVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931069, "uuid": "d5a1c029-eefa-41a7-b00e-b4ca4fdd35f3", "value": 53440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931069, "uuid": "98fe398e-452c-4df6-93a5-953de59b2b20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931069, "uuid": "162f6749-2ee2-49c3-9983-6662ee8723bb", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8097864-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779961908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961908, "uuid": "63cc9fc9-34af-435d-8585-9cf88e30d2b1", "comment": "Malware payload (Formbook)", "value": "3244958b2acfc178b7151ba0e8572008", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961908, "uuid": "e6ca6028-fa79-43b5-b148-2197aa102869", "comment": "Malware payload (Formbook)", "value": "1c0a398026a91a03b059ff55bb6743b2bc76903da0c83016cee9520851618109", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961908, "uuid": "5e51927f-c884-4efc-a004-6e3a568eb444", "comment": "Malware payload (Formbook)", "value": "1420bf7a7196d425ef627b50a00a1bb7209d1acf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961908, "uuid": "8f946552-7f92-475a-9b9a-db7bb9c7f688", "comment": "Malware payload (Formbook)", "value": "fd57795902c8b0a81121bc8a79ccfef1d4cb469d30c71c8c9dc44880513c04512941aca8b640ff785218f1c5a6a3ed24", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961908, "uuid": "64681e1e-84bd-4612-9ebf-024f0cf9431a", "value": "T106E54B445274E154ACDACF7DE5B6B7A0614F380A58EC875A301F82312E43FE75AD28EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961908, "uuid": "45648846-2ca4-48a3-807f-fbe039033548", "value": "98304:ri+jqsXwZo2udlr/qGBDLk5HIUxfht8Ec60kB4RBNpzhiVQARXXGe0n:u+jZgZovHbL3MfL8Yn4fpy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961908, "uuid": "9d5a2274-c9fe-48f1-afdc-fd887546b746", "value": 3220927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961908, "uuid": "68b0a9bf-683f-4950-9ce5-3efb75dc3ba5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961908, "uuid": "74a80241-4d42-499a-939b-816614217f04", "value": "900882783782782.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b199b7a4-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966568, "uuid": "f4a9bb7f-584a-4f02-b8eb-a173c950606f", "comment": "Malware payload", "value": "5474d3099286b2296c02fcb7dc0a3d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966568, "uuid": "88502ead-4356-4713-a0c7-e4121bfc72b6", "comment": "Malware payload", "value": "1c0e141488525ac4770cdb6c47a401b886e5e6fac2b51e740b834a1f597bf7d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966568, "uuid": "492cd2f9-eb1b-4cc7-a04e-55d780a8e74a", "comment": "Malware payload", "value": "1ecd34294f3bcea5c617f5fcd2cd66b0072847ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966568, "uuid": "32d8cfe0-1172-40eb-8e97-fb99c3c72743", "comment": "Malware payload", "value": "3ed98f1669777e114e3ba77156b25ad4347932a112a5ffb4f325eb1440c00cee401ebb2453e711eaeda78de90072e25c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966568, "uuid": "143fcc48-7334-4eed-99ef-a2f620cf28ba", "value": "T19575024AA3B451FCE1BBC178C992450ADB71FC250B70AADF17945AA61F23BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966568, "uuid": "c211225f-66be-411a-b4be-75ae1b8a0af4", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966568, "uuid": "503a7686-83e6-4ef2-9abc-4f62302d3cc2", "value": "24576:f2LZKAyz5tmx1Y51t05ZtP7gQA+YXIySn46BKuK2mqsc80DM2jlX6cw:oByFh51t0jaBm4MKuK2mqScjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966568, "uuid": "808dd949-40e5-4550-86e8-5ae960518885", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966568, "uuid": "e1ddf301-086f-436e-ba69-557ac08ad60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966568, "uuid": "8a2cdc37-fe0b-40b0-9436-79074b11f9fd", "value": "c(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7bfdf5-5a99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779975013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975013, "uuid": "6767f374-4bb4-41d8-a754-6507582bab5f", "comment": "Malware payload", "value": "d993c59e338b0b3160f053ccd4a90794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975013, "uuid": "d367b236-c280-4a66-9b37-bbf076029518", "comment": "Malware payload", "value": "1c5080b6fa705f69758a8add633e3314f1953308ff68750be9455340bc91536b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975013, "uuid": "7cf38745-a9c0-46e5-b893-eb0a780d90e6", "comment": "Malware payload", "value": "dcea71b9ab9de8efca301de9e2f7bf11c7132364", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975013, "uuid": "a1e2f4f2-e00b-44ac-9b82-e629a835024c", "comment": "Malware payload", "value": "b08600efd49c56abbdd27520a7965f8a7c109aa179a41c5e7a093200ae863d9cdc2ddecd0cdd65b319f09603bd3a6136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975013, "uuid": "2e40532c-d139-4a0f-9813-78b0ba8141e8", "value": "T1D2944A65FC819B91CAD02EBFFB5E824833130B78E3EE7111DE155B3526DB84A4E7A442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975013, "uuid": "11dc4093-943a-49fb-93aa-1520824f8adb", "value": "12288:H7C6HEX8RiqoH2VKBr6WTwZOWlwt4UIGg7qua33k5X+6m:Hfk8itBrVKtLUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779975013, "uuid": "e9ed55a8-a090-49cf-9344-355668c0d812", "value": 436428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779975013, "uuid": "55d7690d-1048-46c4-bd73-a44ee3cc8b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975013, "uuid": "5871a375-8988-45b6-90b1-765f6bfee7be", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407e2411-5a9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779977545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977545, "uuid": "0ceba683-9bf0-4d39-a9cf-30b4efdcf740", "comment": "Malware payload", "value": "e764ac9ad7684cfc8fbe1d4dc86622a8", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977545, "uuid": "699f5fdb-a18a-447f-9865-bb05efcd2678", "comment": "Malware payload", "value": "1c90a1ce25b5078cea3e1c6aaed4f2e1727aa54fdd3c4a12d57afc085f1fcff9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977545, "uuid": "439b09d0-9e65-4e4e-99dc-9d18f0ed41fe", "comment": "Malware payload", "value": "bced32428926ef5a0ccc22eccf1f8ff94433dbc0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977545, "uuid": "22806736-aed1-46d3-aced-40fc8b26eb7f", "comment": "Malware payload", "value": "a6b10361370733a1282ccdd0633f45cd4862ab08626a9e2cccd7eead091a1d6a848f9ed4e65050cc4c1305a4ea18ef1f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977545, "uuid": "a3a2eb24-0219-4d93-9ae8-e45dbaeb13bd", "value": "T14BF42360A1CF348995B1A5B527B4167A4EAD1D1CF5DF0E080F37478F918D21FDA62EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977545, "uuid": "32004178-437b-41c2-9f73-a21643c40183", "value": "12288:tPTZkaz0AuFNTIUf76xKyAZ+r8B5EBcO/l6Ipxl/NtM/66qJ:t7ZDwFas+r8BXO/lNS/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779977545, "uuid": "d3eae314-9a4e-46fa-bc0a-e4356c76957c", "value": 787519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779977545, "uuid": "0ffe0df7-e419-4cc9-9b30-719b9488ebc2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977545, "uuid": "ecf0d9ed-d0f3-4fdb-b7b3-fddd771b23cc", "value": "1070_26782818.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8c05d2-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974158, "uuid": "2e9b5e42-785a-4b7b-a031-a3785dc6a4ff", "comment": "Malware payload (Mirai)", "value": "d66c89f39134e48bfce4107caf154c59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974158, "uuid": "94d32ce8-fcc4-4c89-8352-66f2b14fe61f", "comment": "Malware payload (Mirai)", "value": "1ccd5d7d4097b01f9e0360512ccb5eb6833fef18c9f83652374de37e4523886c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974158, "uuid": "2685afa0-b0a1-4a0b-b934-87c3ca5f31cc", "comment": "Malware payload (Mirai)", "value": "446d943cf84fe6b655f892df68df696b4b6b2a31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974158, "uuid": "51595905-9f10-46f1-8d2a-bdb73937ba04", "comment": "Malware payload (Mirai)", "value": "e1d392c4f7dec3c5fcf364ddda3255173e322ec02c6df43263b82dc375fe06b046812ae8d0fefab984770c9986df9e11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974158, "uuid": "aa8d14cf-0187-46e6-bded-544df84fffca", "value": "T110631981B880AA26C7C01777FA5F118E3315A7DCE1EA73438C156FA576CAC1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974158, "uuid": "41c758b0-1846-4480-b853-bcd21d0f40ec", "value": "768:WAcI9rYg37dZobc4PrzXsOalwkbj3ybaXvoOBVUNOKo1w5kHuLwCVy/Jx+5H8hGq:oiJ3LokOaCKXtB1uBeZWlRQnTIgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974158, "uuid": "763c7ddb-088f-4d6e-8bbe-0d4823f9ea41", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974158, "uuid": "34e150c1-f205-474e-82ae-12f31f030b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974158, "uuid": "3b09988c-d0b9-4b05-991b-154c4c8a07c3", "value": "000cbae6e7ad5f4961efeba229a594a17581b4a57a58909952aa781d1abb235d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfccd5a0-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780012575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012575, "uuid": "98860d61-56dc-4b2a-8371-e9249093cab3", "comment": "Malware payload (ACRStealer)", "value": "6676c29d1eba253af790c6a8809f9452", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012575, "uuid": "c68daba7-82ed-4081-a535-22a724b51657", "comment": "Malware payload (ACRStealer)", "value": "1cf857a9b341295ce170abd7d79f66e1d2026adc39927e97a658a1af097e52c1", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012575, "uuid": "4369a300-1372-4316-be9b-5c02de300399", "comment": "Malware payload (ACRStealer)", "value": "81e6c07c077b5d39409e5f1ea4697c64173ce10c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012575, "uuid": "aa943d32-712e-4d0a-bc9e-b2c529dec079", "comment": "Malware payload (ACRStealer)", "value": "b66c20d62961894a4b328de26a749e140cb41804f52c8e4fd8d2a244556ff3894c0a201354566f90be200ece56a339f4", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012575, "uuid": "e942f56d-3f97-45ad-a2c0-bda0559933ef", "value": "T11C968D466CD14CFAC0AA633289B722917B71BC080F7263D72E54B7782FB26E45D79784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012575, "uuid": "d8efa249-aae2-4fc5-9278-266937cf1a73", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012575, "uuid": "18ede139-3083-4313-9b5c-c308b8e6f2a0", "value": "24576:HAfslD2eyKlsn1MVd4fehjOGA5SWQoen4zKXs2O0d+D4ZSfnBele5yK2tFAF2O:HAUlCeTsn1mOf+O5SHMKXfZ1XyF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012575, "uuid": "e654abf6-a794-45a6-8b8b-87f4f7fd1c97", "value": 8626304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012575, "uuid": "47fd323b-2ea0-41af-84c8-cd16afd8ccdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012575, "uuid": "7b81eff2-2e01-429c-b349-23d87767442b", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72078caf-5a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (PurpleFox)", "timestamp": 1779927377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927377, "uuid": "c4f6a30b-45c6-4191-8243-86317026ee4d", "comment": "Malware payload (PurpleFox)", "value": "c87e94cb24f6398ad4da0953bc663e8f", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927377, "uuid": "4631e876-71a8-458e-a2cd-f67155a6c82d", "comment": "Malware payload (PurpleFox)", "value": "1cfb6fc65a1c6b9f28c76cfc300a3b6e9afcf98d5793e306d44eb6c18ba9a63c", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927377, "uuid": "3eb98ea3-680c-4f3c-95af-3aa9609d44f9", "comment": "Malware payload (PurpleFox)", "value": "c7ffdc931540a1c0dd2b6d24f79020db1fbb69ef", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927377, "uuid": "0639d722-d2e5-47b4-ac36-d2364740c080", "comment": "Malware payload (PurpleFox)", "value": "ea4d36093d841dfc6ec1129e2185f317d239cef8ec65e1ddf0a27b479281ba9aa03c27a241ed81ee65c0a082c98c5d12", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927377, "uuid": "dd7bd43a-0154-46b6-ab07-a7d17a3c7138", "value": "T1ACF53349BC15D739C0521BB1401B9ADC4C14BC47272796EAF8ED32AC877BB47E1A29F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927377, "uuid": "e5be6f41-0249-4ad3-b8aa-379925b0a219", "value": "98304:Fc3k/vss/JBneaHH+jeEOAenXo38sMSQ9Zf/yex:FHnssRoan+jeE4nXpsMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779927377, "uuid": "1c321563-be78-4efd-ba9e-c33b12a20cb7", "value": 3604480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779927377, "uuid": "b393336c-40a0-46c7-8097-c64ec841e4e2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927377, "uuid": "b2e9bb31-be8c-433c-95c8-f55f5686b899", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81556da0-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966487, "uuid": "e9eb6497-2037-4b2d-afb3-cb2b90fd951a", "comment": "Malware payload", "value": "0b4f20d3d53440d90e582cae0c362ac6", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966487, "uuid": "d8f6b50d-292a-42b4-bd3f-b6e72df0b520", "comment": "Malware payload", "value": "1d477806c1b83764056bab44b84594436c870ed324712d1d69d93e6f1493811c", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966487, "uuid": "071e581a-f822-49b1-8969-52597bb121bb", "comment": "Malware payload", "value": "f20410e8d38dc6c66d5d9661ee220cacdc420bbc", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966487, "uuid": "31ec03c3-d675-4cf5-8dae-e0ea0e276711", "comment": "Malware payload", "value": "497e051d065c7fc6a080c05bc233ed484ad31daf07b0dcfc65657f63ce3092e2f48c57dfb07a23b9812cabd0e8278563", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966487, "uuid": "29713fea-90ff-4501-8bed-0d786c1c033c", "value": "T157F533F727984C20F42E0CE1569CCAA6A2153219C5F7768B4E7DE443CBE98E0D790B5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966487, "uuid": "885bd1f2-ed2f-4760-a361-24a54dd03f5b", "value": "98304:3MRQak9W913KFPXswWvIwymP3uZZfRr7b6KEaK:cRQakxPvZ1Rr7XEaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966487, "uuid": "6cbb3e94-9b26-4386-a850-2068f6d8edd1", "value": 3450211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966487, "uuid": "efe1cfb6-fe4a-4f8a-a047-3df9f5ea5519", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966487, "uuid": "e0d4e8fb-792e-4f6f-9b33-19a2e3d31ccd", "value": "a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726ecdd6-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974622, "uuid": "f37b6e90-c950-4236-82e0-641943da69aa", "comment": "Malware payload (Mirai)", "value": "47bd55527531d1cd64e71cda47f82a4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974622, "uuid": "7b094e59-1d2d-4f70-9a07-343747bbf43e", "comment": "Malware payload (Mirai)", "value": "1ee8376e0e8de93753a24c38f85de8d0c3df073067d72c3ff74437518751ee13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974622, "uuid": "1ab58ce2-a44a-4f1f-bf0a-25040442c264", "comment": "Malware payload (Mirai)", "value": "c89390fd3c58850568b74179ed04203273661f5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974622, "uuid": "dce80d5d-c412-4774-9554-1ef26120d4c8", "comment": "Malware payload (Mirai)", "value": "b0bed02559ceeaefba859b194b52be202df28a99eadce0ff7d9263a9ef823f773036a91813c46b86688921e1c2fe318d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974622, "uuid": "cc649680-3827-457f-804a-5d19249049ff", "value": "T105B35AC4E7D7E4FADC0056B93077AF328976D57F6226D6C2D3E8AC32A941400C50B6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974622, "uuid": "16d0c5f3-fcd4-44ba-afd0-2670632ee050", "value": "3072:aS80Q6ey88QIOZJYgyJcHJi4lIMlSObELThs:p8x1H8VOZjyuHA4rgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974622, "uuid": "4dacbf94-f292-4cf5-a2dd-734d7bfa7c52", "value": 107760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974622, "uuid": "1adda04a-be58-414e-9918-46c9f144c4d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974622, "uuid": "639ce9b5-aab7-408d-a21a-87e647b99f7a", "value": "0050bff549456b73e43fbe780977534c1264b224d61ecfad5682da771eac5c55.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4922ad-5a31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779930239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930239, "uuid": "c335c989-32c2-4342-b49b-63c158785e36", "comment": "Malware payload (Mirai)", "value": "b2c2a62297b06954e2881aadf9ed7ae3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930239, "uuid": "5ee11a12-f817-40e4-8b10-0f201c2b3979", "comment": "Malware payload (Mirai)", "value": "1f6945fa88b971680ae293969895441db6f6a4dcbe0990a38e88093853bb25b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930239, "uuid": "63e00904-a0ba-4417-82f6-e427b364c699", "comment": "Malware payload (Mirai)", "value": "dddb06605c211b3d7d5b311ddac4a8b7a36b24ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930239, "uuid": "a21e8705-42f0-4b4b-a19a-6a0b6298251c", "comment": "Malware payload (Mirai)", "value": "2028a2725e146af0cc57456740452ef036b260ab4800e7306320745a2fe124baa8b759d22ffffe76433bc8891527d7f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930239, "uuid": "634d130b-b81b-4d9f-8c32-bcc02f08bf50", "value": "T1C6B69E02F9959F66CA3D45B5CC9417A42330FC026F83AB836764F23CBC7E6856E962C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930239, "uuid": "6874178c-4e2e-46b3-92ff-dd48358eb695", "value": "49152:cRNMS71zGn3fCK/YXS6zB4wqH2PFISmamBveLPOGc5++91nz+SGT5q3xe4miCUun:cF6BI13nmz++91nz+SGT5O2Be7MEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930239, "uuid": "79620233-8735-426d-9ac6-0130fecbf7bd", "value": 11403426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930239, "uuid": "0be4b658-e91d-4286-ac03-71f8470050b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930239, "uuid": "99610892-418f-4983-8030-dedd57619238", "value": "wife.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea7bc4b-5a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Bobik)", "timestamp": 1779952711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952711, "uuid": "cf134dca-ea36-4369-aae9-075611e2de87", "comment": "Malware payload (Bobik)", "value": "85df2116ac0d29fc7abd0f061861c027", "object_relation": "md5", "Tag": [ { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952711, "uuid": "d0e6e201-6a96-49b1-a272-4e8eed77c32a", "comment": "Malware payload (Bobik)", "value": "1f9791bf4cafab66fa14b278892ab0be2a79978841166c7ed7ca646870756a5f", "object_relation": "sha256", "Tag": [ { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952711, "uuid": "ed0dfafd-7b9e-44b6-bfb7-f5527431b6e1", "comment": "Malware payload (Bobik)", "value": "d9402a154ef8cb21cabcc6724509a31741194214", "object_relation": "sha1", "Tag": [ { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952711, "uuid": "a50306d0-8e48-4572-8c92-4bffad639d06", "comment": "Malware payload (Bobik)", "value": "c3ffaf9b3d1f703209bafc755443b7c5863c28776b3fbab921442465f9d890698b717c347d193662727116bb102b4d96", "object_relation": "sha3-384", "Tag": [ { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952711, "uuid": "bb8f1733-60c1-40ed-8461-92059102c774", "value": "T1F5F50103F6A480F8C0AAC178C35A5633FB7ABC894635B25F5BE46B512F66B605F2D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952711, "uuid": "95824d10-af29-4e65-acc4-5880beafb6d0", "value": "e09efc0b65657060b55cb1747b29031d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952711, "uuid": "493494d0-d0ae-424a-8418-a87bbaa74cee", "value": "49152:ODGGdrWPbfSN12lsVZ5YTsCs2pGTcaWr5vb7cZVtwZWWWCcwzI:1FbfW0lsh13cNr5fcAWWWUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952711, "uuid": "92547e20-9570-468d-ae2f-51026ebc8e3a", "value": 3550208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952711, "uuid": "e14abcad-d7e1-4639-bb0d-5e91821e24fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952711, "uuid": "53b4865b-f9f3-4d5b-b5c3-47b85cf21bd0", "value": "1f9791bf4cafab66fa14b278892ab0be2a79978841166c7ed7ca646870756a5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f803f6-5a3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934552, "uuid": "7d44e94f-9406-4c1b-bc0b-26b928886348", "comment": "Malware payload (Mirai)", "value": "a3d2ed892712b0f9ef0269e3d60d5538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934552, "uuid": "9ac625fd-75b7-448a-8a56-6132e358ec7a", "comment": "Malware payload (Mirai)", "value": "1fc9446ea2e0bce14c249aed20c6012cdf3cdaf43129f4348d083f0d052fb4ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934552, "uuid": "9b8c3e32-9e73-43cc-b0a9-0aa5b75ba794", "comment": "Malware payload (Mirai)", "value": "30f9fb16e5685edfccda0cd6d1b428e5dd526feb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934552, "uuid": "6e1e577c-ba5c-4d5f-a0f3-04ab5e471a2b", "comment": "Malware payload (Mirai)", "value": "58b615a9cf364d09de573476bd3f8034dcd4acb43ae5e8ee7d4edeefb3685855f4baaa5dd283b3e80d0e5d892e16ad9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934552, "uuid": "0cd1e07c-4584-4295-86a9-cad296fc6347", "value": "T10333F210B194E4344B305B79EC844544AA6187BAD3FB3E27A354487DB693E09ABEF247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934552, "uuid": "f1d2cf36-b7ed-4d80-99cf-8fb1f66b84cb", "value": "1536:BZ9NL7THbu7vHt9/6ec/ZvA3sfTYFgJpYP7zL:BnJvu7llc/RTYUm7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934552, "uuid": "7063d847-1ee3-45ca-a66e-967df17655ba", "value": 53832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934552, "uuid": "b1d84598-68e2-46e1-9956-16e5c0b0489f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934552, "uuid": "b2df7bbe-6091-43e6-81eb-9ae793dd88a0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11476ab3-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001088, "uuid": "7a4a2309-15b1-49ce-aa62-eebcecea12db", "comment": "Malware payload (Mirai)", "value": "0cc40a43946d294b0c73b1a2cf3619f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001088, "uuid": "bcbe3889-4a36-4e76-8c29-d94c0728c3a7", "comment": "Malware payload (Mirai)", "value": "1ff03b4f1cbceac6aa4d15f2c05bcab64cb22e681ec64471b107effff2c51562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001088, "uuid": "cf451c7f-4212-4cea-91c4-c6b5e887531c", "comment": "Malware payload (Mirai)", "value": "67a7acba95b01f7455eeca23961479aeceef69fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001088, "uuid": "ae702321-d204-4313-8fcb-afccbd4b72fe", "comment": "Malware payload (Mirai)", "value": "98db1a62aec750c409c6412b3a64c4a91438d1123c7b05714b99a84d091adf5035fd1778c9020c41156d6d49f3b63565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001088, "uuid": "01c94a1a-11d3-4bfa-b291-5d65641c5abf", "value": "T11E04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001088, "uuid": "aa21712f-22d9-49a5-b94d-e4725819cf22", "value": "3072:nKpzGjeNkSfcQqmav8SqaRVlnYz65pVt:nKYjeNYQqmeqavlg65p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001088, "uuid": "1d4f59b6-d94f-4e2a-ac7a-55f5d77571db", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001088, "uuid": "4ccfff7e-7221-4784-954b-e4bcee0cb5e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001088, "uuid": "21d22d30-98a8-4bba-ad52-4c3f77178c10", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339f3222-5a70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779957337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957337, "uuid": "93b02c3f-7bc5-4f62-b582-7f65eb15332d", "comment": "Malware payload", "value": "8af7b88f5812bebaee14a08c3581eab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957337, "uuid": "b1857f6b-2601-4815-9b6b-cd9a08e0fe21", "comment": "Malware payload", "value": "203e6d15b332b2254aec08fd2b9e01ab51b3b6eb3f8f272521a19f1d34a0ec2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957337, "uuid": "9d6104be-0716-462f-bd12-0bec0dd7f0c5", "comment": "Malware payload", "value": "54077812872511b46ec059eb4a8a51abdb2e463a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957337, "uuid": "a0f30437-8913-4069-b03a-cf1ecb89b23e", "comment": "Malware payload", "value": "1c418a799294e5ccc9f1e32b5b4c31d4dbfa7db09da4fd48956e69f67b27bd501e025d87d020ccbd0853e78559086ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957337, "uuid": "8adbaca8-74a2-4c6c-b760-65aec4d7d757", "value": "T1D1155A94FFC75CA5EE13413D89CFE36F2338A39089068F63DA5C75366913AB1294760A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957337, "uuid": "1c5d53c4-95d1-46fa-b178-bfe674caa862", "value": "ff2e220cb691ce80d80b1cf573c2167a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957337, "uuid": "dd73007f-7d2f-4c96-b2a7-e04e2a0bcc05", "value": "12288:9rogJsm9C0qMx5lvhUffT7373dvuCvUS1uRVL/pl1uWIPgf:ZogJsm9C0JDl5kXhNs6yV7pfuW3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779957337, "uuid": "f88d0bcc-b753-43e8-a59f-830534262300", "value": 876019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779957337, "uuid": "6766ba1b-fa55-4a7a-ad48-f02c40213ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957337, "uuid": "9b595561-e368-4a47-9857-5efc9b374c18", "value": "203e6d15b332b2254aec08fd2b9e01ab51b3b6eb3f8f272521a19f1d34a0ec2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7d7a2b-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload (XoriumStealer)", "timestamp": 1779966588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966588, "uuid": "f0769496-ed14-4721-967b-58d378d762fb", "comment": "Malware payload (XoriumStealer)", "value": "c3343478e7bd123c3bc061304ca2fb5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966588, "uuid": "9b1ac2a2-685f-4b25-b7c3-c3fefce5298e", "comment": "Malware payload (XoriumStealer)", "value": "20e41f9151518c16eaaec357c16761d4dfebabb425ac727105a10020b34e169e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966588, "uuid": "986afe7e-f5dc-40fb-ab65-fd26c7745c42", "comment": "Malware payload (XoriumStealer)", "value": "9b6870b224743802c2d6f1fa5b80cadf002fa231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966588, "uuid": "7602f4e7-28c3-4e38-a57a-6940773297c4", "comment": "Malware payload (XoriumStealer)", "value": "4172b8d89dc865caf61715bf7b6b2765ba4b1441ebc503564bfb0b942976ffa314084bf9cfec35651f03183a916e37be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "XoriumStealer", "colour": "#EE67D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966588, "uuid": "e0ebb8a2-398b-4a61-942b-8ea5ff025094", "value": "T1F304026E3887286CD50EDC7AE4D4C278D47A29F5DFAC1BC26F61CE3C14E364B0A54992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966588, "uuid": "353be0b9-35c9-4b68-8e78-b313707f947d", "value": "3072:8Ddm8cXckTPlvYuWsaMYxbFcnV1lxgM1SpkQVARnlNP4y8PM6LatfS91azlSDysB:0belQuWtRsV1lu0ekKAVP4y8PtWfSLDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966588, "uuid": "c16ab89b-8e89-4553-905c-76b5291ee8ee", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966588, "uuid": "373ad968-742e-43b1-b5a7-37967362cb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966588, "uuid": "b573890f-60d1-4942-828b-255fc791fc5f", "value": "UMPDC(3).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81331ca6-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946300, "uuid": "c1fd22c1-705a-47a2-8094-c69f402b72d3", "comment": "Malware payload (Mirai)", "value": "14db80651ec038d4c6c84a5b536c31b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946300, "uuid": "1e0fce21-f3fa-4235-a7ef-e9eba18aa599", "comment": "Malware payload (Mirai)", "value": "2110d38d355d2eb8bf6e584377904fdaeca3105ca238bb1b35f07db7f7008ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946300, "uuid": "7aa30238-0e00-4ecb-8c4a-7d88751407b9", "comment": "Malware payload (Mirai)", "value": "baf9cf584246fe490ef1fcc928320d667ac4172c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946300, "uuid": "1386e913-4553-4edd-aa73-b5c27f4cd30b", "comment": "Malware payload (Mirai)", "value": "3a452562def137fa0f942eda525407df157db7bb7b4ab604367b90cf740b4d2a260e56bbd69f5c08d19298209c3f1965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946300, "uuid": "7065bbbd-d0ea-4eae-b685-0403bbf67210", "value": "T11183630E3E215F7DFFEC823987B74A21665933EA22E1C5C4D19CE9061E7034A641FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946300, "uuid": "52f5375d-b765-4bbd-88c8-9f04660eea1f", "value": "1536:im2yFrszc6u0vTJ2VdKXrE1nHkiRZKyLXPjejc:IyFrau07cVSE1nHkiRZKyL/jic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946300, "uuid": "c63ffb2d-7ee4-42d0-9445-44a83f8faa0a", "value": 84120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946300, "uuid": "233cec0e-1c7c-4dd4-9236-08144f7c2e4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946300, "uuid": "a0c999b7-1307-4b90-9cdf-6cb7d6485524", "value": "uranium.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e314d4c-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973380, "uuid": "6f6a8ae9-85e0-482a-89da-dbcb6e816316", "comment": "Malware payload (Mirai)", "value": "0ddce3bd0e7565bb03a792a5ae6a66e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973380, "uuid": "df7ad5b1-4d58-45f4-9768-a41bed10f2bf", "comment": "Malware payload (Mirai)", "value": "21247f16dc218d7eab680fbc54e396a067263923a129cd737a5eb07f30f732e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973380, "uuid": "4db0d03e-1671-4543-ad20-76338f4916d9", "comment": "Malware payload (Mirai)", "value": "d77dcbc5664728b3afda3d8240298de47c68d21d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973380, "uuid": "2818aa2d-fa95-4244-ad9f-be2cbf1f24cc", "comment": "Malware payload (Mirai)", "value": "9a3cee8ab5c6d5d2eec3761fd2e60fdf6b540da5811d603206167ff4c3594e533dc4ac716c136719f62cf7af7866ab06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973380, "uuid": "8236ced2-756b-4ca7-a74c-11be84175e09", "value": "T19743F14CE75E958ACB3CC837689C23784F0677A630A65F9D53928BD4C91AF97D20E078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973380, "uuid": "fe59ec4d-ad97-449a-86c0-e7ca46843f23", "value": "1536:W1yxYNZQkD2B3yRtKLWtfGVvwP0vYacvVG9ns/UY5:WsY8kGiRkLWB9EcvVG2/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973380, "uuid": "af1c300f-ecc2-4f4f-9b17-ba166271ffc4", "value": 58180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973380, "uuid": "9c3c6f53-05b2-4798-a843-822cb19b4f39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973380, "uuid": "3287718f-69c0-421f-9545-93e2c8f54701", "value": "023782pler.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d3ceb5-5acb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779996725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996725, "uuid": "f7693354-0d34-43c1-923f-2d41498a1bf3", "comment": "Malware payload (Mirai)", "value": "6a78242fa444c0185d31a758331dd80a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996725, "uuid": "c7e79e57-7619-42d0-a7d6-63103f5b1985", "comment": "Malware payload (Mirai)", "value": "214560cd87460bba7d8592aa1b9398c46757ec5bff0db2d7a86f860842c978fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996725, "uuid": "f0d5e4bc-01b9-4ec7-a4f0-2eaffa0b0c68", "comment": "Malware payload (Mirai)", "value": "36e86ff75877e41ad8336872fa093237ac15c165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996725, "uuid": "1c97cfe8-7419-46d9-a280-b50d2a40512f", "comment": "Malware payload (Mirai)", "value": "6a7d7e3c2dfff2e176ff00572cd4ffad9ddb02d7305a526b8f8915af62d58f9e52335553c4b561631762229bcd791690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996725, "uuid": "338c4204-0ba9-4f1e-a749-ec9836df7b7b", "value": "T15B242A46EA404F13C4D627B9B6DF4249333397A4D3EB730699286FB43B8779E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996725, "uuid": "8605deca-87e4-4e61-a6b4-13b8ee1de3c1", "value": "6144:BlQaUlr8g+G8caOIdpPpcD6LE60aYYFM/RUi7Db:BOaU5AG8caOIdpPprEYO/ei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779996725, "uuid": "42fc8d7a-b615-480b-b974-e40cda293c05", "value": 214710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779996725, "uuid": "b59cb246-6155-477a-8ff7-54bc3d5cd97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996725, "uuid": "3d3b3625-6a9f-4edf-a2e9-c14013250c01", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efac9b7d-5aa9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779982134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779982134, "uuid": "7119264c-4221-48cc-a741-1efefac2a9f8", "comment": "Malware payload", "value": "aac0c64bf8186ea8b7fd7eaed7e5fe4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779982134, "uuid": "bbb7efc0-664e-4f16-a5e8-cbe7049f6ccf", "comment": "Malware payload", "value": "2232eb680881fa7bc2e9402cfedbbf416ff065426cb5309bb0c9ce8224632cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779982134, "uuid": "86525547-415e-44fa-bd8a-493f5602c198", "comment": "Malware payload", "value": "5dc963972199b38e5d7d849d4fa8b8e1a6d8270d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779982134, "uuid": "399dfb8d-438a-4e62-aa05-943d5d4a5b65", "comment": "Malware payload", "value": "f0778c5433185d906ee8ec10853c2fb32e7a15d977f0a729db18cc1b0bc33a1ec7b05f99bdbca419ce52876de0caabba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779982134, "uuid": "6ca41700-382f-4745-9422-eeccb27a0221", "value": "T184E2E724A3D5E470C15B237027D6D5E022E2EDD75E370629ACC8F9ABEAF33056B25E44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779982134, "uuid": "45744af6-9ed4-4c72-93bc-854474123f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779982134, "uuid": "bb397633-a58e-4e4b-a60e-3303ecbac989", "value": "768:yz57Ngy0RKX/bFXnwwKsuGgReSUaq1LyJQz:8/bNnwfsuGyda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779982134, "uuid": "e2be22f1-d459-404f-b642-a0dde089c580", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779982134, "uuid": "8307b26a-3773-49ef-ba1e-211bda002da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779982134, "uuid": "f545ce37-731e-4fcf-8018-7a80b8d154c5", "value": "10784_30601_10_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9808ba2-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779961910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961910, "uuid": "9fd84b59-3310-4300-b319-169f5437d3ba", "comment": "Malware payload", "value": "b57f33c51b77a9798ce186853a0fabc8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961910, "uuid": "cfd908b8-7fdb-443d-a455-a8fcf586282a", "comment": "Malware payload", "value": "227117cb5cd59799253909f333d21e70d457f4b97b278424bc233cd3f7c5c80e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961910, "uuid": "dcca987b-7e2a-4731-93ce-d33507ad74b0", "comment": "Malware payload", "value": "dbbbbaf4c29f5c95f0cf4f1daf2fe12e407c1634", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961910, "uuid": "7de21629-d018-4e0b-9fa7-87b73666cc15", "comment": "Malware payload", "value": "12dccd8ac310936a79f8396dd4b6c238999c6c5fa19fd02ff41dbeca37fce642f773b82aecf110e26f107b6ba9414df8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961910, "uuid": "e14f11c3-57e9-42ee-8565-51077d6e8d54", "value": "T1D192F19920A6A8F3FF5862FAA756DDC80E7C155215DB780DEF88078C994BDF12C136D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961910, "uuid": "3c4d9e81-d0bc-4bcd-8fe0-f83b0b2b3244", "value": "384:MGC17HcOa+T0gmV2kynPaT71fVAMQ4olv795/gcYMYFk6GYigBg4g8p6vbo:MtZHK2kNPIj795/djYFk6m4g8p6v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961910, "uuid": "b0f749c8-0cbd-46ce-abf2-037e2b3bc7a9", "value": 19619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961910, "uuid": "ae692375-b895-458d-89af-b0234ae86b71", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961910, "uuid": "b7f3fe83-6005-410a-8ff4-913f3bc3a9dc", "value": "EMA_3910Swift_MAU920AHI87DH74781A_KOU8N7492273_A6468B8DN98_D8BAYIIAI76TAIU682.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb320a8b-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "60fd2861-ffbb-424d-ba91-bba53c18405a", "comment": "Malware payload (Mirai)", "value": "900d745d23013778e669b40572a90f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "b8069cdb-b00d-4591-81ce-63e320583830", "comment": "Malware payload (Mirai)", "value": "229cf645b51f906fca2038fd49bee1300511ba4f21cb60699cb8c7aa0bf46b5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "f4e8e781-42f3-4895-baf9-cc7daac7edf5", "comment": "Malware payload (Mirai)", "value": "18d5c85dd59cf3e7f81a0632620a911ae00c4233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "afa9ba49-5086-4b9c-aced-7cffcf23e9e9", "comment": "Malware payload (Mirai)", "value": "a0997c835443ec014351346dc5c3aaced32c7a2ba6585a4dbee996a6f3b25ed982d010f78cc747c8b2534ff1563c511b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "ba81f8b6-8971-4867-b2c5-000c7fd7a7a5", "value": "T1CCC3F90ABF711EFBD4AFCE3345A94709299D560621B93F397A74D818F24A18F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "68a10197-f835-47c3-9fbf-bb9d04ff0969", "value": "1536:I1M2cYMBlxAN9bwBm4hoouO8xxxQS9oj4dDb8HMr5fMoO95aqyhAexWPdA2XQ+7c:IyrxhoouOEX47TTej5nZhD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970959, "uuid": "531d0f64-1c6e-4ef9-b274-dc009210b52a", "value": 118228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970959, "uuid": "4f65248a-1338-43f8-9a11-0288d24796a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "ae062835-7f0d-4f5b-802e-f8bb100df486", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66565b06-5ab0-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779984910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984910, "uuid": "f5ae8eda-7f9c-4c1b-b824-7a95624d617c", "comment": "Malware payload (WannaCry)", "value": "6a5ccfb1a5e88d806355c76edf5afcad", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984910, "uuid": "7164b997-526d-4199-9be2-b659f995fd8a", "comment": "Malware payload (WannaCry)", "value": "2318cacaf04dccd78420bfb0510ddd906e670fe0eb63113d00d3a04b3f4fff96", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984910, "uuid": "db0563f4-0d29-42b8-9c5c-8ebcbd718b22", "comment": "Malware payload (WannaCry)", "value": "1b425a860647f78c70c24eb4872893c475264c3a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984910, "uuid": "56059d79-950d-421f-a83a-9bce11378bfd", "comment": "Malware payload (WannaCry)", "value": "5b4a4550a8832ac6cf3a8f748608cfc1cb605989ad8e42460f98132e9d6b1af0a690fdc616c391979ef2e5035e76dfe4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984910, "uuid": "e4d5c319-3a2e-4c14-a094-27db84ece2d5", "value": "T11436339922ACA1FCE0151BB484B74D2AF7B33C4963BA4B0F47C487AE0D53796AF94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984910, "uuid": "c576dde8-8b42-42dd-9cc3-9257ac06e6ab", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984910, "uuid": "afabbb04-8eeb-4338-9378-d343bb8bd97b", "value": "49152:jn2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQxAMEcaEau3R8yAH1plAH:DyDqPoBhz1aRxcSUDk6593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779984910, "uuid": "0a8bc73a-a449-4ed4-91cd-9409378db944", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779984910, "uuid": "185abfa6-0e97-4c87-9163-1239dc6d66be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984910, "uuid": "a7e5c4cf-c9fc-49be-a521-9cf9a4f7fa78", "value": "2318cacaf04dccd78420bfb0510ddd906e670fe0eb63113d00d3a04b3f4fff96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c9f247-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969882, "uuid": "60f34fa4-fe2c-448e-931e-7852ba8a3e8e", "comment": "Malware payload (Mirai)", "value": "5919fdb6e1413203b3260a564c3ae314", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969882, "uuid": "f665e754-588d-4d8d-9402-0380910cfa87", "comment": "Malware payload (Mirai)", "value": "233fe69e58e78f227f5a5b72966cd8b9749db67bf26f0e1713c963895c6991fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969882, "uuid": "9a314683-a44f-47fc-a689-b5bfe6c6dc6a", "comment": "Malware payload (Mirai)", "value": "d9ef096ab6687e4450c2e3fe14948ce29fc4914c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969882, "uuid": "6d5b9163-f5a0-4668-be1c-b3dededc94ee", "comment": "Malware payload (Mirai)", "value": "839f3bde72e91aebd61a947912e20fe4b72608ea2de879af73dab4f3ded0dfe4e118a93e1dda3256e259d8837e82419a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969882, "uuid": "03c6d13f-a92e-43ab-a656-9b6daf600467", "value": "T1F6412F9C82457D81C48DE8293693C10DB9904BCA14AF1B98AEC60DBD98F4CCF7139F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969882, "uuid": "7cf0f9b9-9ae0-4934-b04e-124802bb3598", "value": "48:mXBV7XDqV7X/V7XUV7XtV7XsV7XBV7XCV7XOV7XDV7XZVGXBVGXDqVGX/VGXUVG6:mxV7GV7vV7EV7dV7cV7xV7SV7eV7TV7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969882, "uuid": "888b85c4-a346-4106-818f-5b6b13f35cc4", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969882, "uuid": "1f224c40-660f-40bb-8238-aabad3532005", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969882, "uuid": "57df93d7-3e67-4d06-8bf0-fc5fd755dd4e", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ab1117-5ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780007437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007437, "uuid": "1e23ddb2-6f3f-4353-bee8-2058ab9a0460", "comment": "Malware payload (Mirai)", "value": "8a80052dd0591700bfb6797961ef4fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007437, "uuid": "557eaf26-c1e4-4172-a2d8-716533de4927", "comment": "Malware payload (Mirai)", "value": "23a4afdb324148b185b7f2e8123e055220959f7d37a8d2f49bf111fe7f4a5650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007437, "uuid": "beb98f1b-5e24-41d3-8a7d-06dcf7a0b27a", "comment": "Malware payload (Mirai)", "value": "8fad568688dd22d6dbf69c8f0b962e180f0792b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007437, "uuid": "b87ab1ef-f9d0-404a-9d4d-c0602d86882c", "comment": "Malware payload (Mirai)", "value": "8c2961e15d3dc6c0774ad89762667e09b71dc42c32bbbdf78be924b369a58183a9e8719eed5e3425d297785d31f74603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007437, "uuid": "b7dc8625-803d-4987-ac09-f0a9f2b60d62", "value": "T1D6E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007437, "uuid": "50b5c59c-4edc-499a-885f-7c75184df862", "value": "1536:p+5TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxsdbK:pWlybKpzEOfGQ+vEubTt4ouftL44dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007437, "uuid": "db9074cc-1fdc-45e3-baf5-5f093a953c24", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007437, "uuid": "68161199-50b2-461b-ac63-4cadae754d53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007437, "uuid": "db077cbd-fd99-4540-ba54-c9ccfa253ce2", "value": "23a4afdb324148b185b7f2e8123e055220959f7d37a8d2f49bf111fe7f4a5650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00ed989-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779953680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953680, "uuid": "35b9019c-dd86-43fe-b992-f614c8ab66f4", "comment": "Malware payload (Mirai)", "value": "7606b1da4251e95a309e411130b0848a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953680, "uuid": "eab1f463-0ab1-4b73-b171-b56a0ca19397", "comment": "Malware payload (Mirai)", "value": "23ea46201b79bcd802191e5656daecf304b5b94a56d09583484e6fa99cfd7f0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953680, "uuid": "96189401-069e-428f-bb9a-02c7ae0c0083", "comment": "Malware payload (Mirai)", "value": "ac22699432bee6c1495a3ed785310c1b3d4531c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953680, "uuid": "2cec8fed-7b2e-44db-8789-8978bc31dd47", "comment": "Malware payload (Mirai)", "value": "4a766297cbed400118485ef5254195754164defd7d93a924e57ba89831af395f5c2755d45cea74a8e6a46292ede71ac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953680, "uuid": "5b4e05f0-7aeb-4222-b948-ed76a7bfe549", "value": "T1A3A32A86F881865AC6D023B6B77E368C3322A3E5D2DF3207DC285B6527C559E1E77780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953680, "uuid": "a040567d-f16a-4e71-bb6c-84ad98f206e3", "value": "1536:fNqwse8cIcu4KMng2foXj7CCzKH6g1ldqzMpd5+cqmx6zxnDoecsBzcOLtzbxokn:Vqws5cu4tg2foXiCzots5+mzTjYb1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953680, "uuid": "096c3dc0-8e09-4ca4-8ad4-713c19b17e4b", "value": 99856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953680, "uuid": "9fa1887c-26f4-4990-9fd1-9532ff66b762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953680, "uuid": "16aa4782-b176-4146-81cc-6eaebe4f729c", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97d2c7e-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973936, "uuid": "1c3f39dc-d6db-47b5-ac42-eb2b5f129dfa", "comment": "Malware payload (Mirai)", "value": "bf9aa14251917c6bf31c0385f569c53e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973936, "uuid": "17192af0-6c51-4cb6-9caf-23acbed13faa", "comment": "Malware payload (Mirai)", "value": "23f1f00383dcccced590eb9f14795c26f68f5f2fc566c01cbc21689919d2dcf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973936, "uuid": "eb056bdb-11a1-4a8b-81e6-6a45388b7b44", "comment": "Malware payload (Mirai)", "value": "3a44277bba72898e4ce7b6a77a909fde5d2e280f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973936, "uuid": "02ca4206-92ca-42f7-967c-518193f22f92", "comment": "Malware payload (Mirai)", "value": "fb75f5967d01b0e717480c90936b63cd51b21ed50f8ccc18d89f2714f843b522b4e90bbeb3388bda48bcf00137adb734", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973936, "uuid": "f00ad798-8c8d-4696-9072-6d9cf43564a1", "value": "T1FFD31946F8819B11D5D151BEFE0E124E37131B7CE2EE7212AD246B347B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973936, "uuid": "c95b795b-d8d2-4aab-934c-a007564300dd", "value": "3072:M24rLCYgPesXczYdraeC2vEf3g2zPBBgoxI:M24r+7pXcYxa9VfwGBBgox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973936, "uuid": "554a923a-8f67-4871-b7d4-d2608400fb0e", "value": 138972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973936, "uuid": "51603000-65d0-4e8a-8124-88c7b6eac0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973936, "uuid": "1a074b58-326d-4d71-b433-e00a328907ec", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d4da78-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974494, "uuid": "dffa1582-bb28-45c8-a6b3-568f02d2e7fa", "comment": "Malware payload (Mirai)", "value": "9270a15f724ef19bfa56977f74a44b49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974494, "uuid": "72e9bdec-c50d-4392-aca2-13fa433efc08", "comment": "Malware payload (Mirai)", "value": "2484484280b0dac041271fb3e12d9375066b9aa7199bd67d0330132c2ace6571", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974494, "uuid": "ae00e0e6-271d-4043-89c1-a915332637f5", "comment": "Malware payload (Mirai)", "value": "a7a68b9747a0843dae56cac62ed5ee73b6e1404b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974494, "uuid": "46c2b57c-ed40-49f2-b4ab-2a579574a344", "comment": "Malware payload (Mirai)", "value": "4ad9c0008da57add3a70c3abee5bc8287d036a4f2bf2d49de35b181cbd2a14f867225afbcf70426840f76f156bd23ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974494, "uuid": "09874c57-5687-4249-85a9-27fcd5e62022", "value": "T1B383A34A6F610FFBF89FDC374AE92B05249D541A60997F79B930D818F24A21F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974494, "uuid": "cfd46ebc-229e-499c-a5ae-8787d39056cc", "value": "1536:Em3N2qK0YBEio6jlhDwYfMcQPJeTEPzA5D3/JnC:Ei0qujliCbDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974494, "uuid": "20c9bb4f-8454-4941-8ad8-4f96db9193bc", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974494, "uuid": "20782af8-2129-495d-a65a-dbb96e0da0ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974494, "uuid": "6ba22e1e-c3ba-4b16-99be-02ec4d3574e8", "value": "00325fcc368c7b667919a9cdbfcdbe3475772f25edba3d23cd562d9e20d9a8d1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db014d4-5a3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934590, "uuid": "47dbd4e9-cf68-4f74-9736-fd991151a3da", "comment": "Malware payload (Mirai)", "value": "63e3eed7643f0185a90464377b71192b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934590, "uuid": "d82b9fee-b099-44ba-857e-901d5cac5ea9", "comment": "Malware payload (Mirai)", "value": "2575be6a38e85b5e1808ebdaadcb4fadb9bfa175184077cbf5164115b4d8982d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934590, "uuid": "452ffec7-3be6-4930-9806-8722f2e00058", "comment": "Malware payload (Mirai)", "value": "2b67e82a5fa073f934f52400f6aa26a996c4065c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934590, "uuid": "c8dcf027-00f2-42fa-8bc2-94f1845a5843", "comment": "Malware payload (Mirai)", "value": "ec8a1971da79b6f622436638308cfd734d8b968a330d95dee838e4d22fa60c302da7af6f8f9bb35cbabff79da7750943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934590, "uuid": "ec1d88bc-4d67-43b5-8391-de49c7c72bd4", "value": "T12FF32941F8414E27C6C712BBFB6E428D3B2A13A9D3EA7203DD255F20378695B0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934590, "uuid": "cdde59b2-9ceb-46c8-a4f4-3d851a663d7c", "value": "3072:k4CF7a6kqFKa6jnW4BZ8aOoUmJBd6hh1ba:k4XqUnLW4r8vfSBEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934590, "uuid": "434a65c4-e144-471a-ae69-bc92feccd4d1", "value": 158944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934590, "uuid": "ef17c0f9-2c9b-4f2a-a752-eedf35ada761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934590, "uuid": "27773837-5bf4-42c9-90ba-8450f5ff4db4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef92b75c-5a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933171, "uuid": "2bcdabe0-5785-4d62-9a5a-0dc40a95c783", "comment": "Malware payload (Mirai)", "value": "bf5c110234069263b75a21d0a146807f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933171, "uuid": "928e416c-15ee-408a-9e94-336d1a737d78", "comment": "Malware payload (Mirai)", "value": "25dac8f50287ac0ce04bdc62cbb5b5509c8b49db93d3a027986c24dfa229e3be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933171, "uuid": "fbf808e5-15ac-46e6-afee-74cee5e8c248", "comment": "Malware payload (Mirai)", "value": "0945068b9450e4f81e75d1724ae993ffb0df4d9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933171, "uuid": "d13035f1-d533-4575-a618-4f223fdae3ca", "comment": "Malware payload (Mirai)", "value": "c14599b96514692dace5b531a125bab7b5352a807b9ac467fcec5bcf3e7c38a27f16787d71f69e2d68778edf5a6569bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933171, "uuid": "60510ecc-0967-454e-a252-604f79ddbf39", "value": "T1CEC63D87B8924942C9E83A77F8BD80C433670FB99B8756565D04FD3C3ABE1DA1A38354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933171, "uuid": "1c7b3b24-0db3-4a3d-af18-4fa2f3aeaf94", "value": "98304:Bhb3UaNUc6HEAJa4hzEkQSGe+dVHz+SGatOJTZvkRJ4aE/:VN4hIkQ5e+dVHz+SGCgTZvkRJ4H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933171, "uuid": "696333e7-bbd6-4828-ba90-b76c9fc47a48", "value": 12255394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933171, "uuid": "32774ab3-24e4-4057-a299-26fbd873dd47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933171, "uuid": "63b097f7-78e5-4867-b145-eb9e9f3bfeb8", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b19d6a-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779949737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949737, "uuid": "2fdacd99-f52a-493a-ada9-11227a8a2cb2", "comment": "Malware payload (XWorm)", "value": "da14752e9556c7dff7ed65aa23477263", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949737, "uuid": "280ef7cd-1dc6-4f9a-8627-9e2b76a5cd2a", "comment": "Malware payload (XWorm)", "value": "261d3de1ef717433231c98fd5e7da0c36946a8f3317385fe4a6a0e40f8d3981e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949737, "uuid": "d9ae71cd-2e3f-4c14-a160-b6056894205a", "comment": "Malware payload (XWorm)", "value": "db626a51811a4064eead9445bf22dbb7fb191b55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949737, "uuid": "8a691924-9732-4864-8629-c6be726f488a", "comment": "Malware payload (XWorm)", "value": "d7896fa6e07419be423fff7de364abb32d654651ef1cbefb202ec4123701a9fc379ad4130158703fe9ee7aedcb34f820", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949737, "uuid": "cf7541c9-52df-4518-85eb-afdcefc21d21", "value": "T1CD133E1D5346A908AC35BE77A5D74D3CC0E14EA315B6FCD24E87CECFE18992068DA632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949737, "uuid": "36abaa2e-a7d5-4b06-adbd-c06eb9c1c1c3", "value": "768:T4hTpnhsbCm/yzuE3d8BbGJsqpuegzO/S5fcXfbNv4GmvgZukGgGcnZvEaQjEfu5:T4hT1hsbCmqzuE3d8BbGJs+uegzO/6cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949737, "uuid": "20ccc5f7-7607-4c0d-97ba-321a6f512759", "value": 43527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949737, "uuid": "20c35d8b-ad2f-4123-a96d-e9389916deb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949737, "uuid": "7eb65d7b-55e7-4513-978a-a6587036f927", "value": "Order-Sheets-Inquiries & Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dc37d6-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "610ef9f1-36ee-480b-a82e-ec9d3926adf9", "comment": "Malware payload (Mirai)", "value": "caae21d7b9a29ac131b3f8ccbbb4800a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "91eee942-f51c-4900-80b9-0029915abc5e", "comment": "Malware payload (Mirai)", "value": "26e07f0cc44dbbdf633d1943a08d494a39988c72678ca6bf02b69134213f7795", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "6c869c85-504d-4dc2-a5e3-05c25eedb24d", "comment": "Malware payload (Mirai)", "value": "a4049af19cbcff4d3185a7e3fb1fb224ff031801", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "32169884-e388-48f6-86b8-e0c9da68bf01", "comment": "Malware payload (Mirai)", "value": "9e8a60b8064e5367cd2b472228a86bbfcd9fb39ea69384103dedd5d2fb7071dee511c7ce7cf31dc9b0b1ddb97c821ade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970957, "uuid": "59e58070-9b82-4bd4-a514-b0f45323889e", "value": "T151732955BC819B13C6C022BBFB6E428C372663E8D2EA3207DD265F11378792B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970957, "uuid": "da119c47-84ce-44df-86fc-1bebbf96f5d0", "value": "1536:cTZPFRVt+LDSTs9Wp2oScuBt5CNXJUKwEfe2M4WVaU3vKz:cT/R495UKboJUKwEfqtKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970957, "uuid": "51be0472-4b29-4277-8c28-b64cb580810f", "value": 75192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970957, "uuid": "8e54c6f0-f573-4d4a-87f1-946815d8f448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970957, "uuid": "f24dab8e-1fea-43c5-92fd-2c6ab3d2fcce", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75a62aa-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779970523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970523, "uuid": "ceb60996-36f2-4bae-af53-2e6b9beeee92", "comment": "Malware payload", "value": "8c21e71e419fff5af076a55e937d7020", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970523, "uuid": "5aeb3f2f-dea9-4d82-8edb-300a2d66dc84", "comment": "Malware payload", "value": "270bb96d46082cb03f080f5c3bf86f9a4cb3652ab73a2e8553cecd9552fcac80", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970523, "uuid": "e597db22-c4fd-458d-889c-1b6519410438", "comment": "Malware payload", "value": "52e37ca8ff95b12f6e498534e6e3a4dcea7fbfb4", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970523, "uuid": "69d7e7c8-47ab-4afc-a877-2f794c367e1a", "comment": "Malware payload", "value": "452e099bedb75adb296523c0d14348f4dd1ff7346736efe87d366205aa7ac00384cfc4fd76143557e88cec099a534852", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970523, "uuid": "6bdf969a-59a1-4d30-8e13-dff6923fdcb3", "value": "T1EB631257FFCC1B9DECD927F807AAA5DB13529035947281A90DE28C9A905F9B110DBCCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970523, "uuid": "e12cee7c-a9ef-4e1d-b96a-e2cfd1bc6d21", "value": "1536:JU7MbwKNGjjH+Xq34n/q8Zu41zmX3sDgfarP+:W7Mbp2L+Xqdfoz2sNrP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970523, "uuid": "3b18e8b5-58d7-4a3b-b325-f8db082ed538", "value": 70852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970523, "uuid": "8619e12b-679d-4611-9e5c-eb8228a58a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970523, "uuid": "5fb316c4-ed25-4eb0-8790-3b6cbb79093a", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862a9fb5-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969931, "uuid": "6ef5b1f6-f1de-40c3-9b7e-024e161a3263", "comment": "Malware payload", "value": "3ce3f765a642fd869445623eaa44d6e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969931, "uuid": "0fd4af53-4270-446b-afb0-bb2584bf16a8", "comment": "Malware payload", "value": "271173e6829904cec6078766a6a6ee8e34d86a5985b93b30aace52c2f34c491d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969931, "uuid": "cb33f52d-1380-499f-9fb2-6e868bfc6ee5", "comment": "Malware payload", "value": "a9eac9cd5e6123bda0ae779457f433a9634368a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969931, "uuid": "508a4c96-726f-4a92-a2ef-047b1c1006f5", "comment": "Malware payload", "value": "d0eac72ae58e04dad9f4b9ca59c65838c92a6ca9f43701fa492e92ffcb1a12ab314aadc1dfb4a7c10b0249e506c8b45b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969931, "uuid": "713d276e-26ca-47dc-901b-52222bf570e1", "value": "T19B3130C554C17B7ECCD8D5157753A02D502869C52E6F2FD8DDDA289DA7C0A92F220E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969931, "uuid": "355f8c46-258d-4acd-8051-cb4795b9de0f", "value": "24:FVEBvi1pNeBFBvK9hOA4TtqBvTm7T3i1BvWPiMB8p7EByTvDp83jOrQtqBVSjR34:FVovi3EB7v8hOrcvIbiLvAiA8q07poor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969931, "uuid": "8105284f-3211-41bd-9476-b660db8eabef", "value": 1498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969931, "uuid": "f2ef4b7f-1938-4dc8-8a11-ab182f432705", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969931, "uuid": "88fb528a-68dc-48fe-b041-9e6e650403c7", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b5a787-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966605, "uuid": "728afa25-58a9-46ad-9ef0-581c2ba3de60", "comment": "Malware payload", "value": "7f6ebe42191052554a31f7fa607d1f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966605, "uuid": "dda5984d-8e5e-4771-839f-fe05675f3232", "comment": "Malware payload", "value": "276490a44e77ee07d521f0dced9767bb2a56dc45d8674ec13c14bab422af3c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966605, "uuid": "be6c5010-f163-4b63-a137-731a744668e7", "comment": "Malware payload", "value": "5942ae1199349f499416231288ce0d77e0ab7fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966605, "uuid": "153771fa-285a-4b07-b128-7197312bb65d", "comment": "Malware payload", "value": "84518bf3a6e99019fedf5fd15b3e10b4e27b44834481bad926a985243c3feabb537ed4fde1bfeaf71b01d24a6dc46a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966605, "uuid": "c6445fbc-b51d-4125-b2e5-c155c7101ea2", "value": "T143B5D05667B500F9E167C278CA528707EBB2F45527309ADF07548EA62F23AF25B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966605, "uuid": "23a7dab1-38ff-4495-adcd-b8ce38ef0797", "value": "ccddf740495379a87b950796cd164c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966605, "uuid": "1fc04cca-526a-468b-8516-152ad9912c07", "value": "49152:gdXKPaRAob7DSKEYxFjEGEZyUJo+14dVWqNZrU3z/oHKWFB6kAu:s6it7DnjE5yVZrU3z/oHKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966605, "uuid": "7906adb9-ebbc-43b1-b6a0-c608a0d679b2", "value": 2292736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966605, "uuid": "fe5ad739-ad0a-4fe3-b18f-a69ab6bfe22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966605, "uuid": "9597b0d0-a5bd-4df9-82ab-58dbaa13df9c", "value": "b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d8d0c7-5acb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779996537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996537, "uuid": "b6a1e68e-a06c-4b11-b745-1a3e0264a8fb", "comment": "Malware payload (Mirai)", "value": "3f7c67617bf8ffcf8c2990e901876a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996537, "uuid": "c15d1678-ad2a-46fc-a051-55f72aa8f625", "comment": "Malware payload (Mirai)", "value": "277bc495f21806f6cbadacc81f3ba9c00b2908f6426a5a3d22fd619d88ac56be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996537, "uuid": "aa747d9b-d2d0-4fa5-9821-66134b94c4c8", "comment": "Malware payload (Mirai)", "value": "11fd1ec34dfa28f3611590a1051bc0c4aeba74ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996537, "uuid": "54ef0b4f-ba4f-45a7-8e18-6748571c7192", "comment": "Malware payload (Mirai)", "value": "c6b21a307a165a676d3e8e06e576cd10e8388671c93fad26ca89dbbdddb66fe140bbcd7e18b17ca72c542de0af2470dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996537, "uuid": "a780935f-e305-4375-974d-612b99eb54ed", "value": "T15FE37C73D829AF94C555D578B0359E782B13A55592872FFB29A3C2708083ECCFA06BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996537, "uuid": "48466ef3-4214-4f46-9f5d-d44be82ea5f3", "value": "3072:ojEaAWfpUGIXUf1A8TK9NOPxsZMoy2WMv0XUkimca:ojzjeFCyNOPxwSjM8Ekimc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779996537, "uuid": "ca31bdb9-f9df-436c-bc59-3ce68d4cb4d8", "value": 145952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779996537, "uuid": "e3f34078-433d-4632-84f9-530fb9ad0b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996537, "uuid": "a4f562c9-6d5d-4995-a624-5b128ae030b7", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23adff23-5aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779984368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984368, "uuid": "de7cd39c-f07d-4c4d-b1ef-050d55aa5b07", "comment": "Malware payload", "value": "5bf39f9e8e38497da3a9e3d07b3debac", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984368, "uuid": "f8b88005-f3ee-4bd3-8bcd-6edb57146483", "comment": "Malware payload", "value": "277fc5d6f3064294d9f539deb6e7d7445757be004d74d2fa46e0e264df57e5ab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984368, "uuid": "d1e3934d-899b-4ef5-a9c1-947bcf7e1ba5", "comment": "Malware payload", "value": "1c568285ed4c6932b6d932de8433035d0f6c1293", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984368, "uuid": "5ef26b3a-779a-4e50-8613-14bc968f985d", "comment": "Malware payload", "value": "2c84f2d438d93fe1ce2c3249e29b977d90672a8601b2940fef7b982a5b259869a5be0b2e0cd6a768cb96b7359293ea7a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984368, "uuid": "e4bcb24a-275b-48fe-b136-ebc0572c2eaf", "value": "T16CB423D2401F4C59D7564FB207C921E3C5330A7E86A528CC05DA68A66BCDEACF1E8BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984368, "uuid": "84b77d75-a942-423d-b160-e44bdad52e8e", "value": "12288:jUVIQ050I5QuFLa6tnXFJQ5Naka7+16PuW:jVQ0zC0lnVuNxm+1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779984368, "uuid": "d2b1b796-9e6a-4d11-91f5-4ca34157d684", "value": 507250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779984368, "uuid": "bacbf75c-f14a-45f1-9fc8-9cbb735c6239", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984368, "uuid": "454a342d-8035-4f64-9067-f1e0478232dd", "value": "libmod (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11637224-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1779931080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931080, "uuid": "fe88bf7d-f00a-408f-8f41-9382bf6e3672", "comment": "Malware payload (Gh0stRAT)", "value": "9b384055c353d5288b2531260172cf5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931080, "uuid": "003ebe25-62ca-4c96-a3fb-a692dc9f624f", "comment": "Malware payload (Gh0stRAT)", "value": "27d4b34d2ea281766a07da52b6700b196bcba749aaf73c96b0320512479e55b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931080, "uuid": "e11dcc7c-9822-452c-a08e-67ef6b815d50", "comment": "Malware payload (Gh0stRAT)", "value": "120b71a878e94972af79e3d02a762137f3610532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931080, "uuid": "be63d4ee-d813-48bc-9499-f4609cbdbbba", "comment": "Malware payload (Gh0stRAT)", "value": "445704c28a6e7afd6e5f24546324aac200a0d882fee22eba1072e8131d8803f6bf6ad2aebd0fa19d2b572c580b3f0a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931080, "uuid": "e49596b7-2e26-4cd1-b99b-68570d82f1c6", "value": "T117461217B2CB653FF06A863A4DB6E222953B7A6169034C679BF4085CCF250D12E3F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931080, "uuid": "6b83a70f-d2fc-402d-9cb3-fc2e92ab635c", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931080, "uuid": "6f4b1a60-91d3-4750-8587-2f67f41e4f9b", "value": "98304:S5fgQnyJbc0aQMrDn/r85YynPNLAvEtr99VKsdzK9UzDxUQbjIYoaQo5iku0B9:mbnyKyYsVnF0vGBPKsJz5UQQYoG53B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931080, "uuid": "4cda6bc1-f630-4677-b896-101e631ef576", "value": 5425324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931080, "uuid": "f2019ec6-d87d-4713-9825-4072fa7aa0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931080, "uuid": "b31bd475-358f-4226-bff4-447ca4459fbe", "value": "der-btuq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2effd7-5a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779950672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950672, "uuid": "2acb9dcc-8654-4e46-977f-21ed4b99ed8a", "comment": "Malware payload", "value": "dbfbfb159bf14e53d74aa9152bca09c3", "object_relation": "md5", "Tag": [ { "name": "82-39-86-48", "colour": "#7D5831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950672, "uuid": "99cd1c24-6376-4633-93dc-9f89ca0418e5", "comment": "Malware payload", "value": "2874868daf6660876cec6a903d2bbb9b437d8d2ff173d8bc39e6f18a016ed838", "object_relation": "sha256", "Tag": [ { "name": "82-39-86-48", "colour": "#7D5831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950672, "uuid": "73f60cf7-c1d6-407c-bf86-831d99c4a72b", "comment": "Malware payload", "value": "4fd4b0f0ec7f9869c5a341dd3e11f76a1b611efa", "object_relation": "sha1", "Tag": [ { "name": "82-39-86-48", "colour": "#7D5831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950672, "uuid": "ede43975-79be-4ace-9d2c-2dd447cf52bc", "comment": "Malware payload", "value": "1e48fedfa7a5940e62540741589c8672b51da01d1042c0547ff17986d06fea5bd3d0a2e44a2cb88b8478360000123753", "object_relation": "sha3-384", "Tag": [ { "name": "82-39-86-48", "colour": "#7D5831", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950672, "uuid": "a89ceaa2-dc04-44d8-a38a-ad13639f5137", "value": "T1178523FBE7A2BD17D4AD0C71405769896C50EC17AA584B373662307FBC732B26602C7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950672, "uuid": "be8f52ee-ac71-4a31-92c2-a8747fd6b1e2", "value": "82b407bd94ace9b3a0545d370731833c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950672, "uuid": "6a9dfda5-ef22-452a-b718-cae9aa49f790", "value": "49152:g/rq4vbuBqQ+53khTgLl5ZmbX67L7SAvV:g/tbm44wWX6e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779950672, "uuid": "60bc9c07-3c74-4ce8-a208-7ffe485498db", "value": 1754704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779950672, "uuid": "c241fcaa-6fe3-4412-bc35-d6e1d3591014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950672, "uuid": "d2c80c0c-fbd3-44de-b2a6-75ff9c3f3e15", "value": "2874868daf6660876cec6a903d2bbb9b437d8d2ff173d8bc39e6f18a016ed838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21f7857-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970944, "uuid": "093c3944-abc6-48a6-b2f0-17fca61398f0", "comment": "Malware payload (Mirai)", "value": "e9434012e4ce4a6e6f9aa2dad2f7e981", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970944, "uuid": "746411c9-cbb8-4f14-bd00-1040f88d2968", "comment": "Malware payload (Mirai)", "value": "28897c30818200c11e7bb2e2432339bf7f753365e8b3d968bd64ee1aec7f9704", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970944, "uuid": "e3c245a5-ba2e-4fa9-a2d4-7a3f3bfcb3ad", "comment": "Malware payload (Mirai)", "value": "832731f5a1ea0dcf093a1e8c8a42fa6b322bc155", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970944, "uuid": "8542a66a-af41-42c9-86d2-520ebd37e259", "comment": "Malware payload (Mirai)", "value": "4fa55e7fc7ec04cdc9958a27b23d2b6d79b5c888775f51ff53b22b75558b1d13e679f6b8a4dbbb2c4a46b49f1d73920b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970944, "uuid": "c0d07a2e-6942-4c24-ade8-71ef28e2f440", "value": "T14A5349C59242D8F5E90501B4253AF337B672CDA901B8FDEBF79447328066EA8B147B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970944, "uuid": "5ef8643a-4bbf-4ae7-adc0-84a79c3f065d", "value": "1536:4ARyERa/39BY3+xKIGj3Uwj2LN0N7FszHnp4:4uxQ39GuxKvj3Uwap0tFKHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970944, "uuid": "867a9882-f87b-40fd-8470-9cfcac847b6b", "value": 62896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970944, "uuid": "3e9625d7-b880-4bfc-a852-59c2842ec3b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970944, "uuid": "adf72b4e-15bb-443f-b22f-0d86ffa1f618", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd2abea-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "f76fc4ee-5dec-4d2d-8bed-ed6b8bf6b9ad", "comment": "Malware payload (Mirai)", "value": "c74b3475cd378c306f4aaf9cf120ab8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "94a9d301-c5ac-498e-8868-1d1c6730794d", "comment": "Malware payload (Mirai)", "value": "28a77c97f2ec275ac8fb0c7ac3925f6fd963b6f0263e7b9c3e270fcc3c0597f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "29cb6e78-7308-4efe-9904-917feffe59a4", "comment": "Malware payload (Mirai)", "value": "3bef2984ca91c6bf54525e54a53e5d9016191e7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "03e0aeb3-2990-4aa1-a0cf-bc92a0bffe27", "comment": "Malware payload (Mirai)", "value": "724efc7a6f5a633fe389a5f818dcd254980c111566506f85fc732a16e79dc816b3be60b960ef14e672922883b78bcade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "5b19b82b-a9b4-441a-b31a-7f49df67515f", "value": "T1AA539E73CC26AE98D04586B0B5614FF82723E104C6177FBB499AC3AA6093DACF9453F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "672a3f9d-0ea2-47e3-ad79-9f885ae78689", "value": "1536:3maf52kqbGBxW2pz8Gkz+BSKMpMnMJ46Ct5N6t:3mwfqbGBx/GGaQVMvJ46U6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970960, "uuid": "66e5a21a-db14-4232-bd6b-3ca8b69d7852", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970960, "uuid": "e929783e-62e0-45ff-ab81-07d52a56c12d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "23dc7cb5-9d6f-4416-a6cd-b6ce969049ca", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaef60b8-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "6dff69f3-ae36-46d9-b3ba-35e9c9c31741", "comment": "Malware payload (Mirai)", "value": "0ad20a74b223f39b757605ff0f636272", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "b7c7003c-acd7-4bce-8c5d-ddf0e06b0503", "comment": "Malware payload (Mirai)", "value": "2937a772b2607238d8ddd940deb95464ea288858dd9fdbd71329820b2c798558", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "f425ec80-77fe-4564-90b3-27f5ea2b8741", "comment": "Malware payload (Mirai)", "value": "f7232b6806fe96ac02e938e098ce863699022906", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "5313ed5f-76df-4e83-8a14-ce88314cc26e", "comment": "Malware payload (Mirai)", "value": "018a57f678f5ae6d1ac4d7daeacb316bd61c88e8d511b9879083a8eff123ab84aedab75a4231d19d6d6e66476f3d468d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "e44a55d7-8a30-4803-96c5-4796974e481c", "value": "T17173399AF800DD7DF80AE67B44570909FA34A39846930F3A6767FD63AD721A41C27F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "273153ce-a49e-42f7-9665-35c9b74362e0", "value": "1536:YXP+H97VThZf/jA2Svq8P/hQDzoP2WLF9DfnrSlDYTZ8:YXGdBzLA2SvL00hR9DZTZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970959, "uuid": "d760dff0-868e-4d7b-8215-18e6fbf3d033", "value": 75960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970959, "uuid": "3af76e4f-96d0-43be-a0ec-94034ac858f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "86376db6-6dca-46c2-9a50-3dcbeca9067e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8739314d-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972510, "uuid": "14639b47-a84d-4fea-844e-e75c2fd7a4d7", "comment": "Malware payload (Mirai)", "value": "990a271e90bdaa4a872b45b78e2b5c65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972510, "uuid": "517873ea-e5ee-415d-8399-dbfbf4a874d4", "comment": "Malware payload (Mirai)", "value": "29c9cd75fea34ba30be4c79c67f5e90df18c1d834fdef30313b032830df16eff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972510, "uuid": "187a2fd8-4682-4188-a9d0-b9b7d1b1cf9c", "comment": "Malware payload (Mirai)", "value": "cd50931fd8a5932f1a69c69852179ad95e0d1903", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972510, "uuid": "586f2adf-b8fe-4b90-9b69-91580670f333", "comment": "Malware payload (Mirai)", "value": "ee6261fb781b4204b738fc18bf08ea132b25d49c75eda26dcd8eddfa9e65732c7e1fcf2d2625494c97d31a0f3177f80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972510, "uuid": "f75f1f64-1890-4114-8852-d0d9e5ae6896", "value": "T118932986BCC1C612C5E1A1F2FB1F91CD371643A8E3E67207DD19AB19674B8A70E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972510, "uuid": "8b181970-9931-41d7-b19d-50ef5b04425c", "value": "1536:Pk0hQqpERtnvjviHBmAD5uyGINtyKWk00guL7Tf3lfvF:Pk0BmtvjqIcuyrNty9uLvdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972510, "uuid": "ec13d945-b5fa-443a-b137-2ebb8c9a6e2c", "value": 96448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972510, "uuid": "0a5a5d50-0a47-40c0-a37f-da41bcb7a00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972510, "uuid": "db3621ea-5327-4b56-b484-f10710e80d13", "value": "SecuriteInfo.com.Linux.Mirai.9853.13547.1685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31ebf15-5a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933043, "uuid": "ce3dcb9f-c47c-4071-bec5-3538ee1163d9", "comment": "Malware payload (Mirai)", "value": "320291ac02b17a2955c655b56f8da2d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933043, "uuid": "af5ac6b0-8a78-458b-a2c3-326adcbea1f2", "comment": "Malware payload (Mirai)", "value": "2a387e0451140e0f74cf9bc37b876e1da6d22b6b7e1b5994dbfe263bf645d80e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933043, "uuid": "8beea67b-4d1b-4f1b-982c-0d6049d8a68e", "comment": "Malware payload (Mirai)", "value": "4607565d226614517c5ba3e58d63a3c70f21ad21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933043, "uuid": "3bae4376-24db-40cf-9edd-dbe7bb876c8c", "comment": "Malware payload (Mirai)", "value": "66133e2bea174374b83e90014efffa64181c112d0cb84fcde2cef91a8f8b7ee1c6721f47196f423f4092b489da0f4866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933043, "uuid": "164fceb1-9b41-4a00-9714-6bd29dc203ac", "value": "T12AD33A86F8818A11C6D112BAFA1E218D331317B8E3EF72539D145F3127CA9AF0E7B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933043, "uuid": "62ea4ff8-3e63-4d0a-9bf7-715a64deef96", "value": "3072:vb6HDkByXidWalN9vnU6a8oaXlNo6dH5jm8Lws:D6j4s6aJaAg5jlws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933043, "uuid": "69a49818-3b08-4486-b405-cf8f2b077841", "value": 140828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933043, "uuid": "a311dbf2-97d3-4052-83e8-50cc37d79926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933043, "uuid": "12f93fe8-50c1-4ec7-a7ba-bbe2fe916786", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8823d860-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969505, "uuid": "21617927-0fa0-4d5a-8627-fe801638c1b2", "comment": "Malware payload (Mirai)", "value": "02bf3f4b7f152727a41ea993a311a397", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969505, "uuid": "a463a566-a646-4b5b-b517-4efd9271724d", "comment": "Malware payload (Mirai)", "value": "2a508dc943369562963055c351592514a0354b77a43276cc773494df45a3a5cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969505, "uuid": "c1543d5a-5986-429c-b82c-1e7c79f910f4", "comment": "Malware payload (Mirai)", "value": "d1553823ed6a745a56202385987ce9ad2126254c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969505, "uuid": "b4a6d2e0-8172-4771-a5e0-b686f617feaa", "comment": "Malware payload (Mirai)", "value": "709852e26882300384401e786afe53a8d7cf4beebbb0a29b7780cd4a2bc3c17cab7a188a90bac090aa2f6a15e233a811", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969505, "uuid": "693c01b8-43d0-4a40-98af-016f637cfbe4", "value": "T1A6932A86BCC1C611C5E1A1B6FF1FA1CD371643A8E3E6B107DD18AB29674B8670E3B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969505, "uuid": "1edccb2d-b62e-4972-b103-4e18e18fbfb8", "value": "1536:BdBdeyd1B2X6D9BIrITus+rqVoJt8g8GbNBNii0TE/:rBd5z2qR5iBrq2JtDBNivI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969505, "uuid": "f3c6b6fc-1b93-45d7-b7b5-763d141f0ded", "value": 92912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969505, "uuid": "e3053db4-75c7-4710-bb17-f8310060566c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969505, "uuid": "88f21446-394c-499f-9a09-7de3db1d70b0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b84400f-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000300, "uuid": "e575cf6c-8797-4bfc-b4f9-93385a6d6e34", "comment": "Malware payload", "value": "92bdfaadc4bc9195166007ec1ca61e38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000300, "uuid": "9447c40a-0b26-4577-8143-3e4a08450b5c", "comment": "Malware payload", "value": "2a74ce196e98b97fdcf59c76c469612ea8f9db184006a27a11fa181d73497f79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000300, "uuid": "e86fc3b5-bbce-410e-84e9-eb8bca88b952", "comment": "Malware payload", "value": "d51ed053aac788100dce06afaab7a5da688db670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000300, "uuid": "d5ee0b1e-f9af-4595-8659-2c58e3dc835f", "comment": "Malware payload", "value": "2c0c03c67e5d62de70d7b1737c3febf20d13499639609763bb9fd971d382b3786d2e6d0721c77ff28a4a774586f2146e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000300, "uuid": "9f8d0b6e-960b-49aa-a978-0a7109899a69", "value": "T1EC95331F3F7DD4F8584608126E819591D0CE8CE4BAA53F8188181F986E60A7AFED7D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000300, "uuid": "5eac4ecf-987a-4ed1-9b8c-6c2ad78f680d", "value": "49152:Rk54qPWTfdRRb4u9WUY5jBuZGxVhKc49EkmIz41UAjFv:R64qsXZZ9nYX7xVhKD9EkiqQFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000300, "uuid": "27ce280f-4039-468e-848d-56351a88b5ab", "value": 2043028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000300, "uuid": "44e5a222-6f70-48aa-a2a2-95cb1f0e7967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000300, "uuid": "3e3c1484-b7f4-4a2c-aa37-bf0e1e5526a9", "value": "vulcan_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2a5a27-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "0c68fd21-1212-4c75-ae9c-1c6a2cdfae2b", "comment": "Malware payload (Mirai)", "value": "0e7f7fd737f022eb934dae030ec84f4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "bb9f7751-120c-4ecc-bbcd-aabffe1b45d8", "comment": "Malware payload (Mirai)", "value": "2aacd88d5f4a55424c5b65e400202f725c5dad3866ff8497670223061831cdf3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "875806f3-58db-467c-bbc0-5684b7cc75f0", "comment": "Malware payload (Mirai)", "value": "01c7de902a3f5d0a22a30f419491f2a4e620d86b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "98123111-6a6f-40f4-8a41-20009c344eef", "comment": "Malware payload (Mirai)", "value": "6bce486fbcf35313c8194182d1d047709eab82ccd0e1e5343718985fa595245acb025f17529485c69ff22d84852bd536", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "58e22a0c-7f50-410b-8c3f-a6b3c74f38eb", "value": "T10993D70E7E258FADF769C23547B78E22A39837C627E1C685E15CDA011E7034D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "aad90080-f76b-420a-90d5-c3e7e3c9a19e", "value": "1536:Rjz/9ubUI94p9EEn1JAbx690ZpGsOJfzsCJ/aQVeKk0DU:Rjz/k4I94p9EE8S02sOJfpAR0DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970959, "uuid": "91663ef0-ad1f-40b4-806d-e39b6440d1f4", "value": 93076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970959, "uuid": "20440f14-866f-4948-a40d-4847a32403be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "278bb660-0288-4b7c-9930-3b537df4da59", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb63a71-5a62-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779951640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951640, "uuid": "6a391955-0a52-4fa2-83f2-1ac6d305f009", "comment": "Malware payload (Mirai)", "value": "a53ec7746e9162309ab883f6790a8eca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951640, "uuid": "a312bad6-45bb-48a7-9294-f681b4b2fa0c", "comment": "Malware payload (Mirai)", "value": "2b68324a2a6c177c70b8a6a2a2181018991c9d1a54a94c72d18818ffeee009b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951640, "uuid": "63b8f69a-3607-4a8c-a726-20e374b9dec6", "comment": "Malware payload (Mirai)", "value": "22c89f1c9eb189ddec0e757917f57ce15f7f60a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951640, "uuid": "4bed2f45-5686-4417-8d72-0215d2774ca3", "comment": "Malware payload (Mirai)", "value": "887457bfe4bfc6b14702d6095bac4ca17caee634e9aa444f30a5d4ba319fe44cb91bec2cce26b2bf023a819ca2365da3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951640, "uuid": "8c037207-46b5-4c67-a531-e63359378df6", "value": "T1C08302040AF1A561DAC82D70792DDADE7B4AA9BD903BB6432110717C4A0B6F277FC35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951640, "uuid": "45c8e682-bd34-4afe-a1b5-86c6b8d641c5", "value": "1536:8El6XcGdPJBk1ES2UfJlxHX+vgAyCm2LFqDBJxQZvHutXjS+:8EivxgEbUBldX+IAyCdLFqNJxuvHQXm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951640, "uuid": "419b239d-ce3d-482f-9199-8c7acc965016", "value": 80892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951640, "uuid": "ac10e048-6c5b-40c6-ba25-32b70553cd5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951640, "uuid": "fd0e4151-4b65-42c2-8c3a-31290b48945f", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144fbaa3-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001093, "uuid": "29ef6443-5132-47f1-add0-aa294e0bec5c", "comment": "Malware payload (Mirai)", "value": "c2718fe60360cab947729f2326b5ce6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001093, "uuid": "909202c5-e9df-4f7d-9e31-bd29580d01e8", "comment": "Malware payload (Mirai)", "value": "2c5f6dd0eecd2cdc2f8a2280ac93ee4176ab0e1833d0959d4970782fd075a0ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001093, "uuid": "01b5084c-97ef-46d2-8030-3d9bf0a62c6e", "comment": "Malware payload (Mirai)", "value": "bb7e1525e1835e54215de056c4875b0d12d9ada2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001093, "uuid": "4673bade-23c1-4121-abf6-ac0a47babb79", "comment": "Malware payload (Mirai)", "value": "5a4be2b96a7d94fb0446529d2859a6f409a05bea3ea68e6956927343c5c93952dfeb2d10caa67342ad3d9311abde33ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001093, "uuid": "79576f15-7454-46a8-a287-15c1924846d7", "value": "T14C042945EA404B13C0D627B9F6DF42453333AB9497EB73069528ABB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001093, "uuid": "fb886ae9-30e4-4c71-be86-2f739ff542af", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILsZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLs738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001093, "uuid": "477d9a2a-c4c7-490c-99cb-c7b9aaf26c93", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001093, "uuid": "75755caa-4afe-4a55-9876-10684806a829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001093, "uuid": "afc9a4ee-5747-455c-a11e-74fff6ee0d97", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaa15ab-5a62-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779951665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951665, "uuid": "4846964e-8352-4830-8d41-c58ce8995dbb", "comment": "Malware payload (Mirai)", "value": "15f4290d8f978dbafccc5c069b733b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951665, "uuid": "962d2c39-31cc-48a5-a260-829b4491b37c", "comment": "Malware payload (Mirai)", "value": "2c7f2e4c9638e6c928377ec3e011e77780a75e459bbd705984462af1ca13ffeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951665, "uuid": "e656ba27-d4a0-4b7f-a741-76b0fcf8ad36", "comment": "Malware payload (Mirai)", "value": "ca44f4fa84f5c70159507d10d18e8bd739c28c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951665, "uuid": "043b1f6b-6908-4942-9b43-14a703b4c62a", "comment": "Malware payload (Mirai)", "value": "2f2c6491b80e010fd64ff9a408c93f1dcc5cf9059462aaa708124eb047d9248ebb010db92a4f688c9e0d3ccbe7198ee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951665, "uuid": "5bbaaf37-836b-4dfe-abd2-7dc64b969ab7", "value": "T1FA244C46EA408E13C5D227BAB69F5249333397A4D3D773069D286FB43B8679E0E77201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951665, "uuid": "75ffaaee-4c50-4edd-90b1-169ab22a5e96", "value": "6144:X7+gBpHaNncQyyDlu8tZ4aW4uVwM/9zltt/:X7+gBpHaNncQyyDl93yZJ/Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951665, "uuid": "cf7ed592-257f-445d-9354-bd7b04550aaf", "value": 224053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951665, "uuid": "8ed9e72c-a387-4b86-884b-cc7d55d1eab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951665, "uuid": "21bfb9f1-b7b5-4712-b856-3c16a5069204", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8630050c-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946309, "uuid": "b6f7db8d-719b-458d-8b9a-d757042e2e23", "comment": "Malware payload (Mirai)", "value": "0cfa63fda3524ab9ee1a7408e6b6e5f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946309, "uuid": "4516f4a9-18f4-4ef1-9002-a70d00283825", "comment": "Malware payload (Mirai)", "value": "2cc4709fe1a2f89ede7cabab094fa6c2741c57395fc213b9bb915efa41217d1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946309, "uuid": "d07b982d-f50f-4853-aab9-68f863180cec", "comment": "Malware payload (Mirai)", "value": "579a53863ba7b03a3eb91cd8d080aa3ad314134d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946309, "uuid": "2f71b01f-c576-41d3-9ab6-1687185e46f9", "comment": "Malware payload (Mirai)", "value": "55736795c0e985eaafa4cdf55d5fcfcde88d3a531c0cb46f221c69ecce278ce424200c19d7818a339fcf9e98f312c45a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946309, "uuid": "94b81628-eb0c-44ce-a1c2-843885085c0b", "value": "T12E53F8827D81AA16C7C05777FE1F018D3319A798E0EA73438C191BA17ACED1F0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946309, "uuid": "34aba704-28c7-4372-8146-37c4d55ca487", "value": "768:zHnEczUZv4tZy6hQfyjXI8CMRxYVsx/DeiZvspz1Y3W7wCVy/Jx+5H8hG1rmCd/v:rEFZEZyjyj48NCiZvsphYceZWTMWCB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946309, "uuid": "a0bdee3f-c6b6-4044-98b9-9a2868d38851", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946309, "uuid": "4a53cf7c-c9c5-42ab-b216-c80568475aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946309, "uuid": "00215330-edd8-4ab8-8100-70af1811eac9", "value": "uranium.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c952f2-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972505, "uuid": "88ba02c4-2be0-40e6-8b14-a2814922d51e", "comment": "Malware payload (Mirai)", "value": "9a743dca77431416111b47c963b30aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972505, "uuid": "89e995b9-86a1-4794-84bc-e4475e2905ec", "comment": "Malware payload (Mirai)", "value": "2cfd83ae629c8073f69e95dd73503df990934208b27d709e4ee4aa68b5271962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972505, "uuid": "2806916a-81f8-44a8-b48d-aef8abde158a", "comment": "Malware payload (Mirai)", "value": "3e5d65503a4a594b079fb866bc87bd2ee4753ef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972505, "uuid": "81fc9123-7ad7-451e-9f8a-cef1eee51494", "comment": "Malware payload (Mirai)", "value": "56bb724c72f45cd77a127b31f915cfe062897b9780a2e7a015e7a59df7858e006b64d44bca8794adc5ae22254c09f5e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972505, "uuid": "b5ddfebd-88a8-4da4-95d5-4f061002fa68", "value": "T1DDB3198ABC818B11D5D625BAFE0E518D33134BB8E3FA7113CE145B2A678AC5B0F3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972505, "uuid": "a3fe9610-2ec6-42aa-bda7-ab6acd345b03", "value": "3072:5UNFRACQGY45V5qEaE6bW7CIIqHumP9KAhPAY9WP0jnjSDk0jHH:OlgEUa7CIX9P9tAY9WP07jSDxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972505, "uuid": "03e4d1b1-184d-43fe-84e9-ab31048fce04", "value": 112412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972505, "uuid": "bd2f682d-e008-4439-8b3a-89449d8a945c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972505, "uuid": "f8eb23b4-2db9-4480-9eab-5c2051f0485e", "value": "SecuriteInfo.com.Linux.Mirai.9853.9237.17528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d1b2c1-5a87-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779967162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967162, "uuid": "38cc1736-4eb8-4e89-9e66-6812a82db75d", "comment": "Malware payload (Vidar)", "value": "acdba773ba05c7c898c4f47994e4921f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967162, "uuid": "b5c562e6-9aab-485e-8ecc-f1452838da28", "comment": "Malware payload (Vidar)", "value": "2d9097040993fe2c72c63a3c7b31b731fe3133cb2c1a947ea8d20246150ce6c2", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967162, "uuid": "e0668c81-00a3-47cd-872f-3ba1a813ed35", "comment": "Malware payload (Vidar)", "value": "23a7d9b9c0a9baf6ee7b258277257085b1bc6b69", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967162, "uuid": "021f4493-8a19-4277-931c-193627100e8f", "comment": "Malware payload (Vidar)", "value": "c70382d8a33afdeaf71c14ec1b2730ff77d849f6495617914b573444710f2212d9dd39849f4c800aa9dd0fc56741f674", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967162, "uuid": "9d2b3ec0-b532-41dd-a595-278b14db06c5", "value": "T159C58D0A7CE008EAD0AAA33289F762917BB1FC590F7263C72E5076382F726E45D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967162, "uuid": "ed742420-922f-480f-bef6-77ff89daea35", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967162, "uuid": "51488846-5789-4328-a6b7-4dd476f7f812", "value": "24576:cFvtCrTeVcgnuSeWjbv234qopPIIXw4kO9QdZC2TU0amsKgIOPfnBele5yK2tFh7:cF1CXePnuSeWnO34qopxXIE2Im3Xri8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779967162, "uuid": "8b52a116-c759-43d6-8eb6-1d04ed75ea36", "value": 2556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779967162, "uuid": "cbf16807-ae9a-410d-bb1f-8f0efc32baf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967162, "uuid": "7c220d87-5370-4137-b315-abba567b236a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c84b1bc-5a6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779955204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955204, "uuid": "0e355f8b-4263-44d4-848b-19268db15cbf", "comment": "Malware payload", "value": "f2c4074dce336b9656bf1ad71e857759", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955204, "uuid": "70bc2f4c-b3e4-4906-ab09-ddc065868aa8", "comment": "Malware payload", "value": "2d93a25d0f6f4b80c43ba54d5ca929919701548c13c21ee5be6426686cc41f3d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955204, "uuid": "1995aced-3abe-4ab9-8106-0cc2a6c31573", "comment": "Malware payload", "value": "4be900e43f85b7c364207ba1f400385c26b544d5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955204, "uuid": "29862716-39ed-45d7-9212-118b9228f354", "comment": "Malware payload", "value": "6e9f4a8590d13c8ef8c282f228a22915af7d6a51ae6bc6e5b764a37faec2a7fdfa96c8ad19fe118623578a67a7a00965", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955204, "uuid": "e90cdc63-ceb5-45a1-a9ab-9b6645a5aa05", "value": "T1F7A31441F7F94119BAB72F442AB946B8493BBFA2253DC9DDCA500D4D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955204, "uuid": "5801c9a8-9f00-44c5-8cc8-8c6728f80226", "value": "768:k9VMLhhLLFUnNdZEAfvqLMsfIsDjQxtgZjb4YrnWW7IidvbDTuE9X0DzVYZx5gJA:IwNfkgat8KNHqQAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779955204, "uuid": "3e425cf4-1162-4e96-9719-c36ed51615bb", "value": 105980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779955204, "uuid": "9592127c-8e3b-4fa1-96ee-a76e98a95d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955204, "uuid": "8142c4e0-5ffe-4274-8d10-d3f28a25b13c", "value": "rlembrete_317078b0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04459df7-5a42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779937501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937501, "uuid": "37ba7f50-4ea8-405a-9e10-7e5bee299172", "comment": "Malware payload (Mirai)", "value": "cfa677f16663afbbeb56b676f2610000", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937501, "uuid": "03643c20-cf6b-4674-ad72-fe5c074b4c78", "comment": "Malware payload (Mirai)", "value": "2f1da7acd090409419faa7839612697920aeb9f5058703570b6d595ddfe99434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937501, "uuid": "33ec7eea-638c-47d9-aa02-a6b64516f589", "comment": "Malware payload (Mirai)", "value": "8b57f4a1d4de7d206ee705372c20f02aba7aec10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937501, "uuid": "981385da-a7a4-45cb-a078-ee0a625d41ae", "comment": "Malware payload (Mirai)", "value": "19a80b43fe3eb996de57e3ef34bfcf9dec7bcc13a364fe6f55c669f5347e276f48f5d040a5121293aa3eddac0b10eb83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937501, "uuid": "e78c6145-72d7-4c2b-b38d-ed774168c64b", "value": "T1B004B719AB510FBBDCAFDD3702E90B0139CC955B22A53B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937501, "uuid": "1d68b942-26b0-490e-8a66-9bc9ab13858c", "value": "3072:nKpzGteNkSfcQqmav8SqaRVlnYz65WVt:nKYteNYQqmeqavlg65W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779937501, "uuid": "5bf60da0-9765-4ce5-b3de-4c0e01bce8a8", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779937501, "uuid": "5b694b62-1a3a-4d55-9506-15d40c05a28b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937501, "uuid": "e08554be-f92d-4b2c-9a56-dda507338eef", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae171ca-5a34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779931606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931606, "uuid": "40bf801e-2e14-4b39-acef-ce72ba46e99b", "comment": "Malware payload", "value": "e36f0983d5db44295f759c0620081726", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931606, "uuid": "5f31c536-aac4-4b46-a377-139ab8729f82", "comment": "Malware payload", "value": "2f23087fd9b9804115c782d2d0f88046d370162b5b982299ae0a518ade9664b5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931606, "uuid": "48ba9b19-8080-4d67-aaf0-80fde4b0538f", "comment": "Malware payload", "value": "215e1b7dda3bba668168878f2af416b0fbbbae8d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931606, "uuid": "fef6afb2-0c67-4a9c-be76-61ba21001900", "comment": "Malware payload", "value": "63111b6c0f3cd9e6540057aab67ed45d5fb9306b6d6988978ffe4734a96f28c6aab0fc327f7c7f54c350248548b750ba", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931606, "uuid": "95ef5729-7cf8-46a6-924e-9eb39e1b0124", "value": "T162B59C47BC9464B6D5AA92328DB15290BB31F8990B312BC72F51B3B92F337D40E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931606, "uuid": "25731c05-d8c8-4b70-b9b4-7d4a85a9d40f", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931606, "uuid": "1cb89147-d593-4332-80d9-5e28fdc7f4b1", "value": "49152:pqveuaVJQWaWhM3X2OvZFWy9tx8jP/TIm9UKOSgk0kID1z:6a8WaWhMnLrxtx8jTIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931606, "uuid": "9ad307cb-8218-4a3c-972c-05083f26ef7e", "value": 2298056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931606, "uuid": "dc2dc594-6dad-4450-9f38-8e7e684c2012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931606, "uuid": "fa3666fa-046a-4a6e-bf76-aaa4a233cbf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad39ecbd-5a32-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779930912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930912, "uuid": "7823702d-1fa3-4748-95cc-820bcea4f705", "comment": "Malware payload (WannaCry)", "value": "c9acc7cbfb0fa517f555c271a9c84827", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930912, "uuid": "ae088821-1a5d-4942-b210-b748db0ab692", "comment": "Malware payload (WannaCry)", "value": "2f4d753ef744d84d4b00732b49b323ea206621ed24394939cdc09b0122a2e320", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930912, "uuid": "5b1ba8b1-cbd5-41f6-b12d-3bee1d1d8da4", "comment": "Malware payload (WannaCry)", "value": "c43b6a4ba36645774dd9e89c2dec89c37d5fa276", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930912, "uuid": "ff3e04ba-8ef9-4da6-848b-b845e0adf265", "comment": "Malware payload (WannaCry)", "value": "15831fd93e4f23de0acc3a25c65eb23987b8921dfd61ce084beb5d696aab124098eead0dc9f98cd2414a3ae314c0c75f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930912, "uuid": "341e1cfc-c6d9-4521-8a2f-a73d0215b9df", "value": "T124363358726CA1BCF0450EB444B38E1AF7B37C5567BA4B0F8780866B0D53B9BAF94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930912, "uuid": "060f96bc-f2ba-47a4-9f09-70634e2ce5f0", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930912, "uuid": "b10e6049-26b7-4a63-a8bb-903377ec6a11", "value": "98304:DIDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DIDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930912, "uuid": "2868b969-6a75-4e71-9ff1-e946042f6252", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930912, "uuid": "3cd5ef9b-cfe2-4f67-b2ef-5174fd03a51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930912, "uuid": "ec633b2e-ec17-4942-8d9d-2aa2361dfdea", "value": "2f4d753ef744d84d4b00732b49b323ea206621ed24394939cdc09b0122a2e320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d4663a-5a75-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779959592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959592, "uuid": "8986495b-fc6b-4f7b-90ea-7c537cf0f7d4", "comment": "Malware payload (QuasarRAT)", "value": "b414eedbab7440bb9ac5be73035aeed8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959592, "uuid": "982b5640-672e-4ce8-ac4c-f7e0d0546109", "comment": "Malware payload (QuasarRAT)", "value": "2fc9ef9039962562c93ed50cc88d4a3347c7f40ef9d7bc264c44e471ac93eab7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959592, "uuid": "124f82e1-c800-451c-a88e-05973daa38c0", "comment": "Malware payload (QuasarRAT)", "value": "22b43107c25da59dabb2c0f98f61dd8afeb9b1c9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959592, "uuid": "4d1568d8-e1af-40eb-9c69-3a7bdfcc208d", "comment": "Malware payload (QuasarRAT)", "value": "ff65aa4e7641977badc3f4d59c9056672a378ceb9259ee9da2549e0c00c7a321a015e739b61d6cab2b4eabd20d591094", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959592, "uuid": "4714b0c4-1293-4859-8f90-822df3387bbe", "value": "T19AB612254D3E8F2F457F047284EF0F467EA9C65604B4A9E14858399F8ACF81361E7EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959592, "uuid": "74a16e3f-2597-4c76-a22e-8c440c1723bb", "value": "49152:gKJhEdhEo8JE7hFKoEXGEo8JOfsuvhlN/PXEkNCEXaqYQ:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779959592, "uuid": "04ec6f4e-b4c2-4c53-9947-1f38f41701bb", "value": 10551466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779959592, "uuid": "5c51d83e-0d25-403e-be51-f69823a9894c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959592, "uuid": "8ff9c97f-a3fb-4a87-a6fe-a22b2d9f8130", "value": "Uni.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db9e67e-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "d4c48c11-6c71-466a-8b23-53975e0e6db1", "comment": "Malware payload (Mirai)", "value": "29df6245e7fc8fbfbb198c396905eae7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "abd7c6d7-5047-4e06-82ff-5f86bfea6040", "comment": "Malware payload (Mirai)", "value": "30c3c5f69cfcc12b76d7fa4a789764ece4ab97690003827ef2bb5b6f2a99ded4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "de5a01ad-5eed-4657-84e6-655c15eef741", "comment": "Malware payload (Mirai)", "value": "f448e5a7effd985a57dec1e8b7e36dfc1c0fb3fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "5578345d-0ce5-4b0f-9e2d-8088aba3d14f", "comment": "Malware payload (Mirai)", "value": "8944e13dd00c54c9d06867881524d691d57ca5e8b054b1387c6fa03b5786a1f8d85e6569d7fbae4e6e8867324ab1e2c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969541, "uuid": "5c7bc6a0-ade6-4b22-a8fc-dd1dd14a538e", "value": "T197B3198ABC818B11D1D625BAFE0E518D33134BB8E3FA7113DE145B2A578AC5B0F3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969541, "uuid": "a684b07e-18e0-4a12-b5bb-1179b4b82c9f", "value": "3072:w1lRAo0+WPP9JUnQE6O6Dfi4s1kmhYMHVyr4dWP0hNeCDTUjgH:lQn2/DfiD/hYw44dWP0XeCD+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969541, "uuid": "bbd2e4af-85c4-4ebd-aa9b-d560c279267f", "value": 112412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969541, "uuid": "efaf78d1-9e88-4b93-ba1f-396568c7487d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969541, "uuid": "25ab32e0-0742-4543-bcc8-6fcf19594a55", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad419c5-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932009, "uuid": "8a41a2e0-a8c6-4074-a638-829f2d232e63", "comment": "Malware payload (Mirai)", "value": "d070733d222f0d6410c857aa2a3b76cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932009, "uuid": "fcc1c0e6-ea4a-41e9-b267-38e40f3a5d2d", "comment": "Malware payload (Mirai)", "value": "313fd877f325e3b9ff31bbfa5de740d624eecc8687d07678b6f951a9af180881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932009, "uuid": "00dbc1bc-951d-4839-af16-82d7bd02bfb2", "comment": "Malware payload (Mirai)", "value": "50e8f75531d6607ebd410e5245bd5da39575fd8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932009, "uuid": "cafbf695-aff6-4838-88aa-5139db23532b", "comment": "Malware payload (Mirai)", "value": "af773b3c4bf9f43ae8f20f3a9d7804b34eae1bfb074cbc1d62cbb7a8cfeed531e7da56e02dbebc27ea76dd204eb6d5da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932009, "uuid": "6745395e-cdec-49e1-967b-3b98087f97af", "value": "T151530992FC424A6BC1D403B5B5AE6A8D372213F9D1CB7227DD614B407AC591F0DAAFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932009, "uuid": "63c44b1a-3035-4a92-9d61-6b653a3aefcd", "value": "1536:uSDIgnEoxbmF876qeGObkfJu4IHpmvDzMNRIF2IymQY2AUm6hh13:uScgEkbu66tIT6hh13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932009, "uuid": "a7264462-3f6a-4fab-913e-a0d7330f21d0", "value": 63892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932009, "uuid": "4601595d-1f45-4600-be1b-4434f099f0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932009, "uuid": "56ce456f-83b5-4e16-92a9-db278a8c7ddd", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807beb1b-5a36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932555, "uuid": "ea795225-afcd-4550-82f8-76c6f9b6c1db", "comment": "Malware payload (Mirai)", "value": "5a066a1dd58755233057010c67c7bdef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932555, "uuid": "35216bde-2c4d-41f8-8ed2-392f82a81e88", "comment": "Malware payload (Mirai)", "value": "315d54da15c2e6e789d1dc66bf02112eb25440ca564fb8a136f8bfa514facee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932555, "uuid": "24adc6bc-351c-4e64-b2a2-98b9a163522e", "comment": "Malware payload (Mirai)", "value": "d076ba23acb2be085f33b27428cdc41874fe4f72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932555, "uuid": "038a895c-28ff-44f3-a408-ca0d0485fd18", "comment": "Malware payload (Mirai)", "value": "cf9a9a0100a066c58243edcecc43dde669ada403bd9ab8219e2116cb22324c7bb87770c6768618e64abb86d178ce2823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932555, "uuid": "704b02d1-b66d-4337-998e-f2e700d4c523", "value": "T11A33F1FEB126C2F6D9603FB2191442C5FC4CB69B8E525BFA069654F90C73C10294BF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932555, "uuid": "bb85b2a8-759a-446a-83bf-0d05980e495a", "value": "768:+O4gDczWuzx4gworZUPJ6yjrhQmzCefp2YTtzjBpjOGn0cmg97O5ebg+9nYndx0G:+lfx5SB7jVnzBfFzjLqGnug97O0jCxbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932555, "uuid": "3f3d093e-f2fb-487e-9f6b-122666530eb8", "value": 53644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932555, "uuid": "41eca74c-a36b-4048-8bb9-727db1be644c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932555, "uuid": "bd7aa8d5-6f41-4157-93ec-d8ca0074a5a6", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7748c2e-5a49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779940808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779940808, "uuid": "99e96f72-3ab8-4f72-9a60-a84b76ae19b9", "comment": "Malware payload", "value": "9ddc61c403e47ee15432e0c34af9247e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779940808, "uuid": "c78044ac-b3a6-401d-803e-5315806e7ae0", "comment": "Malware payload", "value": "32e9154820fcda6355078a7cd286b8bdbfdf73415895f2208d5b6f527685e1f4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779940808, "uuid": "d320c5e2-eaf7-400d-80ed-d54937bd6208", "comment": "Malware payload", "value": "277f64bf8b7d40daf8cda4d6d3bcb980cf25f0c9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779940808, "uuid": "0760667c-5727-4808-9c3e-a2f7ff22c691", "comment": "Malware payload", "value": "945f9585da5e97f14ef902b0bf891c77188472fab8fcd2ea50e402ff458ab2cf9d512c5c8543bd111118d7a3d124b805", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779940808, "uuid": "d5410fe9-aa31-46ff-a00a-371dde0b8aee", "value": "T1DDA30541F7F94119BEB72F442AB906B8497BBFA2153DC9DDCA110D4E0B32518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779940808, "uuid": "6a356b9c-be52-4da6-8e37-b771b5635c7b", "value": "768:D91zSt4ZpH5qrf8yF87l9RKWxfofisRFUyMsUxJ8nqY9vVioCP8wfW3/vg185cgA:m69Jig348CnnkF4KOsOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779940808, "uuid": "ca0e9b2f-7730-4f27-bc6a-6146f0000a51", "value": 105802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779940808, "uuid": "3cfbb4e2-ab5a-44c8-9e34-b23a4968558b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779940808, "uuid": "62b81698-0929-4a3a-9867-92445922125f", "value": "rcomercial_fef74dff.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6b95b6-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "aea02abe-e9a9-4a99-bc42-2911e51a1889", "comment": "Malware payload (Mirai)", "value": "109b9d6e5c25989c85017b6473394bc5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "930a5f2f-c2a7-4b26-8fae-f9d92a97836f", "comment": "Malware payload (Mirai)", "value": "32fc6e7bd0e142bef4bee5e0727bd44513e4e672d480739c4d93306e76e93270", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "377db463-f1c3-4cbd-949b-8afe57c759f0", "comment": "Malware payload (Mirai)", "value": "dcc4a807d6ae6258d7faf697086b611f5acc7846", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "55517e26-a541-4cba-ac6f-581f949b4c44", "comment": "Malware payload (Mirai)", "value": "927d47da4d9beadcf561d2ea60229e23ddef37428fb0a74a955687fed5d10085cf001999af2238347dbef1942bec7f50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "e48d4c45-fe90-42b2-8ae4-e6379ba8f0d0", "value": "T11C21CBA6A7D2AD16CC580277CCAB3B10F322BE408A9EF463F35116150C7F31A5F22099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "a01e9510-0eab-4ffa-aeb0-7309b8f8c98e", "value": "24:JhGgP9qD0at6EoKGwrUlFSy40VzLCkIddx2ByQIvGrNf6:JhPFqDPtFrkFSy4CzLZ7IvGrNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969032, "uuid": "38c3ab00-df56-4108-beb1-26c797df64a2", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969032, "uuid": "ac72ff9f-ecc7-48e2-8183-f2ee16381727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "7b1becd1-13e1-40fa-a756-a6ee4f5482c3", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad30bea-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "44c12ab7-b3f9-43c8-b67c-e5a8faacf7c6", "comment": "Malware payload (Mirai)", "value": "fc1d4b2e96ad341074a782be7196049a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "b0ed19fd-3aa5-4e04-b966-97839cd9ea43", "comment": "Malware payload (Mirai)", "value": "3358909b9fe1d8d09d393f5349b9951e05392976fe581f3dff7b6661cba9583b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "2fea6a8d-ec21-47db-af26-e1d714d1cdf8", "comment": "Malware payload (Mirai)", "value": "589cf7dee08c29710f11b554083f41e86cff189f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "f54a0ed0-80f2-4fe4-bdb6-e18cd72f449f", "comment": "Malware payload (Mirai)", "value": "8d5d2f9b58aa0249ffb99615d28a594f2ed30031392978e23e6ebcf24991a9fe0163cd50c64007b237c86242f3d6a773", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969080, "uuid": "43eed7b3-a25f-44f8-9cf1-4935e79b5e2d", "value": "T177C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969080, "uuid": "ab20e2c2-689b-4d21-bdf8-0c8ba9a7b150", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMWN:MwCvdHmezn0nUPMu9KryXsMWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969080, "uuid": "b6f2afda-c711-430e-803b-78917b54e847", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969080, "uuid": "036f91d4-3607-45ac-9942-1a6cb1d6c8af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969080, "uuid": "d003e744-2767-44eb-af1e-3c129c8b12b5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5688ad64-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970280, "uuid": "6e698f80-435b-46a4-a093-203fa765dac0", "comment": "Malware payload (Mirai)", "value": "e44a5b4f4029d760a06e3eb14bae35c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970280, "uuid": "a2ff61b4-cb74-4db8-8e3a-19f01e3c9eb4", "comment": "Malware payload (Mirai)", "value": "337a47777aec77eae59cfcdb58999244b47c85b598dc9ffc4c550330bc8ebbd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970280, "uuid": "74da66ac-1184-466d-8ea9-657f633c950d", "comment": "Malware payload (Mirai)", "value": "0afb1d6f3665c4f85a2330a3413267e75ad59e7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970280, "uuid": "167a5c75-a3c1-440e-ad24-ac0c7ca6a30b", "comment": "Malware payload (Mirai)", "value": "384a334058bbb56479f9213887596764fc77db8ef02a117b962a80a5baf977028984d4b8c5550123f3b589f590e874ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970280, "uuid": "dfa27488-efe6-41c3-9bc9-fa34df159615", "value": "T14F932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970280, "uuid": "0b6a3c80-c9d7-4e39-9435-ed6cf75f5107", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2i:AGUJtkyYEETn0T32TDBf0nst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970280, "uuid": "68db655b-6d92-4d74-bed4-4b7b911933d9", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970280, "uuid": "0669a957-4874-4e3c-8d9a-f5eaee73c3b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970280, "uuid": "f063c4b7-dcc2-41bf-a358-312d38aea9de", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d231882-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970614, "uuid": "6216eb3d-52f8-4f8c-ad34-4075a3e0a138", "comment": "Malware payload (Mirai)", "value": "0aca252ddd10f37063d00e0790b48342", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970614, "uuid": "c005f743-cd50-4872-a3ac-bef9d94775e3", "comment": "Malware payload (Mirai)", "value": "337ef252b8b8398057bc40e96aeba807add5f5412bc33dba1f44ba1804330c5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970614, "uuid": "103d21fe-9193-40a1-ab55-475f5fd32d9e", "comment": "Malware payload (Mirai)", "value": "89f529255ee2351004375ce1a75fb63e2cf7d8e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970614, "uuid": "421cce92-1298-43f2-a357-6441961bf482", "comment": "Malware payload (Mirai)", "value": "016a4b59015561ddfbeea27b281f38ce458b3481c26061f9a8f080f1b1b00a8e843364d4ee557cfdbe03b1f17e9d3cf8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970614, "uuid": "950da3dd-6bc4-49aa-827a-fd67bd053ed8", "value": "T13CC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970614, "uuid": "e42fcae2-1b53-4117-a1c5-0606574f68a9", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPiO:LzhWutxBaORaebXQd+mzBzlki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970614, "uuid": "b3000253-195d-4a88-bf84-b5a1bcd37175", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970614, "uuid": "864abc73-9205-47c4-83de-ea89dfdb479f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970614, "uuid": "da9ad7d9-26eb-48e2-9c1c-ae3811d0b9d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a58c843-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "8c3797fc-95a2-431a-9322-c10a515f390f", "comment": "Malware payload (Mirai)", "value": "4078da7ce2668dd22739202068ef47af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "19eeb13a-fb56-4a73-8fd6-0498b88429b3", "comment": "Malware payload (Mirai)", "value": "34b89fa74bf1883ee82e826868cf2fe9ebbad6f316692c1d0ab43a65c9b12b47", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "d7c7b1d1-01a8-4f70-82ef-b1834e020df5", "comment": "Malware payload (Mirai)", "value": "62df50981c04272a728f99b8e9bee71e35d77d00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "40d32084-0ae2-4527-a866-54571e008df8", "comment": "Malware payload (Mirai)", "value": "92e7fe8f4f19414af530cb63dc4116ca0a9805d52b369a9419b4b44f7de62714d30d7063cdd12e0cfc7aa2d71f3373be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969079, "uuid": "14211ff3-6efe-4bbe-a147-bb0a19eda728", "value": "T1A7A35E97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969079, "uuid": "cf549f4a-aa99-425b-83b6-e77eb3fdd658", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8QkEa:ip3PSVWxHcqRhzhNPt8QkEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969079, "uuid": "da2901cb-1056-42be-a6a3-21942d1642fb", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969079, "uuid": "03b766e1-6707-4949-839a-2a6a9938d422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969079, "uuid": "72304eba-87c9-44da-b0c7-5f29ad18ca66", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8630cdf6-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972508, "uuid": "82529a2d-1800-4188-8563-e3287398d1ac", "comment": "Malware payload (Mirai)", "value": "d534ca2ed12ec6f3b8f40a6719ef5c98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972508, "uuid": "fce14899-9ff0-4951-ace2-27eff632c9c0", "comment": "Malware payload (Mirai)", "value": "359f19ff4fd6da59976b2614ca3c5439134529860e9c1973d4e21d4dc9f6c9b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972508, "uuid": "27f9bee7-c629-4f97-8706-89b014f14c4a", "comment": "Malware payload (Mirai)", "value": "97fb8745a3565cb1b176bc4ac9ccb74ad783d103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972508, "uuid": "45a9f03c-7ebc-41b5-bffa-9b68da4a67ef", "comment": "Malware payload (Mirai)", "value": "1c5424103391e3161503358543117eb4315ee11faa63b84c7ec97893fb06cf6c6ce3bbffc200d2763f7a0e9435d77b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972508, "uuid": "2090e45f-d501-471d-b481-c5b9a80fa09d", "value": "T161B3198ABC818B11D5D625BAFE0E518D33134BB8E3FA7113CE145B2A678AC5B0F3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972508, "uuid": "9882d74c-a7a4-4744-b3dd-37543f58994a", "value": "3072:5UNFRACQGY45V5qEaE6bW7CIIqHuxPRKshPAY9WP0jnjSDk0jHH:OlgEUa7CIXaPRxAY9WP07jSDxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972508, "uuid": "6bdcccbe-82a8-4f35-be12-363064fb62d7", "value": 112412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972508, "uuid": "e3c10abe-2a0c-4485-bef9-9fd27552af19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972508, "uuid": "de742e9a-b320-49f0-bb69-3e71e288dfe6", "value": "SecuriteInfo.com.Linux.Mirai.9853.8885.23802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2dc0ef-5a38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933461, "uuid": "70e21503-0a40-4f6e-9df7-2cb5d336f15e", "comment": "Malware payload (Mirai)", "value": "4588afd947f99a3bb57a4b8670f0f538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933461, "uuid": "ae903ab9-98b8-4669-9da8-4adb29f03e3a", "comment": "Malware payload (Mirai)", "value": "35acb12de36fd9adfd43acceabb9028ae144d9096311b54f938aca5d58a6944f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933461, "uuid": "27e4a378-85eb-4d5a-bbfd-3a79a09a9cf1", "comment": "Malware payload (Mirai)", "value": "dfd2a1d830db76de0e5c419d03f2243eb6d5209c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933461, "uuid": "debe57ce-a396-44c4-b197-ef6f1afa5943", "comment": "Malware payload (Mirai)", "value": "590158efa8c780504970870752911ff85c93468d71f094d986fd178ed3d908d2269ed84be258fc64813d2ba83c734a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933461, "uuid": "128fc87c-1b9d-48fb-a2da-69545d3edc70", "value": "T18CC3AD13D5213DD4D25844B5B0B0BA385373E86A698B1FF3A696CA32944BFDCB54A3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933461, "uuid": "bb6f4e46-bc02-4f93-92ab-d03137fcbdc6", "value": "3072:aEAbN2KuVaDd51sYQftnlV+DTAZQokun/Stt:aLbwykPf1zqfaKtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933461, "uuid": "389aebcc-9ae7-46c6-8e39-9ef76e83f2d9", "value": 120416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933461, "uuid": "27eda1b3-68ad-4eca-9194-9510705eeb04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933461, "uuid": "24730f12-ad6a-45bd-af05-70a8bc82b1df", "value": "023782pler.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32990e3e-5aac-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779983105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983105, "uuid": "7c5ed38e-b29f-493b-87ea-7c2f6104769b", "comment": "Malware payload (NanoCore)", "value": "6537d1e32a429daad853e0bb5f2f3b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983105, "uuid": "7d7d19e4-7aac-4f73-9313-d5097608280c", "comment": "Malware payload (NanoCore)", "value": "36115e96dd16090fa669229c36d861ac7cff249e5562a3a272e74db1b7da33e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983105, "uuid": "414cbbb6-b7b4-4c4f-a528-62252b0142f3", "comment": "Malware payload (NanoCore)", "value": "b43092291c15e90fd396e1bcebe8e69103e6c6f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983105, "uuid": "fb8c20a9-cf18-4776-ab97-b55b7f63d266", "comment": "Malware payload (NanoCore)", "value": "3ccbfee23ec103df65aace011aa913d964f0535b0131c61b94ece060fcdcd87c44647c58dcbcd2697e5b3165544f1eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983105, "uuid": "f131c4b9-c1a9-45e3-bd6c-0acefb6ca98e", "value": "T1A314BF567BA8862FE2DE8579611202128379C2E39DC3F3DE18D420B78F667E50B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983105, "uuid": "ef0d7ce9-d88f-4d59-b820-48002985f969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983105, "uuid": "36bb78bb-9300-42db-a4f6-64cf96258ef9", "value": "6144:MLV6Bta6dtJmakIM50G9lT9E6CvvHPfI2xt:MLV6Btpmk3GrBfCvPPfIWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779983105, "uuid": "61f03f1d-c5f1-48ba-8e85-8cd0bfe16176", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779983105, "uuid": "49b1ef8a-891a-42eb-a739-6ef8d988fef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983105, "uuid": "c063e5a2-70f8-467e-92ea-06f4f1b97e4a", "value": "coffeeandsuch.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dfa4ae-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "dc060333-2fbc-4451-98e4-1276456044b6", "comment": "Malware payload (Mirai)", "value": "5593d7ead032475bf4e65bfd4fb5a029", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "b89937a3-ae80-406d-a8ff-b3b831c17c28", "comment": "Malware payload (Mirai)", "value": "362a2b9c9ebd6569392d0c525e719d17aca3276da29e1a993c83deaa4ea6446f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "00f1732d-3bea-4f46-b1a6-a7d9c3562d6d", "comment": "Malware payload (Mirai)", "value": "26b559fd92abedc957683c1e0dc0d3e4600d5634", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "7c3b419a-c75e-467a-860d-8eebba334041", "comment": "Malware payload (Mirai)", "value": "a11f780086d4ab733f52a34fc4d05bf921755892968147e9fc05fa96ddffc4215fe3bdf7acffbbedd4ebe6adeca4f669", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "0da6be74-492e-4cde-896a-c6470654a5fb", "value": "T11C24D91A3E228FEFF16D877047F34A31976966D617E29684E26CD5102F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "f1f5a6fb-6d56-43fc-93cf-1525e8537bcf", "value": "6144:24cEawn6ID+L3Qpg4H0NQQ2nutCLLYg3XPUXRWW:fJn6ISkUNQQ2nutCLLYg3XPUXRWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973937, "uuid": "603e7511-8491-4bdd-a8fe-b2b4e654fee0", "value": 216041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973937, "uuid": "1ad8db77-6108-408e-a598-c5ec4e78e089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "7759b91d-8d8d-4cba-a5a1-31d463c21198", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80caee8-5aa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779980403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980403, "uuid": "b8de7d91-2112-49ea-b3c9-486735d4e695", "comment": "Malware payload (Mirai)", "value": "2e83eeaf35c32db3a9e8c4442e6b2390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980403, "uuid": "d82b450e-79c5-48ba-a91f-c1c95ad1eac0", "comment": "Malware payload (Mirai)", "value": "36776da9b2957c9b2bdf58f8b0c0a1b444896e35644f5bcbff357dd428791500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980403, "uuid": "ae474b59-b2fb-408b-a9fe-203052f24554", "comment": "Malware payload (Mirai)", "value": "cd49bd86868f32cee8a6b03a4c5466483ee1a768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980403, "uuid": "891dabe9-5988-4923-adaa-aa2d888ea9ab", "comment": "Malware payload (Mirai)", "value": "8f5b53bc9f5e7671b6b6ef76aab80626b63e6b8ca4b67715f73be8edde9d8f9099740dbe2380f52c448a9a5ad44dbfb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980403, "uuid": "1698f2c4-4091-40f7-8962-bea4fdcbea3b", "value": "T149F33A06731C0A47D2A32EB4263F67E083EFDAD121E4F644655FAB8A9171E331589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980403, "uuid": "e0d93ed4-bccf-4a10-92ad-acbf972359ae", "value": "1536:1seT09h5dKK+AeJcPl2n3RcI+tbFoxf+Q4TL1th2WIDFabaQCvAHpapnKBPxQbHY:BCv8K+hJc8n6tZoxyTrWDMbv7Jrio7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779980403, "uuid": "8badf5da-fe7d-48e8-8994-642204c324fb", "value": 161972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779980403, "uuid": "6a5edfd7-a505-4691-86ec-0f255a5d0e57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980403, "uuid": "83d57693-f34c-4112-a068-5900bc34267e", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f33c9d1-5a44-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779938405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779938405, "uuid": "0f02382d-ddc5-4e97-bfd8-a51e51c3e87e", "comment": "Malware payload (NanoCore)", "value": "c3db1215f116879ae1799ec7d0f09073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779938405, "uuid": "cf0d3e93-cf63-4da9-9049-22470e829ee0", "comment": "Malware payload (NanoCore)", "value": "37509ef29401d29e69288a7975f57e3787c5cb4122b95ae159078a396037f242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779938405, "uuid": "7fec4b6e-1145-4282-8bbe-2cf9d509ad29", "comment": "Malware payload (NanoCore)", "value": "5a151977bd4fbb82713fca6ddc6b185b48de9223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779938405, "uuid": "ac4aa7a1-1514-41d1-8795-63ec520513ff", "comment": "Malware payload (NanoCore)", "value": "47eb22094e516ee6c6a10a0dad184aac6362fcbb0eafee17a0e2a28a89aa4dff749e9f8f1538fc0985b812f3922065f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779938405, "uuid": "937ea69e-5e1c-4e3b-b75a-0dfd44a2f9de", "value": "T13814BF2677B94A2FE2DE8679701206525378C2E398C3F3EE28D855B68F167E5070B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779938405, "uuid": "2f9a41ae-b8bf-44d3-a1a0-24f49bf72968", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779938405, "uuid": "175e2555-3a1b-40e0-aa05-2d0495c63eab", "value": "6144:MLV6Bta6dtJmakIM5fBGmPDZ1ZgJB6QUWlvH:MLV6BtpmkqBGmPDZ1gB65Wlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779938405, "uuid": "4e45fcea-3d56-4b87-8420-f001941b5b7f", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779938405, "uuid": "0c2f7061-1467-44d3-af08-2b5d1a5fd278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779938405, "uuid": "f412e372-054e-40a2-845c-cdaa896e5eea", "value": "Nemo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603088df-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966431, "uuid": "ca9909fd-3c2f-449d-9c0a-d9b237cbdf73", "comment": "Malware payload", "value": "38ebeadaff475df53760ce13fa2546e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966431, "uuid": "b9544fa1-7969-49a4-8a0d-47b27b97cd7e", "comment": "Malware payload", "value": "38b94ebed7adb22db1bdedf58837df84c28c437bfa2922abbd26902b8dbad29a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966431, "uuid": "2c175e72-ca3f-4ed1-ac31-0491d8b93335", "comment": "Malware payload", "value": "c921976412170dc38e1f4e2fc63e4a9b44a72b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966431, "uuid": "ee43b9d7-4622-482a-ab2a-cbae0c163e58", "comment": "Malware payload", "value": "0cf85d2afe358909c24ceca543b618e4cd608039544e246198db83f722d4e3a0eb788a92b42c0b70c5079e099ae6da82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966431, "uuid": "e3f0d5d6-f039-43c5-9b69-5e05e24eca91", "value": "T1FB04123D3487144EC05ED97AA2E1D415C3F7B9BAEFB50A030DA5C32628FF9864985A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966431, "uuid": "f55aa5ee-ef88-48db-b977-2ebdc0f7b965", "value": "3072:rvdohC0M0rycJrk5wxpo4TD6e8xdhdYW+xcJRY00smlxPYpBtXtyg2ldoAX4:ahC0nrJG5wxpVTNyjdn+xcg0vqxSZ2TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966431, "uuid": "1aab478d-938c-4ccf-85c2-a54095824181", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966431, "uuid": "ee9c0d7c-78cd-4294-8a84-054ea70b517e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966431, "uuid": "5fa6d2da-1685-4b32-9dc2-3425516d405c", "value": "UMPDC(4).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1a4140-5ab5-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779987305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987305, "uuid": "f8e447af-02b3-484e-be88-61603e256e39", "comment": "Malware payload (NanoCore)", "value": "5429465a51c613021daf03fb9e791a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987305, "uuid": "9df73649-51ae-49e2-9680-a83776ea8d82", "comment": "Malware payload (NanoCore)", "value": "38cac999881944e48e997877535b8cc653bc2b441e8e7e8eaa5773207848df72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987305, "uuid": "05b5faaf-9409-4c99-807f-7561996a7b17", "comment": "Malware payload (NanoCore)", "value": "c69cb99a8412cfbddc90367bed8c466acc6da457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987305, "uuid": "c316c68b-4f63-437d-87c0-a87006ef7d2b", "comment": "Malware payload (NanoCore)", "value": "c3d4f8029d774e691028e68f37467227e83f6e80ab47114b044ab7e792f25293b0ab38ddc409c0aca99fc3516be9e34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987305, "uuid": "000406bf-6996-41fb-b04c-64b64c24e222", "value": "T13214CF167BA9492FE29E86BD611202138379C2E398C3F3DF28D464B78B667E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987305, "uuid": "25b9c8eb-c61d-4299-b909-59549a4e0bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987305, "uuid": "837520cb-a505-4fcf-895b-038f3f0d5813", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0DC/Ma/FfqL4m1FYeRBtm23t:MLV6Bta6dtJmakIM5E/BFCh1FjM23t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779987305, "uuid": "3d729f22-50b7-402f-9251-0aaa932fe4da", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779987305, "uuid": "b58f71b5-dae6-4244-a279-f8478ef6e096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987305, "uuid": "9333cb96-8dbc-4e44-9cee-d7027bc04f7a", "value": "nam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5802bd46-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "25c6cfd3-3489-45f1-ad86-5c48c8a73982", "comment": "Malware payload (Mirai)", "value": "82f36a0d272d4826adb910d8c8958862", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "f8fac3a0-3721-41e5-8b5f-53836a01d77f", "comment": "Malware payload (Mirai)", "value": "3aa00f4b86ade5bc8efdf4983296e5ef16de0eefe2c830f789ca3c4f80175bf7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "30ff5401-f50c-4a86-b990-aa7e7cbb1b66", "comment": "Malware payload (Mirai)", "value": "cf94a4db96045edecad628783a222f8dddfdf95f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "9c2a288c-5ec9-40b5-8fd0-039327ba7dfa", "comment": "Malware payload (Mirai)", "value": "92fbd9b5f155c2204c56d2624ffef9c0a3f942275e69f16826ef45b64c94b6a23ebac1e553028665b2bb2e80fa707e7f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "0acfee82-1a7b-4ffd-a29d-1baf98cef734", "value": "T1F7733B81F54B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "0ca9efea-be9b-437a-b152-74a9e2c46e9a", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+Zsb3SfFWLIk1Q9j+Lxty4AHr:uVFrPNQn+WVQ3EyVUk29jgxOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970283, "uuid": "63214180-b160-46d6-98f9-2fc3aea958fd", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970283, "uuid": "9bf2a7e6-28bb-43dc-8774-f890f4c6885c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "de982307-24d0-4d63-adb1-fd25b8fe95e4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77103db-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932325, "uuid": "780f3049-ed86-4947-a5ff-c5126fe3b0f3", "comment": "Malware payload (Mirai)", "value": "cb361fca587bc83d3d899f15dac4ca2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932325, "uuid": "e414e8ce-af45-4d29-bf9b-1b4a35449862", "comment": "Malware payload (Mirai)", "value": "3b2400bf0ef82de2cc6175ce362b4110eef2427d47f5c91927a7c12f8925a50d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932325, "uuid": "add3dfb0-1b73-4d6c-ae89-6101225293bf", "comment": "Malware payload (Mirai)", "value": "7673620f2cd504cae49b2921950a950cc348566a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932325, "uuid": "4085303e-f05a-4d08-99e1-1c8818153991", "comment": "Malware payload (Mirai)", "value": "651dc2d7d1358ff5a4815af2256c090ac6a5f8547856ef8a250f39a7aa0fc1874746d42024b873319b5a6183b1fb7221", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932325, "uuid": "f288d8a1-a62e-466b-affc-f917bcf64935", "value": "T1FF932982FC91865AC6D023B6B76E728D3322A3E4D2DF3207EC145B6527C959E1E77780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932325, "uuid": "17827efb-f3d9-438c-bcc7-b6ceb971442a", "value": "1536:6I6kSz5MeMlofoxxjR9tYTu137HDdLpF5HsUt0zxGo4ngBx8byPWj81JKIJ6btmW:4z5MeMlofoxX9tx9XgBK+19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932325, "uuid": "aba287c2-e98b-4246-a331-ec9e4e3f6773", "value": 97016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932325, "uuid": "fc712fd0-18e5-47a4-a9db-7fc9e3eaf4d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932325, "uuid": "99aa604a-243e-4397-b130-16d3291e2191", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a2d123-5a63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779951940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951940, "uuid": "b67e834a-2e5e-4c3d-bba4-d702e21c8799", "comment": "Malware payload (Mirai)", "value": "2ba0f2f12e3973dc5c9393d73d147dc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951940, "uuid": "7387dc88-9415-4c78-8af9-a37e2aab1d4a", "comment": "Malware payload (Mirai)", "value": "3b58f20629567352fde6a94ffa1f01db468726e05e1c7b27f3a0efb959db5b00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951940, "uuid": "e3665cf3-fb88-471e-bd18-11209cede0ae", "comment": "Malware payload (Mirai)", "value": "917d66b087f2854a6f8a911821a1c5bd99febc41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951940, "uuid": "dceba6df-730e-455b-abb0-fa8022080ade", "comment": "Malware payload (Mirai)", "value": "d6757cba9fafd92d99cbf07ca525065496803314550623378563b7e15493e1997387578b2b920a28321913079d1e1dd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951940, "uuid": "c88a10ce-b0a4-42df-b383-7b48c1fca2c0", "value": "T1E933024AABE34F05F55B16370946BD1B0AD0810DDDA8485283F415EBACFBFBD0728A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951940, "uuid": "e3944926-e87d-4020-a8b9-5beb1d7e1dda", "value": "1536:q93Z7mnvTUhjv5IF9CIVksyjo6oql1nouy8KyZ:UZ7wS75gWbo6zoutp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951940, "uuid": "07556713-caa9-420c-9911-a17cc6319019", "value": 52164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951940, "uuid": "e539a507-4af7-4a30-bc53-363cc38a95bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951940, "uuid": "2888f2f4-8b2c-44d3-8d26-49c6fc6fee42", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba8edae-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931420, "uuid": "e040a3d0-7504-4f82-a7ee-f7318ec1a882", "comment": "Malware payload (Mirai)", "value": "fdca2c314fdf21c708eae19389d6c5ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931420, "uuid": "e8264f0d-344d-4243-b47b-dcb9384ce411", "comment": "Malware payload (Mirai)", "value": "3c96c458be43d5102df1be7e67cd57c6dc6585aa243ca6b57ad7f5f5b260ea17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931420, "uuid": "505675a9-afe7-4abd-bd15-fe454ca54125", "comment": "Malware payload (Mirai)", "value": "1faba8f0417e3a77694717527ed4712b4564255c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931420, "uuid": "5e523686-26c6-45fc-a7c1-e7633a4fbca7", "comment": "Malware payload (Mirai)", "value": "44bac53640bac277fb0838cd9d6e6a476ed5e4d3e944c93cf43a30e7b0588981288407babebdbb0c2c9644cd20d68d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931420, "uuid": "5dc560ea-333c-4f8e-b665-e7d2823cddf5", "value": "T11EF33902B31C0A47D2A32EF02E3F2BE097EFD9D121E4F641651F9A899672D361585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931420, "uuid": "887cd155-b2ee-4063-bec7-6d8fa0decae9", "value": "3072:IXDRTPLRIPxI3TV4hFbtOk5bLcZs6hh1T2E:IzBjOxI3TV4hFbtOwH432E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931420, "uuid": "c4bf1af1-5b23-48ab-8bef-3da9bfa1b204", "value": 158808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931420, "uuid": "18a5392d-bf00-4e64-91b9-1f0222ce3067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931420, "uuid": "3f652564-66a6-466a-93d9-d90f0db7990c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b01a15-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969626, "uuid": "1167ce2b-4b13-484e-adae-3057b47e7eb2", "comment": "Malware payload", "value": "dc70c7785354b6decd9350614a0aa72b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969626, "uuid": "b009cc6c-ae19-4946-84c6-0f9d4b63a6a0", "comment": "Malware payload", "value": "3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969626, "uuid": "57262ab1-e300-4bdf-9f52-964f527b9808", "comment": "Malware payload", "value": "88f5585cb7b399e4c0ac3b361c3186c64c1b0fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969626, "uuid": "94be3884-bcc4-4bee-9d42-029d9f8924f2", "comment": "Malware payload", "value": "f0e928f94fa1445f676decec43e631a690e99341bed2c465e0268f7a05f17bb0dc704509cdf6db6f2d048f93b79ee379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969626, "uuid": "2ac2d010-6c16-4833-a407-d78da268b210", "value": "T1E1F59D55E3A501D9D57AC13CCA578213EBB1B86453B0ABEF1DB086765F23BE1223EB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969626, "uuid": "d6c1efcc-458c-47df-98c7-c7ee77987895", "value": "0df6317e90b00c7d768274f466155d58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969626, "uuid": "8ec04163-bb0f-4657-a8fb-d86adcc9f239", "value": "49152:BOjPWjFIU6iuTKuk2r8iGJpWwAYzvcT0wZ5KoBi/a7IiO0u23KsheDo0PTayMt9O:G+yupTA2H2lEoR+mM4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969626, "uuid": "f307c72b-5459-4023-87c3-d369bdea4c0c", "value": 3523072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969626, "uuid": "975f68bc-c6a8-40f2-a951-acce1bc7ac35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969626, "uuid": "cf71f1b7-e192-406a-8725-3f47a3310a47", "value": "3d08567fca302d9cecb1faaf90b757c0a9ba40fa7a19fe406b19cc2e33094338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadf794e-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961912, "uuid": "9fa4143c-602a-41ed-be2f-c89538a78418", "comment": "Malware payload (RemcosRAT)", "value": "e4bd219d7bdbc1b416d76aa158f728b5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961912, "uuid": "7e9759d1-556e-4f10-ab1c-3b25655e3a14", "comment": "Malware payload (RemcosRAT)", "value": "3d2429b694cdb23cf49733bfbffe193865b4b0cc1ad8c5dfe43ae213ab8d070a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961912, "uuid": "f53c5477-ba3d-4889-8387-7e17818ef7f1", "comment": "Malware payload (RemcosRAT)", "value": "6b1defae25a8ef00f07a9607f31d00206742e749", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961912, "uuid": "004c684b-a969-45ec-9d86-e4a1b1326b92", "comment": "Malware payload (RemcosRAT)", "value": "09c3a9fe727010a3d985515dd34b4022bf5110fc66ce2e6739a50a9fb303ff35716f98835e497be391bbe608402da73f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961912, "uuid": "cbc6510f-4f53-4599-9bf0-ac5f1e8c2611", "value": "T173630225A4CCCB3DE3C629504995CBF871A0E078AA8F9760FF321548B65ACDE51743FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961912, "uuid": "dfe020e5-35f4-4840-bc4f-4cc84d32e811", "value": "1536:DqJaPT+FMLs/BqnG+Gro2GtKCyVTzI8vQipvvkRTzD5vDcBI:4o+WI/Ahao2GttezItip3U5YBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961912, "uuid": "16ee7ffd-26ab-4eb3-95b5-6139f7a42691", "value": 71594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961912, "uuid": "a9389929-6713-4026-bd8b-cf4ad56b2c01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961912, "uuid": "09526d8f-610e-4cd8-a7be-586b236f159a", "value": "SE26050883.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdc5af9-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970613, "uuid": "9b43ad95-b00b-4ba6-bd1c-37014a7c85b7", "comment": "Malware payload (Mirai)", "value": "4a05204ade8cf69832f5a3cead35a47c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970613, "uuid": "82f75851-c887-4399-aa73-1ea2afc226fb", "comment": "Malware payload (Mirai)", "value": "3d50ec232752204a4f2b7577e2f2b105db1758b3384bc7a2b4f0f8b864fe94ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970613, "uuid": "6fc31800-045a-4934-bea8-98a56958d080", "comment": "Malware payload (Mirai)", "value": "80e4aa94715fd242d1ce08e2207d75818983e89f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970613, "uuid": "3bdbbc06-74aa-4566-9bb0-c9279758fab8", "comment": "Malware payload (Mirai)", "value": "dc5738b09d20fe4e3d621f650acc5403b41f5220187f814baa8efcb30b8f4889ce94200a59d1cee1798e1965bfc00076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970613, "uuid": "e56f9a8b-b05a-455c-ae3c-e7eb9b20e938", "value": "T1ACF34B47B7208FB1C368967109B3CB67A6E6269216E19985E66DCD107F3035C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970613, "uuid": "c506238c-2162-4d01-b70a-43c8a6582680", "value": "3072:93VJgTdgahP/2o/ZrTheIsnjCWRXFm4UpM1wLxpPNNOziHhfam:9FJMgWPZr8IaCWReS1WpPem7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970613, "uuid": "668c2296-a034-44c6-9411-3695b501a178", "value": 166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970613, "uuid": "68f1c74f-f164-4732-a5a9-d9893452c0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970613, "uuid": "7ac02d25-55cb-44ee-9490-9e6a7b3b44d9", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d1ee2c-5ad1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779999027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999027, "uuid": "34cf9acc-1c7d-4a43-9ca7-78305717e113", "comment": "Malware payload (Mirai)", "value": "fb950cb87020bf7105072849a49fc99b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999027, "uuid": "dee748a1-d074-430c-b414-306da3ca7dc2", "comment": "Malware payload (Mirai)", "value": "3dcfc705e0f80bfb3c38e5b7247dd72b817020146af290df8ec2e9d8c1358e48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999027, "uuid": "1287488d-e959-4b65-8fc8-f10d0cfcf6e3", "comment": "Malware payload (Mirai)", "value": "b6918dbce4855dbde3a2874571e3ba59d0c79a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999027, "uuid": "5b90f152-c6a1-49b1-b9de-f82f9a4eb108", "comment": "Malware payload (Mirai)", "value": "72336e5ec28f23a0cfd03b83f9c80424ff17d08240ed622728970b9c3f882a166bf7ae9dfbc083914b7d6e41d5073629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779999027, "uuid": "f01be22f-f823-4a9a-be43-aa68feca0197", "value": "T15224F909AB510FFBDCABCD3746E91B0128CC640722A47B357674D928F54BA4B5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779999027, "uuid": "7078edfa-3cd9-4356-a1b7-52f333b588a7", "value": "3072:cIFtAF72EZLw6AU0DOikm8QTgqmuTHBhxxKNnG94QipL:O2EZLw6AU4b8jqmuTDxcs94Qip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779999027, "uuid": "6dda1f67-3d60-4519-b982-4fa5861cf2cc", "value": 218920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779999027, "uuid": "e96cf9eb-39ea-42fa-aaac-3a900c8963f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779999027, "uuid": "1786828c-5fd9-4ceb-a704-5716854696b7", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb712ef6-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "12be42e6-ab53-405b-9ed5-bb09e6d8cc03", "comment": "Malware payload (Mirai)", "value": "cb4120705312a994ce3f690fcdbd44e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "7bbed212-b00e-450b-9dda-0c8852224d55", "comment": "Malware payload (Mirai)", "value": "3e224e0c2102d217788c8fe029fc03326547a20892d0c777599394082129da91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "87ac9a37-2c01-46d5-8897-591747244507", "comment": "Malware payload (Mirai)", "value": "4626deeb16a60497225bfd81a9579ba165433041", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "9508c6d3-f621-47ee-8a38-b7aed6a57cc1", "comment": "Malware payload (Mirai)", "value": "586487dbdafd996c9cca9876a3e9d7fd015e14358038624dfaa99f91953e37a0e0dfaf1be0a494501bb9a18d23c15afb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "151572f5-a88e-4fa0-9f02-1916bac7c656", "value": "T1B193D609BF650FF7DC6FDD3706A9170625DCA51A22A83B367534C828B64B24F4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "fac9b4b9-4573-416a-8f50-0794b14a4819", "value": "1536:La7KczAbVQNE2N+EYgLjYK4rb9C2h8WXi7ZcupBnacoR2J:27vzAB0E2Crxjh8WS7vahR2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970960, "uuid": "909545d8-6697-4764-9b35-b15c144f5c1c", "value": 93076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970960, "uuid": "eaf7d12c-dfe6-41f9-a67b-86661a42310f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "216b5061-1c48-432a-9e35-fa98704d7ff9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85745aa-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "304e03a1-9497-44ce-9df0-29de175a3677", "comment": "Malware payload (Mirai)", "value": "67919cfb91dcb1b82e4b6dab274ce559", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "0c8a5988-225b-4f9e-ad20-1563fb36bc7c", "comment": "Malware payload (Mirai)", "value": "3ec1e20c41d4ad155878e85ab81a0a86c6de42bd64af34c6879799ab34a6567a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "5942d94c-6051-4434-b12c-7d27d5659796", "comment": "Malware payload (Mirai)", "value": "e13a697c5fa562d709450ec10a2758c4652e52db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "e34708cc-1f2a-4699-884e-685c2dcd2055", "comment": "Malware payload (Mirai)", "value": "4c7823e374e0b33324440892bf2b128998c355e9dd2e1a57092927d2c1e4db7960520d0e5a4360e5b414bcc6e2d74a42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973934, "uuid": "803ce6c1-e59d-4c27-898c-2a8b7a542693", "value": "T164C3AEA7B24F1450C82547F81BCB5B9D2A3315019D2B5AE77C2E733E6A375DB68023E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973934, "uuid": "e63153d9-0179-4ed0-9507-67bfa04cd4d6", "value": "3072:pNYw76zmr3GFEbVmtH+XNG1qaq1agLCfW65nYTq:pNYs23Fm4te8caafCfW65yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973934, "uuid": "3e419187-f76e-40aa-929d-416eb40af7b5", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973934, "uuid": "3962ecae-2074-4049-b285-b21db370ec91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973934, "uuid": "91f0c3b8-f670-43ca-9cfe-05979da2d200", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e10109-5a30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779930141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930141, "uuid": "c0ab6c9c-dece-4e68-a273-0a6dcc7747eb", "comment": "Malware payload (Mirai)", "value": "22477d7ca6f731e0d0a0c439e4aa7c8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930141, "uuid": "f41d64c5-251d-43e6-9ef9-3075d289fcc9", "comment": "Malware payload (Mirai)", "value": "4013543248e5231856950551fd32a7a822a36adc267836768764490899b75a38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930141, "uuid": "94de7e21-80fe-40dc-97be-0cf5f686fe21", "comment": "Malware payload (Mirai)", "value": "accbaac8fd9d2ba9faa599fddba26268a65c9bee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930141, "uuid": "fc723abf-a75d-48a9-9300-57d6adc3c24b", "comment": "Malware payload (Mirai)", "value": "9a0d88635a674b9cde232f948e81f5a749c8f349bc3a0e5adffa12747b4cd2ca2113e9118c1d67598778af5c52f2e602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930141, "uuid": "964cacd5-963d-4704-9784-46bb51076337", "value": "T105C35BD5F643C4F9DD6305B52027BB378F33D0BE512AEA43E3B859229C61A01D61AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930141, "uuid": "2686d5b8-2df4-4151-b732-3c1dc1cbd9ed", "value": "3072:DctTn4KasQqsSNHi48fQdt1DBnuCt7KCXgrI4mFhAB1RBAT:4b4KLPXNC48fkt1D/94mmBAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930141, "uuid": "db99692f-4abc-468a-8b0e-5e0e8fc0c820", "value": 123272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930141, "uuid": "257e0703-b43f-482e-b094-dc2730926161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930141, "uuid": "61bd8224-b664-40ec-add4-aa4ce32c6ed6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad612fd-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "e6f9786c-c65a-4210-8bae-a0f17c28ac60", "comment": "Malware payload", "value": "450b01e53409b3b542e33cfdc3ed66b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "556c7fb3-23a3-4452-87f0-8f84880256d7", "comment": "Malware payload", "value": "403cb03ab078eaa2af60bec7f99486ae486bc477a2a6c46ca780343d969641a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "1344447a-74da-4fd0-92f7-ec2e12ab03ca", "comment": "Malware payload", "value": "5415a71b363ad60bff3cb6585c3587f7c4cc2082", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "2f8bff15-b205-426f-82d4-03ae048ab677", "comment": "Malware payload", "value": "406e422f176a5f137875e9947b8e65c44c25625e4d5abbe448caa0227d8232d2078a92ddcaba8a35ec65effd3d3dd358", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969026, "uuid": "ba5638e0-7f8f-45d4-a840-303a52e67138", "value": "T16B21AF9F4002A4312A245D03E197219CA1049D9BF56A6A1E5DCFBE36C0BC70FBB3A649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969026, "uuid": "3448e292-7c42-42f0-9ac8-241d5f5857b2", "value": "24:c1SSQSWo14KpSfMNBoSNNIHJ2y+FW2BYXPyYtVIz+XK6hJE:cfWjBI7I255BYXPyYt9K6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969026, "uuid": "b1bac12e-2ab4-4358-8e66-b9f7dd96f0e5", "value": 1203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969026, "uuid": "7919027b-a820-441c-ba8e-2f823e839790", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969026, "uuid": "2fc255c5-acdf-49da-b3cd-7e08c4b8d711", "value": "adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e80e1b-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "033180fb-9c95-4f6c-962a-e383cff4be8c", "comment": "Malware payload (Mirai)", "value": "01bad1670102ab1d37ff0d9140219d07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "3164f387-73d4-4741-b5ea-2590817427c9", "comment": "Malware payload (Mirai)", "value": "404a51071350110929d95fb80066ac8b9030cf9c29fe13e49f9e0f3b52831316", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "8dd1a5a9-ad38-4265-bea4-3311be295f96", "comment": "Malware payload (Mirai)", "value": "c6560df4240f940efd3326dea7b5325c6fa45d38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "1ca19a55-b9c0-43a3-a297-778852fc0c36", "comment": "Malware payload (Mirai)", "value": "f1e2741d0a4d38ed35f308a4476944a87911ac14279614a8101520695dde3884b1a03f1c47dea3ba167b55003bae3901", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973935, "uuid": "65506f8d-f112-4c2b-85ad-e23e3b8e50c6", "value": "T142C31A45F8405B16CAC666B7FB4E438D772A1768D3EE72039D256F30378B8670E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973935, "uuid": "85278959-83a7-42b7-96e7-32e20c75596c", "value": "1536:t5LxEHhX9mOAAdWPD8eRs4VByeTNa+rC1doceOweoPRJAASjylXpwywmm2MhYMlM:2HhNmLLPDU46eBa+OcDRCAijhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973935, "uuid": "08e44f28-3469-423d-a883-d31a5dec8ea5", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973935, "uuid": "214c560e-7aa8-4ec2-a8f3-dbf4e675c394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973935, "uuid": "ca234f00-dbfc-4bad-80ed-269911784653", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1ecf4a-5a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934130, "uuid": "97cfdbfe-db0b-4538-9ef2-0bd4819b1eca", "comment": "Malware payload (Mirai)", "value": "659ec062634f3280e9babf0b4979cd47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934130, "uuid": "01221c89-5f11-4356-b39e-1ee89e6c9f5d", "comment": "Malware payload (Mirai)", "value": "406250a4c95bd15630687dca53e24ada4474a8d466d53012811ddb4a6fcab0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934130, "uuid": "9e934a2a-5b6a-4e40-9785-fa8287c3e373", "comment": "Malware payload (Mirai)", "value": "a3f006f939c12bf7f3cc1a8a050b0186d425ec8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934130, "uuid": "66b90ce5-988b-4d28-9173-a94acd6f73af", "comment": "Malware payload (Mirai)", "value": "7f8d5c1f44096d0f51d5828308aa247ff66104d881459ff48c616aae04bd90f863fd7f4019c8c2395b7e383d32fbb430", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934130, "uuid": "8fb61ba0-3009-4c9e-83f0-f42f33df65e0", "value": "T146645513D9154991E1658CF3226B3285AD4B83BF88E732D3ED5A4AA1FF2141F41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934130, "uuid": "bd900eb9-2209-42b8-8ba8-124f4355b696", "value": "3072:XZW/F2L9ytVVWzj5meRX0lzxKUzYe+joCFjg:XZW/F2LMLGX0lzHzYbjomj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934130, "uuid": "d53abfcc-5fff-4ebd-a67c-bc97e270a9f7", "value": 328596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934130, "uuid": "71764e2d-0d7b-43b8-92ea-4a9c85259723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934130, "uuid": "816670b1-673f-4286-a102-b6b372d8740e", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94815b4b-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969955, "uuid": "5d81389d-2454-4a77-9015-c36153e1d940", "comment": "Malware payload (Mirai)", "value": "40c329379367b25dcd9006cd4a7119d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969955, "uuid": "99b093f7-d38b-4f76-b827-88e56e6dfba9", "comment": "Malware payload (Mirai)", "value": "406e43215ace0e7565a5d476d88f6b38e09b4bd59c8cc8414d9ea622ec591a1f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969955, "uuid": "1bffc383-ce1b-4315-861a-3bb96e3767be", "comment": "Malware payload (Mirai)", "value": "578f808d02f914a8be597b3d0ed145683d66f1dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969955, "uuid": "54084882-4401-4738-a160-8fad4dc959a2", "comment": "Malware payload (Mirai)", "value": "8d59fc2a3da5b53139fce95f5a61f993c0cccf9eaed7f538297a56859f03983d3d7e7464ecd64b1e2d9cc3a854ff8a52", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969955, "uuid": "7d9b86b9-8edd-48c9-ad22-5c985e5417ad", "value": "T1A41154AD41C5B881C89CE5397692C11CB08147CA15BF5AA46F95057E65F06EEB131F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969955, "uuid": "14c75495-42b5-48af-a88f-54bd9fac9bd3", "value": "24:kXWWaXD5fWaXkWaXDWaX69WaXLWaXWWaXpWaX1WaX4WaXedWs:kXWWaXDhWaXkWaXDWaXiWaXLWaXWWaX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969955, "uuid": "e27b9193-7bce-43d4-9a78-833a0705f9a2", "value": 1083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969955, "uuid": "13f40a39-1303-47ac-9945-09dbefb2e883", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969955, "uuid": "5f3a2aed-0667-4d04-a456-dc08cc03595b", "value": "bork", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaafcf2e-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "1ba4b6b0-c31e-4635-9f21-2d484bd8d0c1", "comment": "Malware payload (Mirai)", "value": "a81d87c1a09b91d29d9ce2bdb6cb5316", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "72918361-b437-4a8a-9ce2-e35d4322519c", "comment": "Malware payload (Mirai)", "value": "413fe4559296146aebb6bce58229be50c8dad4c6d271ad5888443fce352060f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "58b2847b-662a-4fd6-ba80-5d3c4cc1cdac", "comment": "Malware payload (Mirai)", "value": "7ff497fa15cb727595925ab8f2d68a60c8959f5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "c825ce11-07da-4520-9dd7-02d0beafaab5", "comment": "Malware payload (Mirai)", "value": "3675f499b0bc69fd19385a2e529436aa1e7cd885b4b0eb43df9f6426627f24befa91d9e733e51f8491cb1f1714a4bf6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970958, "uuid": "65cefdfb-6e7b-4e86-801d-698fb9d4142f", "value": "T132E33B46EA414B13C4C61776BADF424533239B6493EB33069928BFF43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970958, "uuid": "624c4468-9e74-4b80-a4a8-246fd132ecda", "value": "3072:8f7cFG4hTDxsa2axL2cGyerAxRuHpbaL4GXA5M/9MINBp:4c04JDujaxL2cGyesxgWL4GXaM/9TBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970958, "uuid": "0990ba19-1cb0-4e55-bfe8-f2f320deba56", "value": 153741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970958, "uuid": "b19e66c2-b0aa-4f20-9e7f-c9f8b50372d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970958, "uuid": "6ac71dda-d0ec-4ae0-9876-135f01f147c5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adee8fe0-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970427, "uuid": "26c2034e-c645-452a-b3f2-dc4799f5daec", "comment": "Malware payload (Mirai)", "value": "52d5a5df83b2ef50dae6ddce743d27f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970427, "uuid": "8e5c2997-01fd-4849-b4f2-de983cc9af7d", "comment": "Malware payload (Mirai)", "value": "41b3f05184e6af053dc011b6316c7d9c0bcb5264bb8618d59ef880246037195a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970427, "uuid": "97f6268e-e5fd-48ce-b036-8186f70681b1", "comment": "Malware payload (Mirai)", "value": "68169e2eff48ac62b6c6d52df10cbddff7482e1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970427, "uuid": "5ba37608-bf74-470b-98a6-01da59da5e42", "comment": "Malware payload (Mirai)", "value": "1d07b0039d92ff514cc5af6d3ced766f4475504d8eeac1d2c37fe29698b8380dad59e52992b7fd68d9041fef620709ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970427, "uuid": "1ee27b57-6c5c-43cc-85f5-6d6ec1afcaf5", "value": "T1FFB3198ABC818B11D5D625BAFE0E518D33134BB8E3FA7113CE145B2A578AC5B0F3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970427, "uuid": "fb9d3960-ccca-44eb-95e3-f3f94364010b", "value": "3072:w1lRAo0+WPP9JUnQE6O6Dfi4s1k9hwM7Vyr4dWP0hNeCDTUjgH:lQn2/DfiDAhwk44dWP0XeCD+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970427, "uuid": "95ce4b39-2e2e-4c98-bddb-425a1ed989fd", "value": 112412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970427, "uuid": "35fddad1-4290-432c-b622-b80a9e49f20d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970427, "uuid": "a6063edb-b813-41b3-b2a0-2a1e2ac5d021", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c17d9e4-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966478, "uuid": "3d047f34-5a34-4cec-8123-76a1a2e5459f", "comment": "Malware payload", "value": "bae189688c5c3b7c4536e9e28fc56527", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966478, "uuid": "05162720-d51c-4670-9150-c21b85b53c7c", "comment": "Malware payload", "value": "420d041ce5a22fb1a7fd57e0d8f3ee5e43f87a161a860ebffc3b0f0241ab24e5", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966478, "uuid": "57e9c879-1400-48b2-a5a6-84e6aca07d4d", "comment": "Malware payload", "value": "383b964e3f34ddc21f4729796184df09bfcd324b", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966478, "uuid": "6cab577f-a6f0-4385-bfd9-d103cfe0e27d", "comment": "Malware payload", "value": "9e95e23365d783d0dba58d73c03593e00089b03d5cd58e010dbabfa2d08911f8678057beaa4aa2029eb9c81a5a1b26c1", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966478, "uuid": "5771fb51-6ad2-4229-8a94-440c695704e4", "value": "T178F5333573EF0C99CF0E48D35688CA68F272227E0E6958453696545A63B3C02DBA4FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966478, "uuid": "a878fdb1-e289-4eb4-9676-2fa94cfd91f2", "value": "98304:jjG7cL06LjXWNgNRPXsjt3AqSoymP3uZZfRr7b6KEa3:jjPL0mr1RP3NZ1Rr7XEa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966478, "uuid": "6d805e0e-2b00-46fc-ae49-d72b6b7d7d7d", "value": 3578618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966478, "uuid": "f7f50a44-bed1-4c35-9270-99ae365dfedc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966478, "uuid": "c2c0dcc0-0ebd-4d9d-aff1-121670c6c5a5", "value": "dk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0524a4ba-5a42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779937502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937502, "uuid": "8827ca96-6f7d-4825-ae8c-405129d3c4c4", "comment": "Malware payload (Mirai)", "value": "8186fdf52e719f45020826a544ead8cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937502, "uuid": "aeba0ed2-fb3d-4ef7-87f5-a2c7d2b2d76c", "comment": "Malware payload (Mirai)", "value": "4249ad9796e325144554b79cc6b7036789a500078e048f7e3cfbc22c91fc1a70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937502, "uuid": "9a08d0d8-f1e2-4950-afc3-2c1d1b62bbd6", "comment": "Malware payload (Mirai)", "value": "d162160bc10b01f2bb755283dd96a999f49f47fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937502, "uuid": "893fc43d-1256-4702-b907-3a56cee1de78", "comment": "Malware payload (Mirai)", "value": "54cda4ad6bede75ab40feced97b88261a35127e53e3b84a58b610f5b497b36ce6547ebe602d07b8abf253943fc74fc6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937502, "uuid": "5b6503ce-e457-4691-b003-bd46bd012fe8", "value": "T12B04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937502, "uuid": "b22d1f0d-af8b-448e-be63-7ab4ad729ba2", "value": "3072:jg57R+7LHZwbq1YSBan1yvbysxr1uGSgI:jglR+7LHZ0Bqyy1BSgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779937502, "uuid": "07d192bb-a241-4afc-8958-59783c1b7803", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779937502, "uuid": "11a25834-d8ef-44de-9561-86f39c8c1afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937502, "uuid": "77555443-db33-4393-9ace-7a16e2844bfd", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2553d4f9-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "abb1555e-4430-4ab1-a1e9-d9b290ef7e1d", "comment": "Malware payload (Mirai)", "value": "677e81eb8ede24ab46026cc888368876", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "def3e55f-ed51-4ad2-b115-4e63cffd0d2e", "comment": "Malware payload (Mirai)", "value": "438a686a936ce1079d35992e8099fe5af58a528c963a4eaea43f5dc38025f7ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "b2118fb9-770b-4c40-b6cc-8a32c589f2c6", "comment": "Malware payload (Mirai)", "value": "baf7432422a87fde66d4b0f5575ce58ae608c622", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "181aad39-c89a-4739-9449-8dba063741cf", "comment": "Malware payload (Mirai)", "value": "992e6224486194939bb682f1cda24593f25f551ed09f02cf91e2b76c69979288447e1bca588c09d37eaabb2c7ab5844c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "306a1983-3e01-4206-8de2-4bdf807600e1", "value": "T127934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "27c048e8-5a4d-448f-b64c-2aa35cb2a9d8", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINnS:XGptyz+VJzB7T9/bLUAx9e/SBJOnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970627, "uuid": "6edeb59d-46f6-41f1-a0dc-6bfad22d44a2", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970627, "uuid": "69763e11-d86a-4c5e-b419-1d99a6c396df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "26e69442-03f1-4dd5-ac5f-c6187a3f9ca9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9b06c9-5ab3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779986044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986044, "uuid": "cf88dbf7-66fe-49cb-a877-4d9871ac8764", "comment": "Malware payload", "value": "524ede42d8649285a1757ca7af1cf6f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986044, "uuid": "a3660dd9-509a-418a-8316-cce8ffaef6ce", "comment": "Malware payload", "value": "43998b11d473dd4ddc92545ef21b5bde25d99ca31b7c6346f89ced93d9574002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986044, "uuid": "6278760f-6533-4a47-affc-d031eb75b915", "comment": "Malware payload", "value": "f251ad062205349a774dbdfbab98064e9913796e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779986044, "uuid": "7c53ff89-4c18-4ddc-9d3c-267d14ff2d4f", "comment": "Malware payload", "value": "d77da9fd2197b16b1e955ca808364e90b229baa71fbd09eb09e597a308df58afecd0b7a0682dd42a8bd4d7d469c78177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986044, "uuid": "80b5699d-d605-423b-b858-97a7760841fb", "value": "T1E0C58D4BACD108EAC4AAA33289B76281BB75BC550F3263C72E5072393F727E45D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986044, "uuid": "d6de0877-0823-47d4-b63a-d01fb0ce0af0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986044, "uuid": "909739f6-bc61-4de5-884d-09652fa99053", "value": "24576:kn0rfvyeSPCQ0lW0s8NhhEX0GN1JJB0TL261EgEs6FrP6dIOwcyDfFOsfnBele5A:knKf6ezQ0lcyTEX0jLbEgV0edGPsfXBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779986044, "uuid": "c14cf9d8-56ce-45c9-8067-f2705065961b", "value": 2558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779986044, "uuid": "7888a896-6fcd-4970-b8c4-5917b68e01f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779986044, "uuid": "cbfa05f5-1118-4ba4-a9db-3bb46236037e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79eb04fb-5a6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779955737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955737, "uuid": "e754e666-4e5f-41fd-a654-113083f05d0f", "comment": "Malware payload (Phorpiex)", "value": "f78e5e2ed6fc820ea5740e5e5baddf5f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955737, "uuid": "f0f2a0f6-4329-4927-9b45-df52870189e7", "comment": "Malware payload (Phorpiex)", "value": "43cd8c9024dd46ea2a8d5cb56f3e9e8f35d79c7fb2f77d384d600df83eeb69bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955737, "uuid": "0c0a02b1-d1ea-4d8c-b277-6f021703e54a", "comment": "Malware payload (Phorpiex)", "value": "09d30b98caf66712b589fec01e01bca36f6bafa6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955737, "uuid": "2ec06c6a-575a-4848-ade2-403d265bf2e4", "comment": "Malware payload (Phorpiex)", "value": "585b5c05fd7d4aaa237b7bc623a6f86233829bac89bb01444ddda7c3fac1322aa46c086a4560a0d5e9c949d7bbec5a79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955737, "uuid": "1797c86f-0375-484f-b035-a4dc4839bc6c", "value": "T126823A0FB9428216D1E210B05676863BD979987237C854DBFBD18A990FA82E5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955737, "uuid": "26bb080f-221d-41d5-8fe6-685ab22352a9", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955737, "uuid": "a9e87a09-b1fd-4ede-a313-63f348c9c183", "value": "192:CKSSCngTBv5/dVfTHD5DIS8qkle6I93fKUSvu9zw+ggSPCiMbO5Ot1EdkF4U93mW:UI5/dVf+jqk0RSu9JgPG7NWav8U9cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779955737, "uuid": "6259c99c-2136-4014-a7b5-83d2ee74b974", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779955737, "uuid": "88c8fd0a-77b9-46b0-bd5d-36eb76c89232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955737, "uuid": "78a18f05-cfc3-43a6-9a63-424840898ed3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12aba466-5a88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779967590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967590, "uuid": "d3eadf86-b1ad-4478-bc50-9f72cf1ea8cc", "comment": "Malware payload", "value": "b9e14de06bb087ac20ce3b2c37027e07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967590, "uuid": "844d8f84-7e99-4bad-8a1e-708bd49fbb41", "comment": "Malware payload", "value": "444571b5a27a3f7d1d8e263300a2d505e7cb90d6f65307ee3837935ac4e2e92f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967590, "uuid": "8ffeb797-3664-4ab3-97fb-4b36f3809f03", "comment": "Malware payload", "value": "e77c1e03a8dbc7e89e004921384b57598c151840", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967590, "uuid": "295281ec-eeb0-467a-a9ff-6ecac30cc016", "comment": "Malware payload", "value": "47083586ff2af4751dec0019fd4442684a586e16128a733f26812b9b41a5d3c08448fe0c2c9d666256cbe1178307d9ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967590, "uuid": "5300bd6e-4d34-4d9c-81cf-81c8b3ff3947", "value": "T141C68D07EC6559E9C1ED91318A769222BBB1BC495B2023D73B60F7382F73BD06A79740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967590, "uuid": "89413571-a72a-4cbb-ab12-990711220d6f", "value": "98304:1AisPF9YHMwY+dRoPNgv5aDl07OCnw8EIcp7rhwIOfFPt8moTXcTAyMDAN8JQfEM:1KYZY+DomY3v1Rp7mIuGRXMrKPJQfDa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779967590, "uuid": "6e2bd8e2-5811-40ab-b4f2-258c6d0e041f", "value": 12607823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779967590, "uuid": "317a4ec7-b93a-4d41-ac3b-e6e0ca206e4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967590, "uuid": "dd978f5e-4d00-4d9c-8998-9a2208f7a27f", "value": "agent-linux-amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76d25a8-5a36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932620, "uuid": "333e99e2-91e8-4abc-a4fd-72008c9b7b54", "comment": "Malware payload (Mirai)", "value": "4f4ad883055c38df49caa9888be03f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932620, "uuid": "bbad9bb7-720c-4efe-b958-9b8f7a8f683f", "comment": "Malware payload (Mirai)", "value": "445348b81ede730a3c9c43acfa0cc6d723335d3fb43f542fd6dcfc94726f2881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932620, "uuid": "e057c9ea-3feb-4a71-868d-1cd9ea6cf6f6", "comment": "Malware payload (Mirai)", "value": "2b71212ef83b5be84b8d038d233c72f4634a5961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932620, "uuid": "319954d4-ce02-4989-86c8-ec10835771de", "comment": "Malware payload (Mirai)", "value": "be582e10cee7d7f7ca96b989b29c0c363f2cb31cdc56f2da2e11f91a66aac316f72f0d6921dd591c2d5d505d75af14bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932620, "uuid": "8485873e-d9c7-404b-9f48-4a0bb6fc6c51", "value": "T189C34A47BA8044FDC459C13553BF7932C922B86E423A729BA7C4FD262D4DFA0163EB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932620, "uuid": "2b614a61-f6f1-436f-bbbf-e49cee5cc574", "value": "1536:7cbvnydBI8P8wt+p4Tq+JprPd5eSLlPkM3q4IUDZIPSvQ+9/u17NyNpDl9YMNo:7cbvnydB1+0LJp9pPpq4yPSvQ+sRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932620, "uuid": "0c26f4cd-8b34-4e80-b757-f3b6f0d910fb", "value": 125712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932620, "uuid": "45f412cd-7c8a-4ae2-8e04-70de51945d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932620, "uuid": "c215cad3-7d31-4e98-afc9-612c51258401", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcba4987-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779970506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970506, "uuid": "ffcc2e68-cf3b-49da-9410-d8e0abfcb3eb", "comment": "Malware payload", "value": "a65e2eb6e668aa84e3d8e1aae4dcb834", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970506, "uuid": "216d29f0-6710-4ade-a096-5adce6b23ed8", "comment": "Malware payload", "value": "448682ebd829c6c05dda879d4609106d8c115b80ac1df15e0f4d28dd7176c193", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970506, "uuid": "b281e40f-6eb1-432b-aea4-191f076e20dc", "comment": "Malware payload", "value": "beb7407affc86e48ba0dd9cb55ba24c4da519547", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970506, "uuid": "e82211e6-46e7-46db-a748-ef41b8b92635", "comment": "Malware payload", "value": "5e53c605c653649e0a0d0b0dd28900aa3ac015edb2e071db3d583395893e3c74bd782d416837fc4e8454820089978d86", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970506, "uuid": "5bcd024c-e373-449e-8c4a-d35f73415e51", "value": "T11F4633155ED67D3E3687C421B05E0682E95AB03C319E5E27B0AAB8EE2FE414DC0375B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970506, "uuid": "b258d07c-611e-4fea-a9ce-1b7b5eff2768", "value": "6144:+lziQ5oJCLUgpy9+RC9EOmcx6Vy9wls5C0dPwdESDXqcOYlPID2lJWXii1o/6nvh:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970506, "uuid": "589b2e19-462f-4bb1-8af8-723f27062693", "value": 5776593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970506, "uuid": "90b978e7-b9c4-4b42-98b3-74b7dab26f66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970506, "uuid": "f206e9ff-efe1-49a4-9d3a-57360c6f88cf", "value": "Dental records + x-rays.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed42ff-5a42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779937503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937503, "uuid": "ba460444-c153-42af-89e1-9db70ef7a192", "comment": "Malware payload (Mirai)", "value": "d9c8dedfa848d20825d50855004ac72c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937503, "uuid": "8b89d858-e402-43b0-8be9-16378131ba92", "comment": "Malware payload (Mirai)", "value": "4488dcbc1ba33c73a0b5823262bab81bc9638a4e47e7bab423ef7f5ca8192fab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937503, "uuid": "7e5a3358-ba03-43c7-967a-0a8e3b0518e6", "comment": "Malware payload (Mirai)", "value": "5eca6d8416e7ad68a684ebf167139de5a5183ab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937503, "uuid": "8173f2d6-e425-41d8-9de1-7fd40f864dba", "comment": "Malware payload (Mirai)", "value": "7f7f61765e3c4eccc35097a7c0ef9f127f9dae3bd61bd3fce09c17b4bdf27adea891fb5ddab99711706af0c2e64cb131", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937503, "uuid": "bd5384d8-22ab-4222-81be-a18474f2951e", "value": "T1C7C31B45FC405B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937503, "uuid": "f1ddce39-e956-4acd-bd50-e679265ab658", "value": "1536:p3Ka0rG5yC/cMChygtxOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQ1:5KaprMh7XOXWFh4UXwcFAa5xovW5kKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779937503, "uuid": "21d738e5-f8cd-42fc-9d0a-dccff5c3bcc4", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779937503, "uuid": "7f1b2d6a-2e39-44f1-9a25-f089418b2196", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937503, "uuid": "5af40891-2a2f-4e16-b1f7-9e145af1884e", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e606fb8b-5ac4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779993714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993714, "uuid": "cad5595a-8057-4206-8ad5-3bb2225846de", "comment": "Malware payload", "value": "ef895e2361c4610748bc0db822773034", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993714, "uuid": "ae2eb4f2-1c01-40ae-a724-873d81a1b850", "comment": "Malware payload", "value": "4544f0e53697d770eac70abad5790433d5e0b70282758c0b3383bf04a4f7f9ba", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993714, "uuid": "fe7e8db6-39e2-4534-bf67-ab2fb7f04b43", "comment": "Malware payload", "value": "32081ddf8934768fb875ff3c0cb4c858c4d2c682", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993714, "uuid": "42af440d-1b07-44ca-bf7d-472e6c3b27ee", "comment": "Malware payload", "value": "7a44f8354506cdd4d1f3140446e2a2522fab697f9fc53c2e91e48cd0a15c3fcb9cf103500cb4f099a6d82830fa671e24", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993714, "uuid": "e13c6207-1cab-4cfc-b34e-bf9528f4c713", "value": "T1F3D2A5B707287015E8F363B80F18F2B95F1ABC525E0A410584C94F97A31E3A5EC7367A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993714, "uuid": "4d64db03-b7d5-4483-bbd8-bdc00c99c943", "value": "d86a3374c3fe39b7f1f94b04aa81d5ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993714, "uuid": "5bce6049-c659-4e6d-898f-9a6c85093920", "value": "192:1VKth9gGg6gCE9u9u9DClFE9u9u9DCly6IUTl5nE9u9u9DCl:1VMyGg4aYYD0aYYDO5naYYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779993714, "uuid": "9d96d5ae-a396-40db-9110-bca29d9958c1", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779993714, "uuid": "04043b8d-2783-4796-ba7f-8459e41a7a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993714, "uuid": "598b73cb-574b-44db-86f9-730ae3fa1582", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65954eb-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931357, "uuid": "47399803-0d20-41bc-b9c3-b7801dba2b94", "comment": "Malware payload (Mirai)", "value": "1ac093118e59afc5ab6e671c1bb13be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931357, "uuid": "8cb856ae-9f49-4be9-a93b-e005b37ff092", "comment": "Malware payload (Mirai)", "value": "456cffb2ac5ed00a0303f5a2eb7648266bc7272714a352d62d82c5b54b01c7e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931357, "uuid": "e99a6ea3-a379-4796-81a7-cf4ebe5cb87c", "comment": "Malware payload (Mirai)", "value": "608c4d3dfda36849d0a157ed88eb71df0f96ca10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931357, "uuid": "0a200d7f-16cb-4769-b8e4-f0af8c9448d3", "comment": "Malware payload (Mirai)", "value": "3dfbdc65e902d3861b2ed3c5377e50d0ccf32f7ed4908270819977d2786898ed79f9a79d441e4c073be0c40a5eed0ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931357, "uuid": "79a9af8f-9c80-4f1d-86f2-7ce361e036ab", "value": "T133C64A42F60A2FE1CE144D33C5A74E6027762D442B31DA92D754F2BEADB23025F5AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931357, "uuid": "ae8bf280-0729-4a18-a414-dc47353b7f4e", "value": "98304:kZGdXW6Z4svPPo3x8agCd2L/vlhn54lf++91nz+SGuSU+gBJNolEt:kZGdmw/GN++91nz+SGTDWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931357, "uuid": "8e2953f5-a715-44fe-bdcf-3c3fc2cc0695", "value": 12517538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931357, "uuid": "e7307e9d-ad02-4c70-a467-e67e4205bcb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931357, "uuid": "eda6fd48-a404-4a88-9a25-0c36e5b9daf8", "value": "wife.ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690cb50a-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779949696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949696, "uuid": "c20739ba-0ebf-4491-b7f6-702f97c6fb7f", "comment": "Malware payload (RemcosRAT)", "value": "33062795b31ab7f727bb21a9c07c6d5f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949696, "uuid": "a57a07c9-aab7-4d13-86c9-1d766cce6c19", "comment": "Malware payload (RemcosRAT)", "value": "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949696, "uuid": "f48a3516-51aa-4e2e-9bf1-6b2ec133c573", "comment": "Malware payload (RemcosRAT)", "value": "56ae347da72e6f1990a1caa993296dfc58ea242e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949696, "uuid": "5b76ef5d-4c1d-40e5-94a2-d2f4ebe4759f", "comment": "Malware payload (RemcosRAT)", "value": "bf93db19b835bae43c30851596bd537097cd91693092dcfc06742f077ddeb17ee929aee1f180f8c2866414e71c2a65a1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949696, "uuid": "17a4269b-a7c4-425b-8bd1-231b8c164486", "value": "T195D33920DDE007790F4317BDFD851A21C5BCC629422290FDF6DA171DA11A5BCE7BEAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949696, "uuid": "1595c536-0d5d-4c46-b272-da4592f872a5", "value": "3072:vK3iCMeUMUYFmzVARGvZiv7A38oqaz4d808M9:ciCMepvFgA8vwvW1He808+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949696, "uuid": "f9756c24-2b66-437f-9441-d77517973484", "value": 140352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949696, "uuid": "dbc081ab-588d-46a6-861b-d54c32f7276c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949696, "uuid": "52eefaec-2a16-4209-8516-ade0a4b32b80", "value": "Gennembldes.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e9184f-5ab2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779985681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985681, "uuid": "99ebea75-bf84-41dd-a386-69e02ec3960b", "comment": "Malware payload (Mirai)", "value": "84c2f9e013a44ca60d2e577538d18ec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985681, "uuid": "d9869b4d-f18c-4e1f-b21a-229eed69c832", "comment": "Malware payload (Mirai)", "value": "45cedfe82f9ad075312a2b564643657f59af855dbfa60a33d6341f219ead9218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985681, "uuid": "9afb69ed-b06a-406c-9c69-f3b936b93dd9", "comment": "Malware payload (Mirai)", "value": "74b82d6f692ca97e7d8f51d692cc2e01b7716a13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985681, "uuid": "a459a2ea-11f6-4525-addf-2b2cdc21ff94", "comment": "Malware payload (Mirai)", "value": "a7ed5a8f3f5928cb5bfce0396b9d464b20fac7b42f376cc00d3a289dee780c1d1c1f9e143f8cf6660c125da4702aa820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985681, "uuid": "f7255a40-5138-4a0e-91aa-52f41198d9d7", "value": "T135F31945FC514B23CAD612BBFB5E428D372A17E8D2EB72039D216F20378695B0D3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985681, "uuid": "0baa2e66-fd19-42aa-93fd-608ad52a0ed8", "value": "3072:Ne92G+tkK89e2+zNiBOUw8pj4TcfoQzV3CEjEo8WqxSm:Ne4tz22IM/6j4TcwQzpCEAxWqxSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779985681, "uuid": "84491238-802e-42e3-aade-655cba6e5026", "value": 164928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779985681, "uuid": "caac86ab-6750-49c9-ada7-e3841faf1c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985681, "uuid": "c5f3a08d-2a60-4dc9-ac59-821b21d4f9e2", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ae6165-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970955, "uuid": "592b07b1-f382-4c9a-9ac9-f9ce00f48021", "comment": "Malware payload (Mirai)", "value": "368d996d48f52c03a5f6519421dcfa7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970955, "uuid": "056a9d8c-138d-470b-a735-73a02eb9233e", "comment": "Malware payload (Mirai)", "value": "4649bec2b1b098e3ed6a27f19f75fc6f6481c510461b852e72007426d3890861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970955, "uuid": "9c3044f7-70c1-4f37-9e84-54eec059a0e8", "comment": "Malware payload (Mirai)", "value": "5ed805fb9d79ca9e9b5d24ffb99865d9fde8b3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970955, "uuid": "a794ed08-afe7-4493-9884-19ead0e107e6", "comment": "Malware payload (Mirai)", "value": "c261efbc77cadb016bc051f7414da607891381a50282119edd031a4b552b5b6ce7055b55f8d9535856fcbbd6864c0a50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970955, "uuid": "2afa16b6-0158-4234-8a01-885ab035b0cb", "value": "T1D65318A5B4109C3FF82BF2B780570619B120A7E85A427B277667FC63CE7E1742822D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970955, "uuid": "3c21b01a-4801-4417-908c-d4eb53ac09cf", "value": "768:at5+Ig4+z8a+lb5OuStfj6rqv+AxoJ0h8nN222/6Vg3im1HumXVAZWL8543rE:WpM+5UBfnWAKl29iVg3PHuqVS885P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970955, "uuid": "d6367b8e-fddc-4a76-b3cf-8d804dd64b56", "value": 66200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970955, "uuid": "94526458-044a-408e-80a7-8568ebb31b3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970955, "uuid": "a1ed1a26-07d2-47dd-8a0c-08604c6fe487", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d98cd2e-5aea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780009806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009806, "uuid": "fdf148a4-06c3-4d69-8271-763e4e9f9c7c", "comment": "Malware payload", "value": "0d1f6685b4e284f92ef25c0f9358bcdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009806, "uuid": "93dae966-ad12-4210-980f-e0e3c9292acf", "comment": "Malware payload", "value": "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009806, "uuid": "b0cac8b0-fe2f-4a23-8f91-038e3d995c9f", "comment": "Malware payload", "value": "7d5c1d672d6e4bef1a7ca4ca9849db74e8690213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009806, "uuid": "6cd1eb4e-5d6e-43dc-9565-8c049ae467cb", "comment": "Malware payload", "value": "001fd5ebe89c1e29751b7eaed55a2a26cdbb2115aa93e201b18018a0ed4b8e66e526e8a7d99d21fc5fb1801f72f15a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009806, "uuid": "5fc07abc-828e-4125-b57f-eea24d759a30", "value": "T130854901FDD788F6E402563289EB72AF2735AC050F329B87EA44767DA93B2D50C36359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009806, "uuid": "fdd0a621-efff-4e51-9726-0153e6290adb", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009806, "uuid": "6ed0a894-db33-4847-bcff-ad50e3a2bd2c", "value": "24576:VLuVfhMWR8Lg/L2vJpBdOKuJFPrjTXIF4yb/nVVY0WtvJ1dZAY6VwYKGlkBGTb34:V6f4nd5LnWVhv4kB+bsGqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780009806, "uuid": "f5263e80-e7b7-4606-b60b-c2fc9e5e2d6a", "value": 1779848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780009806, "uuid": "0762b76c-26d3-4260-88e0-8d3338b0ff3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009806, "uuid": "99dc9151-786b-401d-9b7b-8e851ecbc24d", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4d14b2-5aea-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780009854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009854, "uuid": "d2ecb91a-7250-4573-bfaa-a14b8840dab9", "comment": "Malware payload (Mirai)", "value": "fe19069febd3c309e9234bff881a4f51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009854, "uuid": "32222a6c-7d55-428c-b037-5751b6af15d2", "comment": "Malware payload (Mirai)", "value": "48793b12913d40ffe92bd19da1c2fdedc355d961e40f8043e17832c331f9e13f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009854, "uuid": "5c36a8ca-a0f9-4029-8de0-552f2d8eea7e", "comment": "Malware payload (Mirai)", "value": "c50e47dba5fdb362141de5f912552676e5d7f883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009854, "uuid": "2c96d702-1ab4-4615-89cb-3799a6d56e4f", "comment": "Malware payload (Mirai)", "value": "f3af6275b69f3041dd2ae072ca553cff073b2eefbb4b4b8e54241b6d8473f9eb83dd1946e211df615981e59ea1e828b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009854, "uuid": "327d5487-fcac-4835-9251-8431d2b44ffd", "value": "T1BE930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009854, "uuid": "5ee3db0f-f0c9-4bfb-b4e3-69ecf762ae63", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yen:68NUv5nTacgzafVAwe4BNRIbT2gXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780009854, "uuid": "96d0b0b8-2e74-44a5-ac7a-6f2216607a47", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780009854, "uuid": "90f479ac-f14d-439b-856b-706ae3924fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009854, "uuid": "d161c291-0de6-4e48-a873-c85eaeba575d", "value": "48793b12913d40ffe92bd19da1c2fdedc355d961e40f8043e17832c331f9e13f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c81349-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "01500355-726b-4d5f-a76b-194697ba37d2", "comment": "Malware payload (Mirai)", "value": "84cde40f61e2567345dde3f1da8fe8ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "5f007352-d104-403d-857e-a626d22be8c6", "comment": "Malware payload (Mirai)", "value": "49419a84a9d858f753780d89c2f2f8d1cc762a62de740be6d5c1ca9fbff7ba2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "b48e911c-bb7d-414c-90ab-e140d9018009", "comment": "Malware payload (Mirai)", "value": "997c163741321e2bae6c2211b2bd8db82120af0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "aed63b2c-3638-4cd1-aaf1-f0463a1bb682", "comment": "Malware payload (Mirai)", "value": "b92894340d78042e0e448e69c3340a45346b94b4f23e6314a4461a1d459382c8d9be749c315fe9d6bcad225a9a9092e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "ea1a8874-d099-4334-a332-664d0c439ed3", "value": "T15B838D22CCB44DA8F12A7D7420B4CAFA4723A4449C0B6DFB3D5782A55057E8CF19EBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "4d509bcb-7e60-42dc-bdfa-c8966bcfe4e9", "value": "1536:qKHXB2vmzd/OAW3b2TMIxKS9cEPPhWYPyug+7ZR/Cps+hXU:qKHXB2vmZFW3b2Px9tRNPtdR/EsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969546, "uuid": "f5443c34-da81-48f9-a3c3-4f315a71683e", "value": 85616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969546, "uuid": "37df1ce6-f71e-4330-a562-8fba780ab55b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "5a19cb43-6c5a-4bd2-a0bb-2c529bb2b6f3", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6490f2e3-5a68-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779953983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953983, "uuid": "8bdce047-8913-4109-ae71-d605dbdb10b2", "comment": "Malware payload (Mirai)", "value": "86c98cd7374114c36a935f6809091985", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953983, "uuid": "455a868f-e45d-4a0c-8914-690cb5cf1841", "comment": "Malware payload (Mirai)", "value": "4971f532975084561c6a92fd7815114ca85df3e26fc6cd923a2615aa241731a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953983, "uuid": "50d0d03c-b3b2-4359-9b21-1d7ea38a4052", "comment": "Malware payload (Mirai)", "value": "5ed0f95a19234a67482ac0df9cbacfa173b77e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953983, "uuid": "2fc8391e-68fe-499c-8061-005b050432e2", "comment": "Malware payload (Mirai)", "value": "c5754c88f59e5b466bb99bc71fc4205bba51eb7a6ae64c418acff61de7b5962a6ea077a5b35234818aba6d4e86d5ebcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953983, "uuid": "b8c82eda-2fe9-4825-85fe-292b3e42276b", "value": "T13EC35C42B7080A47D5571DB1293F37E583AFD5A120F0BA89B94EDB0A4172EB7254AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953983, "uuid": "47bef34c-89e9-49cf-8371-062d46260926", "value": "1536:qt7D0UkvURI/Nsfz4jyr5AM7v3FXxKxNkzfr7w9vXqAV4fSKNB6lj/G5:qp0Ukv5/+rr5xXusrU9nDje5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953983, "uuid": "500b5701-4ea3-496b-9f78-8546eb9f5bd4", "value": 128648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953983, "uuid": "b3fa9474-8a23-43df-bacc-47f89dfb9590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953983, "uuid": "cccc4439-44e8-4d28-90e3-5be43a8219d5", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a933de-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969504, "uuid": "7c3abb63-2716-42bd-b603-b5d17b08dc27", "comment": "Malware payload (Mirai)", "value": "7c1e0a1e8f4cc117c16bef9707562b4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969504, "uuid": "809d8d0a-5c53-4197-b4dc-b0a850bfa9cd", "comment": "Malware payload (Mirai)", "value": "4a0d0be49341ad2b61ddc8800fa2d5131539a0d02b75d02fd3362605f5cbedf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969504, "uuid": "f9f5b5b6-38c0-4d43-ba86-340af3309bde", "comment": "Malware payload (Mirai)", "value": "68e4df246f99998f9328a9877a47cfcebe3308c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969504, "uuid": "4f551549-3589-4379-93a7-810c1047ff2f", "comment": "Malware payload (Mirai)", "value": "55a6a07e50ae5b08c51f8c7ea127e25f980f6d58b86befb1b2a4ce96116687af0e877a5b53705450c6da895c36af5b34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969504, "uuid": "762e91b7-6f72-4a61-8892-10ebc3fa39ed", "value": "T1F1A32CD6BC818B11C5D166BAFE0E51CD33134BB8E3EE72138E145B2E674A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969504, "uuid": "f20f196a-a087-4fc4-8189-53ac8961c41a", "value": "3072:WxCRAe7xdE06UmEE5kzgNj+zKql9LZML9y8OmGcDU5:xnmZEgNjLg9LZay85GOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969504, "uuid": "7aec88c3-18d5-4a35-9239-722e8cd2cef2", "value": 98400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969504, "uuid": "270f1908-15b1-4f73-bd5f-edad23ec5144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969504, "uuid": "3346a39f-6a36-497a-afc1-6c74e4d8f5d3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc877579-5a75-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779959714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959714, "uuid": "a99c536d-c3af-4338-a852-bfa8ea03e4b7", "comment": "Malware payload (WannaCry)", "value": "4015cf1950b7134bd0b98734eb3326ac", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959714, "uuid": "10adb423-81a8-49d3-99ed-a6fb6c8b5c9a", "comment": "Malware payload (WannaCry)", "value": "4a3a09d7b98a5a2bf7d87da376c74e0d98f7bf0262c2c07caa14db68ac026b0c", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959714, "uuid": "6d8804b9-bfe3-4df2-a50d-440136029d88", "comment": "Malware payload (WannaCry)", "value": "85ba0c21b48ca1a1c84c51315b2accb9e0724902", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959714, "uuid": "6462e14f-96f4-4130-8f2e-17c216fa11f4", "comment": "Malware payload (WannaCry)", "value": "c9579801ee7cee7ab58d2f626a29b1b239d8c6223181a27ff1fe08de73aab0c060cfabada532b850487713981084e70a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959714, "uuid": "06e7b6ac-dc3b-4024-8cba-23abc77d8834", "value": "T19A363394726C90FCE0450EB844B38D19F7733C5A6BBA4A1F4BC0867F0E53B9BAA94751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959714, "uuid": "4a1aed6c-9c24-46b1-8ed9-cd77ed3f49a4", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959714, "uuid": "6d2583b3-d1fb-4677-92c8-b8edf9e8bbcb", "value": "98304:DIdPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DIdPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779959714, "uuid": "05f106e0-7523-4e43-a55b-722c382938d7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779959714, "uuid": "f4f51db8-095a-47b4-b2c0-181c33f5a6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959714, "uuid": "efd55fc3-9d92-4ea0-a657-09e9d9f97394", "value": "4a3a09d7b98a5a2bf7d87da376c74e0d98f7bf0262c2c07caa14db68ac026b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e50880f-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "5c05ce96-92fb-4a90-88f8-fdeb43816929", "comment": "Malware payload (Mirai)", "value": "6f882840473cbdc11cb37cd10c9970f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "77481749-2998-4ad4-8bd2-ed6e0d8e6681", "comment": "Malware payload (Mirai)", "value": "4a9f5bc5e2270d1866d591ec58f99680df29d495d5e0d813987185cabff124ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "49781512-0473-423d-8aa5-37da974dad5d", "comment": "Malware payload (Mirai)", "value": "b2110ea20d6b4303f954e659b03205b5bb11e18a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "6ebcfc38-42c9-419a-9cd3-7eaf3d7292d7", "comment": "Malware payload (Mirai)", "value": "7d4556dedb006698734432095ea3b2ef349bf4e0db4cf3bad7d49210620b4cac9a69a062cafb854bd79a07a4e437c7a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "1748c174-fd5e-4092-a5c9-025dee8e6544", "value": "T16321AF04F6191423E5E13EB073372B655BA98F0326194908AB9FF69DD8B9C305A8D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "99650e62-e1e1-4141-858c-58bdfc6a5391", "value": "24:3WUpWS9nSWZ6S4/KSwISBd6oTKP5tAFlXMqzktIdKgvy5MaaTo0YGwueLr6JJ:GVgZVbXGADNz2IdKgvy5MloukrWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969032, "uuid": "09408f04-ac5b-412b-b17e-3af1c3b3b5e9", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969032, "uuid": "29eabe81-80fd-4711-a81a-e0e81be91656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "a4f25d07-2ad0-478b-82f9-9c8b691b3423", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8947c4-5a6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779957167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957167, "uuid": "a716bea6-a061-4114-8139-7426d886f218", "comment": "Malware payload (Mirai)", "value": "325b0a0234b26e02c687517050cf233c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957167, "uuid": "7f91691a-fb72-464c-aa68-2433ec58cf86", "comment": "Malware payload (Mirai)", "value": "4ad129438d29f124b95c1f01c0f5ccca7b6f2a89a9f65dc9a45d1fa48ad61252", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957167, "uuid": "51763d7e-051c-493a-a550-ada87c44fdc4", "comment": "Malware payload (Mirai)", "value": "69a37c4192d9447e6eb5322edcd32f3f9e0cf191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957167, "uuid": "1c00d69d-f1c0-4387-9821-a1e327305732", "comment": "Malware payload (Mirai)", "value": "ed0624cb79ab66b905884ace8093256c585ffb626c95628b1923e5fc812876c34e69da2d72a0fb1fa4625c69a427e601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957167, "uuid": "eb9becfb-0354-4b78-9203-4228f62e8f4d", "value": "T1FEC3BE52C4506CD4C26845F1B1F4BA395363D96861971FF3AA9ACA32A04BFDCB84E7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957167, "uuid": "86c5f163-9878-466a-92c5-9eebcc4767df", "value": "3072:RM6j4EIAgJMvAj5BQpMyzRmMbkZ/9hPlznjF:RM6UPJMvs5CCEHQLNjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779957167, "uuid": "01934902-9aa9-4025-9fb0-601d1edef778", "value": 120760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779957167, "uuid": "23ce8d08-97b8-4aa2-8e93-d15023ef6558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957167, "uuid": "9045ba93-5c27-443e-9d5a-3cea8e478bad", "value": "023782pler.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cef6ab-5a43-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779937983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937983, "uuid": "f8db4be6-4029-4145-b27b-d4bfb630632a", "comment": "Malware payload (RemcosRAT)", "value": "fc87d1bdba850ab228530a661200122f", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937983, "uuid": "da545028-ee6f-49fc-b188-39fe77bb92ca", "comment": "Malware payload (RemcosRAT)", "value": "4bb00eb0cd1e15ec069e479a6b42e746e6faf74f9b7625cd0c100036a0e592d1", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937983, "uuid": "8a92f51c-e70c-477e-acb2-8e995f44f9f1", "comment": "Malware payload (RemcosRAT)", "value": "df5d04714fa11dc2bc24fb2745825e2c00616ba3", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937983, "uuid": "92fbb730-7be5-483b-b93d-60cc42159a7c", "comment": "Malware payload (RemcosRAT)", "value": "f01ef05901ce555c183ed6ebe5a94cb1a5911d2e84b964513556d850cb921a0e26ed2e45296525799f4d1bdc8bfe343c", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937983, "uuid": "53d6de40-3061-4b98-8d06-6fa8d3617124", "value": "T1F3D34A20DDE107790E0757FDFD451A21C5BDC629022280FDFAD9171EA00A5BCEBBE6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937983, "uuid": "abdbe473-d4a9-428f-a2e9-5d0914894ffb", "value": "1536:6iSscvODY+oOPUykaW4aOZpOwfpSel6aXhi8S26vK4n+vgzyQDGAzoyM81cvS:j3Gcxkr4D5pn6ehi8SPTQkBzoV8uvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779937983, "uuid": "0b08531e-e98d-4345-9ca4-99f94e5beff9", "value": 140635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779937983, "uuid": "f8f35fef-a0c8-410b-be00-52bad4f4cacd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937983, "uuid": "488364ac-3776-4796-8d81-193a8b9a10bb", "value": "Herpaa.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392a1e24-5ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780006309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006309, "uuid": "858287e2-dfa2-4c05-afdc-f248282580de", "comment": "Malware payload (RustyStealer)", "value": "a305a45fba24a6ce040d9d45aab2d147", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006309, "uuid": "f6df5cea-aa93-499f-bcb0-4c54d6460bfc", "comment": "Malware payload (RustyStealer)", "value": "4c25af5791f7cad042fbfc6dca3ae78b7344c66f9f3a35853e76565bae0890f3", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006309, "uuid": "3dfe2c7a-2ce4-4a15-8966-6823798295c3", "comment": "Malware payload (RustyStealer)", "value": "6daa369997f5fedf4ce3cea09c3013075392f06c", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006309, "uuid": "8d64ea5a-7c03-46ce-bb9b-d91c686a102f", "comment": "Malware payload (RustyStealer)", "value": "c3efa80112c6bbdfb9776b2b35db1c6a577aa581804ac0850ba973e9d00b7ffd83fa8e86943722e8c4215651a2d9805c", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006309, "uuid": "c3e70868-7dcb-4c86-92d9-212c78c8c0e4", "value": "T1C5658E43E695C1ECC55EC078D7579B36FA32B88D093076EA27D08B242E16F816F1DB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006309, "uuid": "fc874777-1f72-40ed-984f-6cf7288ac5f2", "value": "c315611fcbcf6f6b48e39537f48d7d53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006309, "uuid": "0b0c8864-63e9-436f-8ee5-6eec1c3e698d", "value": "24576:IcleFMoBQ1GvX+3R5sT4/AxFl+D3abDEj5VIH06iy9FMO/:IbFMyQwUru+AxHccIIU6isL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780006309, "uuid": "831e6e5d-2d84-4733-86db-7992a77b3d66", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780006309, "uuid": "03af9a07-1b06-4cd4-ba9e-a6ec90f124b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006309, "uuid": "4366787f-0ad4-4c8f-a92a-d3c778eb3067", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bbf3d8-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972502, "uuid": "2eb7f1f2-d6a0-45b9-ad3d-f57fdf515803", "comment": "Malware payload (Mirai)", "value": "5fab3eb6ca036b0aba52d91af6747213", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972502, "uuid": "f22da959-b5c4-4903-b8ef-ac29b4cc8ecb", "comment": "Malware payload (Mirai)", "value": "4c311745ac1b89157373c783beee44ba9adb414a1deefd9c7c0d788ed472b68f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972502, "uuid": "a32ccfee-ad9c-4192-8b1b-bf4bf00822d9", "comment": "Malware payload (Mirai)", "value": "03ee33f35f19d52e7b7f9d24c4bd8482f9172669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972502, "uuid": "537349fc-78a8-4551-a795-396db94b7f3e", "comment": "Malware payload (Mirai)", "value": "11ec177c90a199fe801f71465e17cd94698d5e60361572f086f72245961fa3360fa248d559170d02998fb30326de3b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972502, "uuid": "7045d3d8-3138-49dd-8386-f295dbbdafcf", "value": "T1D1836CC1E683D8F1ED194134207BF3376AB2E9B901A8FDE3F75496329426AA0714774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972502, "uuid": "1f8afebe-458c-4e66-b73b-367186644ac1", "value": "1536:nfZsAtktl/Fw/q0uG5LqSig9BTpDW1U4DD+STTpfXiMYXblr/:fa+k/FwS0uG9qSZvTo15D+SHBy1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972502, "uuid": "1ed44faf-4ba9-45d5-8dd2-ad49cc309689", "value": 82096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972502, "uuid": "f440efdf-62a7-4be8-b470-784a062b0a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972502, "uuid": "ce07e956-7912-4d9a-86b4-6f2ec23dbce5", "value": "SecuriteInfo.com.Linux.Mirai.9853.4832.5832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7483340f-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972478, "uuid": "a16d28b5-6957-431b-aef8-c1a14a935b2f", "comment": "Malware payload (Mirai)", "value": "1a01ff2d0570866c32cd342af93babc2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972478, "uuid": "8318ef86-ad9c-4ef0-aba5-655cfd1b1622", "comment": "Malware payload (Mirai)", "value": "4c32dc36b29a82aa9a7c369310cf5d4711697867a6031b27052c850767ab05b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972478, "uuid": "f033f798-9727-4de8-acb7-839a3fabae09", "comment": "Malware payload (Mirai)", "value": "c07b16d56c6ecdd02116e3af9aa774cdc0102b6f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972478, "uuid": "e332433f-f3f3-49cf-acfe-9669d84f06d3", "comment": "Malware payload (Mirai)", "value": "9c2e843fbba88df166eabc84428f448f5256e782f86ba5eeb392d8f55658cb431f46e30553aff39f172f550414166d0f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972478, "uuid": "195078d7-99f1-44d9-81d6-9bd11b33987f", "value": "T1AF313ECF71711261C688CF0070F14EDAA3AED5E8E59ECA73FD590E6B818AD447019AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972478, "uuid": "2d12b1b9-a0fc-423b-8579-2cb69db82742", "value": "24:FUCdS3eD10dNgB5BBM/hpL4L1b0LAL2ws/76fvy5o71jsgKb8EJNtl4TmaHN:sM1ORPo722", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972478, "uuid": "44914d84-98bd-420f-8122-98c823ec7ef4", "value": 1730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972478, "uuid": "3b51dd4a-27f7-4b14-8bf5-9c8b55a3beb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972478, "uuid": "79059e93-0810-4c8b-9dec-dd68128d92e3", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f63447c-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "e58c51ad-4aac-4334-b857-62a783469da1", "comment": "Malware payload", "value": "30da72f35c6dfd5bf1e2db0efd842804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "ac11c4fd-a1d8-4dd5-8ba0-2b38dc247f68", "comment": "Malware payload", "value": "4cac2812f9a4df7947009b57a12d4854bb340d54fe2fb22e7f9d7474f39891c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "c11eadc4-fd2b-43e0-8c9e-482a23037c54", "comment": "Malware payload", "value": "cbddb37ad371fb9edca97eef9940f44c8612b118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "d39660fb-4f0a-4263-901e-a702d5819d00", "comment": "Malware payload", "value": "fbb1bcdfdbf424d307eb9dc14b423453a8c922220578d01c02ecd2cc48eaddfe6e256a8641b5e140afbec88bea2fd0bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "f6387d94-2c11-4c7c-9fe8-96c0fde1a5c8", "value": "T17675024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA61F23BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "b0c5c093-3e2a-443a-8d0f-b01f57ee9860", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "7ea5699c-5134-4a8d-9beb-90f7b4cced28", "value": "24576:0VLZKAyP5tmx1Y51t05ZtP7gQA+YXIySn46BKuKPmqsc80DM2jlX6cw:wByRh51t0jaBm4MKuKPmqScjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969034, "uuid": "f7fede96-4c02-4528-9424-237d8b81b71a", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969034, "uuid": "35d4f2e1-5fd5-4eea-af82-01143cfbb44c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "039e904a-f40e-4507-a3eb-8552d46e44ee", "value": "v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e601c3b-5a6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779956469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956469, "uuid": "15fcc3ef-0f34-45cd-a4c6-6554ee894e2b", "comment": "Malware payload (Prometei)", "value": "430087719002090e16caa38cadfdfa06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956469, "uuid": "118e36a7-a3c3-4ac9-b00d-34dbbb22ecc7", "comment": "Malware payload (Prometei)", "value": "4d039c8a8570724cee76221274efc873d8a5f552dc4336160e08bd47db2651aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956469, "uuid": "224efb68-7186-4ce5-9600-447959e49b61", "comment": "Malware payload (Prometei)", "value": "047b465face82bc57ad2bab0c9ebb58d4d021896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956469, "uuid": "de06b365-14c4-49e0-9650-0ca1bfd2d412", "comment": "Malware payload (Prometei)", "value": "7582ba686692a7a3630051432d9200ddddcf7aa53a9a5a3b3903d3fb6ba2b50a1c7355809dc0e21c046203629b95759f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956469, "uuid": "53e35a7d-0e99-4207-8d6c-91f3f12f6f9b", "value": "T12CA423B4F9219E9F6DD769F91B24831DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956469, "uuid": "fdb6b399-b221-447a-9355-df1b76c214ce", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdW:Fs6pyCC/Ya2hpi6T6N4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956469, "uuid": "bc391ce4-c36f-48c0-8238-ed518766cfa9", "value": 449087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956469, "uuid": "306220c7-1ed8-48c4-8b63-4e39d8fe5d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956469, "uuid": "a73eeef7-35e5-490f-9054-c468426efeb4", "value": "4d039c8a8570724cee76221274efc873d8a5f552dc4336160e08bd47db2651aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe22e3b-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970531, "uuid": "3759c85f-e7d8-45d3-825a-6fedb24b84e6", "comment": "Malware payload (Mirai)", "value": "3b46591b720cac3338af3c210a04d8d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970531, "uuid": "0d068ff7-f38e-4d5f-9a78-3d45187f3077", "comment": "Malware payload (Mirai)", "value": "4d5ef660842c09bf9f96dca00ed1d822e7742776fceb34695cd16bac1538a759", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970531, "uuid": "80376ede-0571-414e-98c0-b1ec7ad38ea9", "comment": "Malware payload (Mirai)", "value": "1120bcafad17dca677a582212da3675a4f51fbab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970531, "uuid": "dc9fc405-97b1-4f07-8093-b0d2b944b1f2", "comment": "Malware payload (Mirai)", "value": "9027af9d4b0bdc6bc3964e963df4b0ec5ba4d168e2f8082dd9afa4278667cfee219fd3a766bba506d5ea9b1c80fbf878", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970531, "uuid": "9716772d-68b3-4cd0-a3e8-32a06cb0be16", "value": "T183146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970531, "uuid": "f5234dbc-d81e-47c6-9bec-96704bb4ee1c", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTt3:BZAyFzQSdS7Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970531, "uuid": "928fabf7-50a1-4fb2-a184-f0dd22e6ce6a", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970531, "uuid": "467126fb-3dd9-4086-91e5-d66e5d828c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970531, "uuid": "5f39740a-3247-4ca6-ad6c-eaac418eacde", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb65386-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "f50573a9-9695-4ca9-8671-64b9ec21fa49", "comment": "Malware payload (Mirai)", "value": "693a3eb91e2f498678e0e6eb064b83f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "4f909202-ebed-482f-aa57-b92eee31585d", "comment": "Malware payload (Mirai)", "value": "4d6d506d4f803132fc85e7fd2fd9686ee4ac8da39bdbac5933337c1987a424be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "338c286d-7267-409d-8c0e-895b3cae7c2f", "comment": "Malware payload (Mirai)", "value": "cbe2d09e3188eceb4d71a5128b90fddb4809a18e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969034, "uuid": "e43733d4-6cc8-48d9-827d-6a337cf3c6d5", "comment": "Malware payload (Mirai)", "value": "cfa25dc314cc5683d2d3bf5789e39515a232e07096b0f55f78bb88b49f9e783637c56ecfda0181a213d4cd61e3ff22ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "f216d52a-bfa1-47b2-ab52-41db374fe1e9", "value": "T12521127FFBBB9616C860923A0E6333143630DD580015D27ABF537A1DDC21611AF852F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "2897e395-7eaa-4ccf-99cf-5058da67bb3f", "value": "24:3z/Dq3N0yTK+59k1N3s8MAQmlhCDjSkvFiJ9lGXrNTawqVU:3WVT38N3s8MhvO9cXrNu/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969034, "uuid": "51aec821-7534-4223-94ee-6463673bfc6b", "value": 1288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969034, "uuid": "cf9c1233-73d8-429f-b7be-1a89e30c8c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969034, "uuid": "02b12eca-cc4f-427b-be20-d31e972689df", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a95e2d6-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969911, "uuid": "48b7ef47-7498-497d-9389-346265a6b0a3", "comment": "Malware payload", "value": "cd8aa945207d98a69e97618453f951f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969911, "uuid": "be505232-f7e2-477a-8388-350ec8da6e27", "comment": "Malware payload", "value": "4dc243a6480098df728f2073430545d75e7c049058b53f7857a9e94c3e566ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969911, "uuid": "b4c928c1-fc0f-40c2-a3c5-8be8506fdc5b", "comment": "Malware payload", "value": "5b36ef397891982e71aaa3e5730dfdec3a6db6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969911, "uuid": "066114c1-c70a-4134-b9d8-0f9fef38c101", "comment": "Malware payload", "value": "1ad039b6ccb66b7e9805e8a0e6fc4c584c9d826b03102051c034daa26dee30840ba2557961ae4fe3d081edde739200a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969911, "uuid": "b898c8f9-9438-4a77-8c7f-7ff46fad73e3", "value": "T1C3447B15B7A50CFAED67863DCD520906EA72BC5647A0E6CF03A04E970F236E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969911, "uuid": "813091bb-4ca3-441d-9022-40d4f2318175", "value": "7e43b91f81f94c0b680ce92664a303f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969911, "uuid": "9b4f46b1-40a9-4435-a54b-d8f535002d69", "value": "3072:QazEEUE5oCstJOeTG1BE9q5Kw+l0gEtdC1/A8zckczm5yJvfiMojJ5z74:QgJ8ceTG1BEg0S7yQkciuHox0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969911, "uuid": "8327461b-505b-49b1-b9b4-61d835f60778", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969911, "uuid": "5e70edfa-1d55-4187-b417-6b44a2218b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969911, "uuid": "652c1cfb-c4e1-473e-8a5b-353d63b314db", "value": "4dc243a6480098df728f2073430545d75e7c049058b53f7857a9e94c3e566ea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22ee1bf-5a2a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779927538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927538, "uuid": "a2687998-6079-4937-b312-54a259177872", "comment": "Malware payload (ValleyRAT)", "value": "340263766e0ced21de8902425070bc1e", "object_relation": "md5", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927538, "uuid": "a0bf496d-7f4c-4d60-8e9d-c33295a00721", "comment": "Malware payload (ValleyRAT)", "value": "4ed636b326ee6fb52d8a820642afcabdacd2ae8a4449130101022349c4d4ae8e", "object_relation": "sha256", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927538, "uuid": "1fea5db6-72eb-4201-ad60-0d61f6875b17", "comment": "Malware payload (ValleyRAT)", "value": "39d358df6e06dc9bef0f42efc1d57ffc7b1ae659", "object_relation": "sha1", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927538, "uuid": "9ac93425-f073-42d1-bf7b-37cc6b2197a3", "comment": "Malware payload (ValleyRAT)", "value": "353e8b8e7c8666d1e93c2b1f2773e28d19d252521795d74ee9c4fd4f74171481f6bc158b4267c42cbe5515ee8d2e0133", "object_relation": "sha3-384", "Tag": [ { "name": "BypassUAC", "colour": "#E8D0B0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927538, "uuid": "cf88c61d-1cc3-4341-9766-121d728eff3c", "value": "T14B063322F785252DC45DC239AD7286012666ECE1B054CF8B4FD9FA0FAD74FC6885BE42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927538, "uuid": "499e90a3-b931-45f4-a815-417edafd2460", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927538, "uuid": "a9f25bc8-1a67-474a-b836-4813626d3b66", "value": "49152:wl8eO7WZsUCriKlHOehW6myUpRswrXL5+6HBWr0pK8cuJmSoED8kLB337T9kSDvw:wZ1J516T1Q5+6HUYp5Zxh3/aSDKLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779927538, "uuid": "ab2149d6-b645-47ba-a680-8d52d71edc92", "value": 3813978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779927538, "uuid": "812451f7-f0aa-4b66-ae37-d23c1b168e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927538, "uuid": "cad52246-e431-48dd-bc74-7f0216bec038", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5d3ea1-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779961917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961917, "uuid": "6af5fb40-fc61-4e91-a18c-343f94bb3309", "comment": "Malware payload (AgentTesla)", "value": "eaedc35d8a9ec365d2a068be2bf88e9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961917, "uuid": "53e8099e-f34b-4d01-960e-d90aa8762c3f", "comment": "Malware payload (AgentTesla)", "value": "4efa4ac9a374fe418483cab05c51c0ca2c3be58f8571ac3fe96d3ff8a44aa99d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961917, "uuid": "05e7ccff-8eae-4d9f-8841-99ec318754bc", "comment": "Malware payload (AgentTesla)", "value": "16fcc991c0ffbacce65f26b986be0ea05ceac6fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961917, "uuid": "f347cf41-0e07-447b-9878-37eda93b6892", "comment": "Malware payload (AgentTesla)", "value": "17250d99481b2e757524a0d2200e13087e2557224936eb013e732eed923826a5a140b66bbebf7de707f57ab72477f350", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961917, "uuid": "a30771dd-c44e-453d-9c48-7e37360ad04d", "value": "T1A9553310B6CD1FCBFA6A9899747D4384D90630CAB740E440ED7AA65393BBA6F130FB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961917, "uuid": "6be44d5c-b4b5-4edf-b574-5d7c245ee281", "value": "24576:j5ljc+Xe7nDNHW/1R7FTqXx2YlEcwDE7wSVzdE/GjSyB:l9wPN41N+xB60wetSyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961917, "uuid": "0d3d330a-1122-4b4a-a071-cb4965fa6ee1", "value": 1382225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961917, "uuid": "ef08d827-9838-47b1-91f3-3429d28786ae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961917, "uuid": "4d836a78-b745-4702-a0c1-ec7874ec58a4", "value": "ADS1K5-1XMechanicalXManufcaturingXDrawingsXRev2-180526.PDF.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec070dfa-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "fa93bb5e-ac55-42a5-8efd-5a50119ab3ed", "comment": "Malware payload (Mirai)", "value": "fd2f46d9c43b4bc73aeddc9e99a68889", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "3f29a0ef-620e-43f7-95f3-34804085c92e", "comment": "Malware payload (Mirai)", "value": "4f602183f6f9952076b497975e5456ae130c2272851cf5bc123645e429cea4aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "3116e65b-aff3-41ef-a63c-d7fd9727a546", "comment": "Malware payload (Mirai)", "value": "6279ddeaa8258ccce144687e4d45cbe61634e480", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "e99d9792-94cd-4cf5-aacb-2393e4b7d8df", "comment": "Malware payload (Mirai)", "value": "84e11b4ad2e8b91bbd8a042edd3949bd5eec0acd60a1cd1fe21dbdb16447e0e7bdac597df3bf2c7a05d4399ceffce614", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "644f408f-8fd3-4bbd-aa05-08abf68dc8ec", "value": "T191734B36BE761E2BC0D4747A61F34764F2F2438A24A8CA1E7DB10E5DBF24A4025536F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "ef54b4cd-1f81-4897-b1f8-e27ff98efbcb", "value": "1536:o62R0BqKmwgnZwQoILhIctJeQFEok58Q6o9ztDuZg:vzshLmcjjOoUJ9Fue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970961, "uuid": "0e1e670d-3da3-4444-9dd3-d66e1c0d4a69", "value": 75200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970961, "uuid": "af1d8da0-9d55-4df9-8d61-7abbe1a9ec2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "3fd1690e-f89e-4106-8091-02bd28996956", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d885d48e-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "9ba4a599-af7f-4aa1-aff0-57707905d02e", "comment": "Malware payload (Mirai)", "value": "56ca5abc0071e132ad1ccf08c6aaacfb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "2207c32b-2203-4a09-9ed7-2958cca1743a", "comment": "Malware payload (Mirai)", "value": "4f7f2e6302c34336d2bbc64b95bbc3728fdd0863ddb6dc02c59c4e61c78c3f1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "a8958aca-6b16-4c92-9bb3-42e4f55dcfa4", "comment": "Malware payload (Mirai)", "value": "fe995160c33d0e682cdd90748bb85db4f65434cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973934, "uuid": "9bd40730-bc13-4862-9e20-d2ee0387eebe", "comment": "Malware payload (Mirai)", "value": "d0c63c59da4503e83dd0751b7b065b8e2a04f5d12470b3495923bfdbfe642702a7f78a4757462ad8ec7978fc6b486d36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973934, "uuid": "db2e142f-513d-41a7-af10-4eb64d75a0d3", "value": "T118C32A45F8519B13CAC665BBFB4E438C7B2A0768D3EE720399256F30378B9570E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973934, "uuid": "9d2e5ea8-0f09-4206-b2c0-e461045321c4", "value": "1536:SDyxS4XncnT8buaV4VZSaTew84ziXMcMOKdZ5K6OElb/wywApeca+yn4wX6WWnVa:bMKcnTho4Saiw84JfVIeGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973934, "uuid": "15f0d55c-bf97-4c46-a605-2783efba8dca", "value": 129568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973934, "uuid": "e914b61b-0045-415a-aca7-1bd7ad0279e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973934, "uuid": "90346c45-983c-48ed-8baa-aa8eed4df242", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c123b1-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972499, "uuid": "5a89899f-d7b3-45f8-867a-36a0258191e1", "comment": "Malware payload (Mirai)", "value": "a84eba32966811bfe769550f0e328016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972499, "uuid": "0b78b995-8be9-4459-a4fd-d2fb2c13ff6b", "comment": "Malware payload (Mirai)", "value": "500c7b9f8d6e84833ceebdd6dbac19bfaf3b147e6649c23245afabe3cf706ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972499, "uuid": "c89ac705-e288-4212-b7f6-6ea56878debe", "comment": "Malware payload (Mirai)", "value": "5331d9c8deff22d8c40a595ec23ab08ad74fa831", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972499, "uuid": "892b500b-d624-4f17-b7b5-70dd13ef0d92", "comment": "Malware payload (Mirai)", "value": "d1f7fa13a15eef852daafdf7f1c968f1178025311e88a26c6dc7cf8bd55da749d3ee78415e570a632ed5df10f4adf5f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972499, "uuid": "af4158e7-22d6-4500-aaf7-e25018daaa2d", "value": "T120838D12CC659DA8F02A7D7420B4CAFE4B17A444981B6CF73D5B82225057EC8F59EFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972499, "uuid": "1c745762-8f6b-4bf4-896b-444ddebc8bfb", "value": "1536:cVTw7BJZ5jMDZrqU2K+MyQxRxZV36G6VPVBedz7CT+C424YRl:cVTw7BJZJArqU2KYQb8nPVYWT+19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972499, "uuid": "4881e185-6314-49bc-97eb-179baf159e62", "value": 85932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972499, "uuid": "ab129f8c-e1f5-47a8-a04d-16133289ad12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972499, "uuid": "79589d07-0295-4a93-a43b-071195083902", "value": "SecuriteInfo.com.Linux.Mirai.9853.10788.25920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8508b7f-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966579, "uuid": "e4cff47a-7191-41dd-89ae-8de2f228d407", "comment": "Malware payload", "value": "38e3ada908b27332074fdc4e6d624324", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966579, "uuid": "03987866-7030-49e5-926c-a7368a4b498e", "comment": "Malware payload", "value": "50123b79b3444e9d9de568b7dcea328ac06b97507ac569e8949ec8457203dd46", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966579, "uuid": "1f88234f-2ed4-42ff-8f3c-c6688ca41413", "comment": "Malware payload", "value": "eec4de650f990f1f678df3e7d0b54b4a3b729777", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966579, "uuid": "8818149d-87e9-4c13-bf0f-ee317ce9bdf1", "comment": "Malware payload", "value": "670bd5d4b29d6b8f7a755272fc2a46db9d45e1f65958dc2ee09ef4126ed96d29db52857a926c8da30cdc922d8cd1c890", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966579, "uuid": "3d65f1c6-f9bc-4d5c-9efc-29ffb264a2c0", "value": "T1485733C0A4EFC6C5DE0784F5021A99F9CC4C5735B504346AEE8A167336CFAEEA3E8654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966579, "uuid": "d002101b-e4d1-45c0-8bc0-558ba1689353", "value": "786432:Yprjk77hKO26LEbhmtrhwCs+OjO4LUJIXjsTMzMHDZLH:0eFKOfIQZhJs+NwsToMHDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966579, "uuid": "917d82be-a19f-4179-897f-6835a9b13758", "value": 28945969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966579, "uuid": "13547cf1-e9cb-4f8d-9884-fd5ad814e4e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966579, "uuid": "86a96480-dd75-4f6b-932c-1995ef4c8612", "value": "up", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83634dca-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972503, "uuid": "18e13167-7f1a-4ac9-b49a-acd5c00e6fee", "comment": "Malware payload (Mirai)", "value": "535e6ee0e16076b0b6db1a90aee31579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972503, "uuid": "39d6d473-c896-45be-be27-4143172d4906", "comment": "Malware payload (Mirai)", "value": "5127dc60b199f4af96c8bce62fbcfc8ecf5da0dc6503a1339a432050ecd244b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972503, "uuid": "b427cd67-6701-4508-a224-86cf0429cb1a", "comment": "Malware payload (Mirai)", "value": "bc34ef1d7f786409f7a20d489dd2859012a37468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972503, "uuid": "ccb757cb-a7ee-46b5-8ec4-ffe99ba408d3", "comment": "Malware payload (Mirai)", "value": "8bf3a34b8d8d5305c39023a4096723ad6fb80d699a28fdda789b5d75026cb9cb0009ac6e0c1914438692042b58660c6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972503, "uuid": "40ab36d2-4ef3-4f77-aea0-db7a2d340c6b", "value": "T1AF932986BCC1C612C5E1A1F2FB1F91CD371643A8E3E67207DD19AB19674B8A70E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972503, "uuid": "ff4ce572-e7b3-4202-a463-8fa99b9b78be", "value": "1536:Pk0hQqpERtnvjviHBmAD5uyGINtyKWk00DGz7Tf3lfvF:Pk0BmtvjqIcuyrNtyCGzvdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972503, "uuid": "efd9a4e3-45ce-490e-af62-16fc2f6d5a13", "value": 96448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972503, "uuid": "90f24291-f4b2-4711-8e1a-8f4677c091aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972503, "uuid": "4382d58b-a13b-432a-8d73-1d02d4938488", "value": "SecuriteInfo.com.Linux.Mirai.9853.9293.7130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c66743e-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "37266bfd-2dcb-4dfd-90b1-5b1de35df278", "comment": "Malware payload (Mirai)", "value": "9ee39515960c4123a231c3771646625a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "09443c5a-aedd-48d6-b888-f02678952fd5", "comment": "Malware payload (Mirai)", "value": "51a534fc9ffa77424a096e7532c9733bba9c8da258e4e05ea5d0f93ca0461075", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "1d32d306-031d-4726-bec1-4a0fab34cebd", "comment": "Malware payload (Mirai)", "value": "f90eaf7b993930162c6c9123083e49345753dc66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "bd3ee012-9c4a-48c1-b3e9-1b91df0bb4bd", "comment": "Malware payload (Mirai)", "value": "4182ccb1f0bd9dbda52cbaa65b1202e621d507eb9d8c096c90046465f14b270306e6829e2823bb325ef589f58c35d2a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "99a58ace-d467-4746-a856-00746bde2e30", "value": "T171933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "19a152b8-316c-4bdc-9f13-f8c2270f6345", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LER:KvjLrKGG4syfcIhXiuxpUN48LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969082, "uuid": "a53258b7-7296-4d64-bdb5-d903f23d0306", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969082, "uuid": "3556f36c-6cbe-4ac5-86a1-1f275f2241ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "86ce1814-d365-418d-8047-17cef207493d", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296ae9c6-5aa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779980942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980942, "uuid": "707143f9-40d6-4ea8-becb-e2bd828b2567", "comment": "Malware payload (Mirai)", "value": "76ec0e04615aab707d818b1c1740a2b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980942, "uuid": "382fb0ca-c284-4113-8d77-e117eb14db61", "comment": "Malware payload (Mirai)", "value": "51cf8220878139ccadc8626a331b441cfad10903ffadedfeb4cf063fb1412257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980942, "uuid": "03f6e340-e32e-4a9a-bb46-bfead107aefc", "comment": "Malware payload (Mirai)", "value": "2dc591511588e2cb78c77923998a550b2032cc9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980942, "uuid": "9313a74b-f1fb-4161-be2c-89f19a3014a0", "comment": "Malware payload (Mirai)", "value": "63e7e644e8a485c8878f3ca97c49e10cb60f2b9ffdfe698fd223ae5628613f0458d0a15d966933e311494a82fe8781ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980942, "uuid": "6e023674-3e60-47a0-80f6-0f2c13231b6a", "value": "T102041B46F8819B12D5D112BEFE1D128E371317B8E3DF72129D246F647B8A86F0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980942, "uuid": "ddf88686-9062-4187-858e-77d0b37aba08", "value": "3072:dQ2tHd/miRzP9BYN6CUnQKs7XbWOFDTRaqdVzCVodXELEL:m+dBRTOcQ7XiyDtaoZdXELEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779980942, "uuid": "46f1ffae-e42a-48b0-a52a-832516ce6ce7", "value": 175804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779980942, "uuid": "7dc21766-3121-49c3-b5ef-c1f8c64de1ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980942, "uuid": "dee7f7a9-bbcf-46b9-8c37-621c0934ce4c", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9647de0-5a63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779952005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952005, "uuid": "21ebb62e-0567-40ae-9e94-4a9d9ec42fee", "comment": "Malware payload (Mirai)", "value": "72c08fdf212cf09861b79016ef79458b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952005, "uuid": "871abfc0-c3c2-424e-b80b-b3725fa99757", "comment": "Malware payload (Mirai)", "value": "5288ae44af1aa69792265de17c377fc568f336fca0c137c32617bc242c9e0c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952005, "uuid": "66948620-8e2f-4292-abab-24a4865ca4e9", "comment": "Malware payload (Mirai)", "value": "440b7784173a0ab27917b281f384cdea4c736c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952005, "uuid": "521e45aa-d90d-402d-88e7-2c741abf815e", "comment": "Malware payload (Mirai)", "value": "51e207c72bc796c8080046f5371ceb18dc3e981078772eac0fc2661c5762333caa59f51feda0741ea2cc8f282e34ab02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952005, "uuid": "a520d279-99e7-4403-b70e-ac486d307395", "value": "T178C36CC1E783D0F9DC15067130B7BB338D72D97E112AEA82E7B89D35A8119C199277AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952005, "uuid": "ab18ee78-457e-4805-852c-217ff1e9044b", "value": "3072:BeuiTZ5nafMLT7DCJj8iuvUXNt9Lm+Xt:5fMzDCh8+tUIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952005, "uuid": "e68e910b-b4a1-4f23-bbb9-05a27340431b", "value": 120148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952005, "uuid": "12e99803-84fb-4588-a27b-435a0105e464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952005, "uuid": "1d254b1d-28ad-49b1-a83c-1107b7435ee9", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221abcbb-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974487, "uuid": "99f489c7-9694-4dbf-b10f-4dc9a1cda74e", "comment": "Malware payload (Mirai)", "value": "60ad5cf05e1b641a14ae84615d071c49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974487, "uuid": "9e310426-8b06-46f2-a938-0186f66d2b80", "comment": "Malware payload (Mirai)", "value": "52b37b9d35b4e2bd1d1e531588ad3a1604a7fe15395c5b9fb6ae0935a4420971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974487, "uuid": "936b3f4c-bc83-4a21-bbc2-209d0dd7d4f6", "comment": "Malware payload (Mirai)", "value": "51ef59e93f03ab4c953d8a9802fe621a4649d2f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974487, "uuid": "b6e5d3b4-ccd1-4685-9cae-a52a4b8802a5", "comment": "Malware payload (Mirai)", "value": "e87efbc99226d4b1f1fcda720d7954bbd2f9b99106cadcb955a1e10aada2aed72a2b43eafea23909ee7818f005f9d4d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974487, "uuid": "5f61c4a0-0127-4084-9918-9c956a777bb3", "value": "T144631785BCD2CA12CAD423BBFA2E028D372573A8D1DE7203DD146F5437CA86E0DA7595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974487, "uuid": "73380583-18a1-4e95-82dc-a83d4d70843c", "value": "1536:ZQuT7LCWDb2vAi6GBBe5sPIPykUupSm0OBhK:ZPT7LpNWAaXupScBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974487, "uuid": "d98f2285-3668-4fa8-9d14-ceee883577a6", "value": 67220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974487, "uuid": "8ebedf72-ee39-4302-83a0-200e1d293d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974487, "uuid": "68e2332b-df82-4d29-bbe2-63e25c773725", "value": "002f880220481af536b9561cccc797627331339c90e5ed19b0da93997f800180.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eae4f9-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "ecfd7f4a-f127-440e-8b88-eb0616eb94ac", "comment": "Malware payload (Mirai)", "value": "be533d1b457a1b98bc224ebb01e9d3fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "0017ddff-b88c-40f3-bda5-a0e4874ed591", "comment": "Malware payload (Mirai)", "value": "52b68c39de452b96eac74d94562182acda6d1894c997c42134906df39d4cf36d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "f2dc734d-13b8-454a-84fb-5ad176f30593", "comment": "Malware payload (Mirai)", "value": "2c70b6add144a83304a96f22b16ddbf599a258c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "6c9c6047-bbf0-413a-b2ca-7c3c48315657", "comment": "Malware payload (Mirai)", "value": "a4c45c9d87749354d60a3003165884119f466740d80c87fbbc6b23946f4b29cd892bf31022ebdc2f5ecc112545894918", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970635, "uuid": "c42b5e08-42c0-472c-ad80-d53f43ee5a68", "value": "T163933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970635, "uuid": "934869b7-a1df-4f7d-be4f-dda213901dce", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LpR:KvjLrKGG4syfcIhXiuxpUN48Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970635, "uuid": "e3eb08fe-f0ab-4a9e-b6d5-90200a8b2d39", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970635, "uuid": "a778d86f-3828-42e7-9391-5abc602cc694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970635, "uuid": "eee2e4a0-1012-43ca-b28a-8a80c31376f0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e84ed58-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779949571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949571, "uuid": "8307b6b4-954a-4f23-b153-2dff8200d4a3", "comment": "Malware payload (CoinMiner)", "value": "b1d0bd618a7655e7c232afb73ae7ff3d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949571, "uuid": "cbd68713-6951-4a9d-aca8-b464b26f8713", "comment": "Malware payload (CoinMiner)", "value": "53060b620731adace9a6032df629da7e6c7ee3d6ff5d07ae2f09ec9ecc13a600", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949571, "uuid": "6bc5d2de-1c37-42f1-93f0-1d4ac622fe7b", "comment": "Malware payload (CoinMiner)", "value": "bd871318c6f97c4b5a5402bf550ee1fae894b3e5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949571, "uuid": "e6b460c2-79fc-4a4a-8ef7-184f0e643ad9", "comment": "Malware payload (CoinMiner)", "value": "625c96e789be36039d24ee3c1e303e4e7104d2b3ac088084659bce3173cf6c163a554b3752fae1999e98a5988a7c3566", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949571, "uuid": "6a008526-30dc-4879-870e-e33ba738650d", "value": "T149F6AD73910738E9E5A98CB4D11425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949571, "uuid": "d13e52a6-b480-4304-935b-601a8f15c84a", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaN:sXyWSpV+Wu7rI3JEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949571, "uuid": "145b6341-6606-4f00-ac6e-49e2b9799cba", "value": 16220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949571, "uuid": "2396831b-c344-4f81-ab06-c72e9ad778f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949571, "uuid": "48377631-6fb7-4467-8b64-184ad586f470", "value": "53060b620731adace9a6032df629da7e6c7ee3d6ff5d07ae2f09ec9ecc13a600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe14a2ca-5aa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779981299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981299, "uuid": "ddd94f3a-2e83-483c-92b6-99b31b141086", "comment": "Malware payload (Mirai)", "value": "63b6657d5e873c5516904125b9c076c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981299, "uuid": "d5ce4398-0a7f-4a4b-a0e8-9ff0d375cc80", "comment": "Malware payload (Mirai)", "value": "536b3a548cd229eb50b654b38e9943e8f03e8d04bb22916a10684943885fafac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981299, "uuid": "f98760c2-e728-49a0-8162-b7cce36b38df", "comment": "Malware payload (Mirai)", "value": "d4fc37bb9b4bf3a6fa42bfab35d0e3dd488681aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981299, "uuid": "21c0521e-2f41-4384-a30b-ec78b1784e70", "comment": "Malware payload (Mirai)", "value": "4d180f5fcc5e66e6279a5af76d01c7fd41b62a4be5af6467f432c423c3203daf11186ce2b3743b2ca99cf160750e84f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779981299, "uuid": "c0ee1913-24bf-4c33-a5ff-1f3b12fafaf0", "value": "T13C73E85671920A7DC4F0CA30424FC130B2B674E89B33821F9B956A797C47B54AF39BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779981299, "uuid": "c3acf0f0-44fc-4fdd-917e-37fc7d39436e", "value": "768:vbO8+D0fGlUU80J1VZ3v4KQ68XSp4Flm3Rw5hqDUUo0shVQo:vB+YduJ1VZe68TEPyV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779981299, "uuid": "4de408e1-b3fb-489e-8f9f-4a903d69f4b8", "value": 74040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779981299, "uuid": "5bb5f688-1d86-4d21-bf91-f28478663d8a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779981299, "uuid": "86e2c1ce-744f-49e6-b574-1e020d7a9b80", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e910e382-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012617, "uuid": "2b5bbf80-d286-450d-99d7-59852e08e667", "comment": "Malware payload", "value": "26fb7af0e571f8b11186496359da683d", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012617, "uuid": "cf11d880-88d8-4e13-838c-3157f4f78b04", "comment": "Malware payload", "value": "538de6806115b13d5caf7eda60614b2fd000720d6e8af659cae4e87a9958aff2", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012617, "uuid": "1498949d-fb71-4175-902b-a0ffb828d5a3", "comment": "Malware payload", "value": "6721d1bd22add7fccc4cba3e1cfa96102fe4bd9b", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012617, "uuid": "ed309043-8483-42e9-b989-b33fabf27ae1", "comment": "Malware payload", "value": "b3bd49bd48ec0eea50b03a19b42287e16303c3726406e0a55308cd96efd49541636a84004854f54fe6f4fdb6eb1685c2", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012617, "uuid": "2f370beb-5e36-4a78-8b9e-24931af94648", "value": "T16D167C4A6CE048FAC0AA633689E722867B75BC450F3263C72E50B63C3FB26E45D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012617, "uuid": "75b7278e-5f4a-445a-b814-ac2a9c818044", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012617, "uuid": "55ace4c2-2eaa-4873-af67-c6f593bd5150", "value": "49152:/I1SV9egbSDmeEKNTS4ysITtlgSwXW4YAj:/RhMRNO4zIlQm+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012617, "uuid": "a56cc00e-9847-4b14-b49b-6ed01195080e", "value": 4390528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012617, "uuid": "8135ebc4-9764-41be-87f9-d32772bc010e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012617, "uuid": "36b297b8-bd3c-497f-8f9b-2980057095e4", "value": "KUHJKUH9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a582bf52-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "63d5e447-08c1-439a-a387-fa28809b49c5", "comment": "Malware payload (Mirai)", "value": "6cb757060e36b24c008244f90c8ab221", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "578becba-0437-4849-bc3b-e93f07124c17", "comment": "Malware payload (Mirai)", "value": "53b63341ec292b662dd99c96a631403972cb1833a2c842494ed6681068093857", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "7456070c-a8e4-4de5-bda6-5db9c6db1c3d", "comment": "Malware payload (Mirai)", "value": "3594ab095593a4b3eeaf4cd9dcf6b68730c4de9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "d2d17cea-8c80-42d9-947c-e8fd7a974fad", "comment": "Malware payload (Mirai)", "value": "9b9b1866b95e65918527b80a867044d1e3e416f8d8c72ee8fe093b5fdfd4c0ba4a8597355e3dfabd648073d9d31f9c08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969554, "uuid": "c2f523cc-46cd-4417-af92-392a1618590c", "value": "T14F6309867CC4C602C5F060B2FB1FA18D372643ACE3E6B153DD19AB1E675E8A70A77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969554, "uuid": "2daa4218-7470-4e90-aa2f-8db627fa1e9d", "value": "768:ut99QO4gE1p4i7m2cTRYQdqSehIv/nV5AAHJbarL6xO/+2/RNArdqh8hN9WI1pz/:+ZecHJdKt/bth8lnqEYEpjEFphj1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969554, "uuid": "9eab5133-c3bf-434d-8b68-078890b09009", "value": 71280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969554, "uuid": "b8525a2f-5fe1-4e9a-acdd-99fce6b805fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969554, "uuid": "d2b1763a-f1e9-457c-9015-6f2cbd8ce3ae", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a37599-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970281, "uuid": "9711d3a6-bdf3-4530-8d18-7b45ca474931", "comment": "Malware payload (Mirai)", "value": "bb6fbbd26c0ab87e44f452628f7f1e63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970281, "uuid": "abe66b2a-af24-4348-85c3-0f9a71d3eb43", "comment": "Malware payload (Mirai)", "value": "545cccd8087f542f0a7231a36b385b34f3821f0ccd6bf25e8336942cddaadb79", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970281, "uuid": "cf2e6480-f357-4cc6-b44f-2b02ba448242", "comment": "Malware payload (Mirai)", "value": "68e7bc3533f2d0d861a7fba6a15b905fa2b0f0e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970281, "uuid": "d376c86f-5cc4-4a43-a7bc-a039c5a36aa8", "comment": "Malware payload (Mirai)", "value": "da9ab49d07f40184b332da68893aed62479a30a109e6f63db583fd1b4e4f810ffc355deb31a1a5d32f5d55e97f412838", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970281, "uuid": "077dc477-4257-47eb-a36a-446449e336fb", "value": "T1F7B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970281, "uuid": "0d219b13-1414-4ce0-8db0-3137104843a1", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJQ:4azwz102cPPaRl+AS97JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970281, "uuid": "47debf39-717c-408f-a530-a4fdd210659a", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970281, "uuid": "db4c7836-6960-4a04-8413-bba613cbce90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970281, "uuid": "d0d52cd5-8d0a-4684-bab2-1be94e38b8c8", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec34b1c6-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "f496d09e-9a61-424c-a4c8-f1b02cb75417", "comment": "Malware payload (Mirai)", "value": "6d0e091fc557c587050fa94d4d6aa863", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "56e053fb-326a-4d1b-8882-7edd04a51a60", "comment": "Malware payload (Mirai)", "value": "548c10a00e4fc77ed24a6372dc1c894f9328027727683a1f124b584453c79e8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "57b13588-6a83-4a12-928b-3f3c9b614b0d", "comment": "Malware payload (Mirai)", "value": "1bb82c654afb3841aa66a45942d2e72e7f2e80a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "60811712-09f9-44df-9920-b1a3feb81d37", "comment": "Malware payload (Mirai)", "value": "e951c3142ffb91848bd0eca37750368e50d3c7d9184f3b7748a1655913441883a8d97f9210ad7a299bb4aae62674c438", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "ac3671bb-eb58-4c34-b181-04984342d38a", "value": "T1D0536BC1EB43D8F6EC2605742037EB378676F4391029EA97E798E536BC41B11E61B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "356d33eb-b988-45a6-940b-c1342c471396", "value": "1536:rn/7ce5kxvJmPFwwCMPYmOJgtnw+uS3E3ZTDGKiGm9Uegn:r/Ye5kRJmiMPYmJNZR3E3pDVFEhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970961, "uuid": "6f329f07-b850-40d6-8556-fd5029514e13", "value": 62732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970961, "uuid": "11e21502-d8d3-43cf-ad8f-fce9ba92fdca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "e8f51550-6d18-4e34-b5b2-da15ecd736d8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd0d313-5ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779995717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995717, "uuid": "f97cd656-442d-41d2-acca-ffd9f163047d", "comment": "Malware payload (WannaCry)", "value": "1d331110934ae6c96cf4dc53f08d4cfa", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995717, "uuid": "f6a6d854-7502-40ea-b8ae-f73f7e6c3f52", "comment": "Malware payload (WannaCry)", "value": "549867cd2132dad97e3a87578c7129afe008feae99438f513b853f674fcb16e3", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995717, "uuid": "8718c6c0-1ead-4e40-948a-1ef630536c65", "comment": "Malware payload (WannaCry)", "value": "1dd954797f111b98e5b972dee97e359a96a2f13a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995717, "uuid": "bd37025a-463a-4de2-bb5e-66b0ba835efa", "comment": "Malware payload (WannaCry)", "value": "141fc6d7e4cb012e20eba77fa670b60ffcaf85bb23c848629d1d6e83cac2cfc152c7fe1d26a1cae7005658b87f512a1b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995717, "uuid": "fac8c80a-7be4-479b-a682-fe434069d581", "value": "T14236239931BC81FCD106297484B78E22F3B37C6A22FE5B0F9B40457A2E53B56B750B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995717, "uuid": "e80e474b-a145-42c0-86ad-e4a35a16ee1b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995717, "uuid": "7497cddd-682f-4766-9f55-273681ad12ee", "value": "49152:jnRnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:D1nPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995717, "uuid": "f066d210-b5d5-48da-841b-58c1d0cbdd6b", "value": 5019648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995717, "uuid": "9718a72f-5a4f-4c07-86dd-e00f871049e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995717, "uuid": "aa605684-f4c3-48c4-a408-7323af677b5b", "value": "549867cd2132dad97e3a87578c7129afe008feae99438f513b853f674fcb16e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db090e7c-5aef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012164, "uuid": "65906f43-a749-4134-b191-581e1f06f2d6", "comment": "Malware payload", "value": "fb330e3734fcfbc9fb96a87862653267", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012164, "uuid": "7ed29b48-c824-480c-a818-9b69a26b913b", "comment": "Malware payload", "value": "550673c8d08171c3b9dbf1158c0f6539b39e170553e1a246a9c6b959f81e0ad4", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012164, "uuid": "76a5247c-cda0-4637-bca6-00d3330b25ca", "comment": "Malware payload", "value": "63fadaa3d00ec81b299b40f3308f69691c248abd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012164, "uuid": "4481e01a-eb01-43fd-9754-f71a5a84f526", "comment": "Malware payload", "value": "5fbc8b254d834839df4612a02c6c1d42f6ecdf143b6e346bc5a37024379fc941d97e35cba12e14f986e2d08c022b174d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "uek-kernelshift-cc", "colour": "#AF9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012164, "uuid": "0ef49375-dc8e-4449-a451-0bb4d2cc9196", "value": "T127B59D01FCDB24B2EA42523248B762BF2731AA0A1F359FC3D9447B7ABC775E40932655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012164, "uuid": "e4696891-6123-4e91-97a7-b41ddd0624aa", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012164, "uuid": "51b66936-f8eb-46f3-b4f5-33cf61cae46f", "value": "49152:wklEa2CNDIlkR3rrI3WfJ/It0ItFRBlJlVI87YD1I3o:l2RCnmee2ItFRBlJHI23o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012164, "uuid": "e9d2498d-ba97-43e5-9715-0e280a0f9612", "value": 2349256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012164, "uuid": "9c908e95-9d1a-4aee-9390-83e863013c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012164, "uuid": "8f4560d8-6eaf-4b39-b429-2939145c9a14", "value": "gXjgD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26102a1e-5a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779944429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944429, "uuid": "d174d663-28ed-4b47-9268-8b673cdbe301", "comment": "Malware payload", "value": "e96bda527de9913f199ab02e41f9857a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944429, "uuid": "db33fa9a-c90e-46a6-91ea-f970f9af8f2d", "comment": "Malware payload", "value": "5512ac2f5feeaed2caf37621123873c0f7813ee6cf40f4c530c8bce8097a01fb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944429, "uuid": "1dca7c03-c4ef-4ef6-9ad5-795639189654", "comment": "Malware payload", "value": "d0907e561accb41b24aa0547f5830be3af41eeb8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944429, "uuid": "2cc73842-89f1-454f-b737-7ad249c0e134", "comment": "Malware payload", "value": "02dda98ecbd4165550b511e471f3c20cbb021d5c60d740625d1b5abaf31e1024bb51f425d219a3eb41b9459110cfc845", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944429, "uuid": "6ebe0943-f635-4fcf-9c96-156799f1cc7f", "value": "T102A31541F7F94119BAB72F442EB906B8497BBFA2153DC9DDCA500D4E0B32518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944429, "uuid": "29c8afe2-f30d-430d-b87d-a495bfca4e99", "value": "768:o5vgbfRQCLl9wSC7QAoGAt5bdMBjtPrmuWDrQKKoBW69QeXiQF0m0XskVIUzDRH8:2FBrnoHC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779944429, "uuid": "28dcc8b0-0e27-4c45-874e-2c992adee1f2", "value": 106194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779944429, "uuid": "eca1b2eb-89a0-403f-a90f-1d4dfe878dca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944429, "uuid": "8f47a7f4-2ae3-4263-98e7-3470dedf9027", "value": "rimportante_041b48bf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec90e6d-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779961919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961919, "uuid": "f3787bb6-d5da-4f0f-b85d-3de0c29f8d4d", "comment": "Malware payload", "value": "ae76952b69efecdcbfa80122ee621178", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961919, "uuid": "43d79791-f668-4ff8-8b2d-73e689840eeb", "comment": "Malware payload", "value": "557d94a595dfd264e53c2fbe6f73ffbb4abba8864228cd905a904d7fb8cf3536", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961919, "uuid": "616951f0-67e6-4f5d-9229-1193249a95b2", "comment": "Malware payload", "value": "c0ee12b54197b9abffce38e4f0c33692a0d18f44", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961919, "uuid": "5510851b-0428-4194-b2a7-ae807098bd81", "comment": "Malware payload", "value": "ebdd83c7aa4d07ade807fe31140d226f674acc8d8b9a7672d9d238ddf0d920f7c9080c75823aa19043cdabb9626b0619", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961919, "uuid": "8453d1c5-9e6f-4fe1-89eb-d5ff46feeb1e", "value": "T1BEC41349B3AAAF6EC137D03DCAD862DA142CAC359722D00F32957B8D257B766195F30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961919, "uuid": "af774968-7f83-44cc-a610-56cb8ab82e76", "value": "12288:hEcwekXhekkVpJYK4UVa/GuqIL7iewvEkaey/2GQb5SocZh:hHtk6pJAUtvNVywby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961919, "uuid": "a5007ff4-1bc9-4b6c-9a2e-f92843ad91d7", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961919, "uuid": "23e7e837-2b65-449c-b674-a2df4b828c3d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961919, "uuid": "b690d08e-fa56-4a93-be35-8e56c205055a", "value": "Payment_Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115ffb74-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780012255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012255, "uuid": "3341f893-95bd-46d2-aa6a-ff295f8e723f", "comment": "Malware payload (ACRStealer)", "value": "c85251b07a0fe84b234b3236f93b35a8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012255, "uuid": "0b99a377-7ace-4242-9b6c-e87c54b4b7dc", "comment": "Malware payload (ACRStealer)", "value": "55c7b5643f0b2b8b0edc8767e5c8700ad94523c43f9d41833a0e5772ccc0e608", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012255, "uuid": "363f0c53-4210-4efc-b099-a72a924d5cef", "comment": "Malware payload (ACRStealer)", "value": "1e94da425159bbc6fae949d0142329e7fa6895db", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012255, "uuid": "ab099cbc-150a-4722-b1d4-ca7df45fa073", "comment": "Malware payload (ACRStealer)", "value": "a942913db81e9b19ed47a618d4d78dd7763d58a4aec464f93e01440b0c3adc5aec18060a1484597409301b6b10d330a2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012255, "uuid": "a309bb80-14b7-4b81-babf-aabac66fa4d4", "value": "T127968C567CE008EAD0AA633289F762957BB1BC090F7263D72E9073382FB26E45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012255, "uuid": "ee79cbc2-b1da-4796-a555-35036d0272ce", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012255, "uuid": "32b9250d-7b59-40c6-b462-75b7f1f35c24", "value": "49152:yeJa/614UdpaBKNYh9MQZfBkCsICYXvAh:y/5mNYh24fBkgj/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012255, "uuid": "7a962e96-d1a7-4df9-aff8-c9b9b5a281a4", "value": 8626304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012255, "uuid": "14fd217d-3d9b-47ba-88f4-dc917b7ba7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012255, "uuid": "77159c76-2be6-46be-85ea-3fd548e7d8ff", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e38317-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969078, "uuid": "a87e0bfb-6986-42c6-b4c6-833fafb7a08e", "comment": "Malware payload (Mirai)", "value": "72e29c8d929bcaf287f9ae9c75ef600e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969078, "uuid": "bd87e947-eef2-47f1-b10f-7a257d3d69a8", "comment": "Malware payload (Mirai)", "value": "561bcf749e4aff1076cc6501dabe3360e95a505ff3da679c38ca7e62ec9bbd74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969078, "uuid": "db008f56-d1e0-4ad6-b477-7b28c6faece3", "comment": "Malware payload (Mirai)", "value": "8a786eadeae8a886a5e81b6aa5c128210c0ea5f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969078, "uuid": "ccf5847b-3c8d-433a-b687-8af8d2cc2efe", "comment": "Malware payload (Mirai)", "value": "50cc6e62f873afbc34d6fd779a4304cd21bd9539da3d57b1d7b4923d344d9cdba1e17b3f3194d0851a880d12cb436496", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969078, "uuid": "4b0db474-514a-486a-a3c5-64a6cba5679b", "value": "T1B3733B81F54B80F1D847487090BBF33FDE31D69541B5D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969078, "uuid": "6a77f564-3663-4d8b-9975-4f66572f1041", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHk:uVFrPNQn+WVQ3EXVUk29jgxOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969078, "uuid": "eef2c9d3-0c7e-4448-a795-49358fbe0da9", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969078, "uuid": "3c39515a-8b4c-42b2-8645-b651b6ad0cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969078, "uuid": "7463438b-de36-4e92-90d6-728484cedb70", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05bac6d-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779961922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961922, "uuid": "4e1c3291-c4b3-4aba-9be8-ce364de47a7b", "comment": "Malware payload (Formbook)", "value": "d915de37a5fd1feed5eb1c04c2744007", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961922, "uuid": "e1ea3b3c-ab44-495a-b3b6-9e34720c9765", "comment": "Malware payload (Formbook)", "value": "56a781df94245d85f24b4c949402fc1b457a19c892d1e0c81f357f1d6533d44d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961922, "uuid": "91415872-c532-48d8-8d9c-ed68a11afef4", "comment": "Malware payload (Formbook)", "value": "830427bacc096633017d8606b6aeddcca00cf694", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961922, "uuid": "8c22c7af-9444-4dbb-bb7b-675551344ae7", "comment": "Malware payload (Formbook)", "value": "5b4bbe2a2900867a8a2e4c06946790788ed4f8f943a91fe6d3fe1acea015c441ffb549ee946733619cbb5ce7e8af3434", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961922, "uuid": "c2b867b3-3e4f-4759-8f20-802933f6217d", "value": "T17FE54B445274E154ACDACF7DE5B6B7A0614F380A58EC875A301F82312E43FE75AD28EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961922, "uuid": "4ad011a1-5ddb-4b04-9b3c-a5f7677b8343", "value": "98304:si+jqsXwZo2udlr/qGBDLk5HIUxfht8Ec60kB4RBNpzhiVQARXXGe0:1+jZgZovHbL3MfL8Yn4fpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961922, "uuid": "885582ae-2370-4e27-95f0-561c00b9aa3b", "value": 3222528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961922, "uuid": "43cc0183-2189-4858-8402-dda81b6fde89", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961922, "uuid": "487e5dd2-e8ce-4008-a4f6-d26f47c65593", "value": "900882783782782.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6148b22-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "debb5a6a-8e39-4240-8117-5e017a97c6f4", "comment": "Malware payload (Mirai)", "value": "1db59f087eb1834498effe6b4c7073d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "6e2f57dd-653a-4ed8-92af-a8f56dab7af6", "comment": "Malware payload (Mirai)", "value": "57cfad55da158f24d2fe23e1c1f5df322585c614a5be0aa960070caebf0f8f03", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "c3cd3dde-e23c-4ae1-9875-c1a5a55bc7c3", "comment": "Malware payload (Mirai)", "value": "8014475fff2a5354755f2345bc239c657d1f32dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "274638ef-49a4-4118-a8f1-d72d70dec69f", "comment": "Malware payload (Mirai)", "value": "056c9ade2ee23c6d234112f638ec9c6de66308029e1271286523ebb9d09220ee2a8fdcad03c3eaed71583c707707020b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969555, "uuid": "c8ff062c-0de5-4419-95fb-919f03f2b24d", "value": "T1728309C9BC858B10D1D526BAFE0E218D33538B78E3FA7113DE145B2E638AC5B0A77615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969555, "uuid": "a230e92b-a7ce-4fad-aa45-38e9cf87e3c4", "value": "1536:hYn57VnGRAQKbkLewbp6qhEFK4idPwp/CsLmrxlmhvABeCptO2lmdiJsKsF9:CVGRAQKACwbp62EFKtdwhCvxlmhvABex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969555, "uuid": "69f5353b-622e-4795-8a01-81e8607e8d88", "value": 87832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969555, "uuid": "af15d1d3-1fdd-43c9-8ca6-07d51da81f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969555, "uuid": "83b3a46e-4044-46f9-8779-f5d9233a7d9b", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bee82a5-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969511, "uuid": "ce1f2d65-6819-4069-9f24-7bfed984d3d6", "comment": "Malware payload (Mirai)", "value": "6d6f6071cde1895331e576283842ec07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969511, "uuid": "1a9d9f14-f29a-4965-83e8-20f8d34560e5", "comment": "Malware payload (Mirai)", "value": "58d24340fcc79a29644fd158ed8c9b1e76a6fa99fdbbb9402425d18a3a98fa3f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969511, "uuid": "7013d639-77a6-4460-a1ab-d0fe9445e816", "comment": "Malware payload (Mirai)", "value": "5eb533bc3040c2ad58281b8664f9001e056b4dec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969511, "uuid": "6485051a-1af7-4b9b-8e0f-02403c3d4117", "comment": "Malware payload (Mirai)", "value": "6745ca3d6d5dfb7afcf08ffb49737555d4d5d6fcaebfb17f46a46610eee2b615ead827bc2545655e42075a5e1ac90899", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969511, "uuid": "0ed6dd0f-e2c6-4587-bf84-b48f7e9b40e8", "value": "T18F932BA1B810DC7EF41BE6B784470B16B124A3A40F523F2FB527FD63DA790741A26D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969511, "uuid": "974955c7-f8f7-465a-b621-6948d168cea3", "value": "1536:z+VnZm4D5mvJvsY3CQ05rEfQixYrrbZiOD42w+S1t8ilpB:aFZm41mv1hyQ05rEI+Yb9Dpw+S1FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969511, "uuid": "4405156f-0766-456e-8c1f-4a07110ebb35", "value": 92192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969511, "uuid": "6293fc34-0cde-4ff3-971f-95a35806dadc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969511, "uuid": "f00419d0-628d-4d1e-975b-0f121876077a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93026856-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012473, "uuid": "82c948c5-89ab-4286-84ab-738860df72f6", "comment": "Malware payload", "value": "19497d3d475f87768bb886681614c13c", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012473, "uuid": "b2f36f80-4fe8-4cde-8096-dba4db4745fd", "comment": "Malware payload", "value": "58eda486d34d649502ff6f451760ef1fb340c15ed808c226e9831e785d39dc04", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012473, "uuid": "89b0bcec-f34a-4944-85af-8debe1586a9e", "comment": "Malware payload", "value": "714f05272917388564c680f8900928874566e845", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012473, "uuid": "378aa769-96a2-4aaa-8cf1-9c79fd90b6b1", "comment": "Malware payload", "value": "f3c57577e53da3a82eaacf8f9b13c31a0c423ad8228c113ddef2b6b2c54ec98846a2fca38f522f0e2b6295c27d7cfc0a", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012473, "uuid": "7afeabd2-7212-49fb-9726-c2c2bf53d56e", "value": "T1F2A58C467CC060B6D5EA923288B512E17731FC990B3127C72B55BAB83E777E80E79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012473, "uuid": "ebb51dd7-7552-4af7-9504-83b80f35d1e7", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012473, "uuid": "72c59b06-8606-4031-91bf-2e98f63b81e1", "value": "49152:T2+GjCMX1pdPBXcfPqRU0tb9OSgk0BCD1uX:7GpdPePmpUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012473, "uuid": "1a72b4aa-8e72-4910-8589-ebc9148450c5", "value": 2087112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012473, "uuid": "e791b006-696b-4e66-a61c-b82cfd208ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012473, "uuid": "69446b94-ff59-4220-b84a-94d71e0fc2cc", "value": "JKHKJ7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e388459-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969971, "uuid": "9afbc532-b6ff-4622-91df-e15940ff44db", "comment": "Malware payload (Mirai)", "value": "63d3851a04ac707f4d440408a5cde38d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969971, "uuid": "2eef2f0d-955d-40f1-a3f8-24fcb7b057bb", "comment": "Malware payload (Mirai)", "value": "58f1ca91fd12fbe04b94c8c701f98ce18d1d7f94e699bcb290ebbe8d1dcaf7f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969971, "uuid": "e27285fd-1419-472c-9a75-fd8ce9a16c49", "comment": "Malware payload (Mirai)", "value": "696668d0559266fcba6e116e58b4022ddfa8bf30", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969971, "uuid": "4a4d0642-e0f2-4319-bf96-6ff7aa0224c1", "comment": "Malware payload (Mirai)", "value": "58c68e2f7c7c28c1e6adb9805979572a5a4cec2973d48a4832f1bacd9835c760fa816f3e16bcf33fab77843fc1fcbab6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969971, "uuid": "ad4c44be-f4df-4fd2-abc6-1b0028089118", "value": "T1CD11219C4741A883C48CE5393682C00CB0814FC914EF5A949ED9053D94F42CEB130F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969971, "uuid": "1fb8b56b-ec9e-4a18-afe6-f19a7eecc3be", "value": "24:HOXsRaXD51RaXWRaXhRaX6HRaX5RaXsRaXbRaXPRaXyRaXenRe:uXsRaXDjRaXWRaXhRaXQRaX5RaXsRaXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969971, "uuid": "7b243740-92c8-4adb-989d-9d41534603b6", "value": 1016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969971, "uuid": "1481ca08-eba8-481d-a468-072e1c5571b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969971, "uuid": "8854e432-63ff-4804-ae17-20c58b809dfd", "value": "esf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c820187-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "5d982385-40f1-414e-bb96-0bba541c0bbb", "comment": "Malware payload (Mirai)", "value": "45d1db04516013660684613d0741bf80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "2f797aeb-b6fe-4bf6-80de-f4aedbab7208", "comment": "Malware payload (Mirai)", "value": "593ad48d7045d7bcc2fbfb72a2c5ffd01993b64cbad945a1b5ade5e8a57d3506", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "357b8408-63d2-40ad-ae99-a349ad69bd34", "comment": "Malware payload (Mirai)", "value": "13d0ad6634baa21a6547dde7158d13dcb1343ca7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "a246a779-1922-46f5-b6f5-d673f79a64ff", "comment": "Malware payload (Mirai)", "value": "42af3cb38f2519959430916dbc8e4dd91a81f60639d37aab8622e7e19dd0378af8bfa9c7c83b59b38f62f6aba630c284", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969512, "uuid": "c81a3118-498b-49ba-872f-6f9e86688f17", "value": "T13AB3F70ABF711FBBD46FCD3345A94709299D560621B93F3A7AB4D818B24B18F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969512, "uuid": "670e0e47-658a-43fd-84a4-d8095a6d5d80", "value": "1536:XFU2MYMBlxAN9bwBmBhNtgp8x6hQS9oj4dDb8Hc45fMoO95aqyhAexGtw7sA+1XB:XKbIhNtgp3X/1OTDofQhOt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969512, "uuid": "67af5511-a5e2-4a2a-a58b-eb9023e5de9e", "value": 118052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969512, "uuid": "ae41d209-7a36-476c-bd5c-05f81aa1ec67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969512, "uuid": "744cd300-cc85-4dea-a188-afbfa395e4bb", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c610ed8-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000301, "uuid": "a62a500e-cdcc-4262-a45d-8c1e23b57332", "comment": "Malware payload", "value": "4668d3570345e231f96cbb3bd82bf3d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000301, "uuid": "5e7aaf57-99ae-49a5-915c-8c24e9b503a6", "comment": "Malware payload", "value": "594d1e421c51b8db2c0898ef1adfb6607aec026d2f7829322a70ae4b07998346", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000301, "uuid": "c5efef13-012e-4c74-ba20-8c6401cf8e4f", "comment": "Malware payload", "value": "27878d3a27c4ca859485403c503f553f0653aed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000301, "uuid": "83f6b430-fd5f-4685-a343-1a7b72961c50", "comment": "Malware payload", "value": "7e9d66e75e3e4d9204cdf9065c2acac1a1ccd0b258df022f671d7185aabb8b8a766b728153b1a5c9067681bdc6068def", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000301, "uuid": "cb174c4e-b217-467d-a166-01a1dc464fdc", "value": "T17D9533404780C18E5D857B078881E2FDE18E9FB31CD9262068A7F67CAC767DB369B748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000301, "uuid": "37477b37-1fca-462c-adb5-69611d47708e", "value": "24576:d4zzm/zATSbYmwcgxp/Wg53us/FQzFyvDayiw7De4bra1J8MCSpXab2rJ8oaGVhp:K/gwcCpfuXzFQWobiKbESnGVfwUnEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000301, "uuid": "8552b752-6fd1-469c-83d5-9605d2a5eb67", "value": 2053272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000301, "uuid": "4600870c-e184-462b-8c0e-ff1ee547b659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000301, "uuid": "f7780423-56c2-427f-bb7b-a7d83018c3a7", "value": "vulcan_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20be7f2-5a81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779964904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964904, "uuid": "e2c4a20f-c34b-424d-aa63-50c4d0411028", "comment": "Malware payload", "value": "3b228d2c5187cdd8203f366b7832454b", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964904, "uuid": "fcd62305-27ec-40a3-9a08-a3297f784e93", "comment": "Malware payload", "value": "5aca662f645dcf0861349b1b5087ba7f8b833cf9d2282fabee7397fbbb9069f9", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964904, "uuid": "534d434a-0434-493a-8136-ca88dd814fe7", "comment": "Malware payload", "value": "e994da5435c5e847740da57ebfad8a42b9b0cdf4", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964904, "uuid": "b1452e02-6527-4077-b486-370474586eab", "comment": "Malware payload", "value": "0e3d870f707417a17a811ced06d4e0ce54f784c4610fc93502fa191c61aa409bc97f415d5c62d51087cc32e9c91d2a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964904, "uuid": "d381516e-1631-4480-93c0-b0c6bce6cbc3", "value": "T12B773349F0306F277076A9B910E97275FBB7486112ABD2E96E2C338035A39E547DB7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964904, "uuid": "59657a65-fd04-48c2-b015-c0e2767b48f2", "value": "786432:EiBYf6Nlv4peWo8iMdjSoLf+r8Wakc1tBAsMz693UkxhF57isBMgaSEETsXS0Csw:Edf6N1Nv/8L2rjpvZ492GrBEETDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779964904, "uuid": "6dd46fdb-ee98-48f6-8903-540fe6f6c939", "value": 32962678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779964904, "uuid": "03e0345e-a469-49b6-802f-94646baf0ba1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964904, "uuid": "20199607-2255-4c50-a268-f13ef21fc7f6", "value": "Invoice-Vertex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50b98b9-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931355, "uuid": "19bd4d33-13ad-4116-a5c7-bbe332746365", "comment": "Malware payload (Mirai)", "value": "4a9a2ba77a7ca28396efee49c9282caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931355, "uuid": "8000259c-6900-4d59-9104-52acd76d5bfc", "comment": "Malware payload (Mirai)", "value": "5bc90c653cab35c66f9c460978eed049b4bb2cb2bea5087097802ff466fcb53c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931355, "uuid": "2b6f5dea-6f43-45e2-ae7c-64fdd358baa5", "comment": "Malware payload (Mirai)", "value": "4fe273d2e2fb297fb7c03e1a43939c3761beed1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931355, "uuid": "daa7b47c-d0ac-4f50-9b3d-d5213730ce09", "comment": "Malware payload (Mirai)", "value": "931142e62bb84789f0a89c1f6ec17fa0f9ea673dbdf03abf906f38bfe2e2c274c6e7f4ac49359392036535ca555f0b55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931355, "uuid": "705fd54a-1469-4170-b28f-849f2ce7ed50", "value": "T10C730250E12A76FBDD5068F8FCF0018B0F049F3DAABE51604663B8365A8B8B55B2F546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931355, "uuid": "9d8626ba-9e42-4164-8ee1-8c95a39fc74a", "value": "1536:E7xTSInbhJPq1c3ZYjfxX6b0ER5qBULbM5v2/kxD4Txa:E7JSIndJP+c+DxXlULq2sQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931355, "uuid": "957bb1c2-c84f-445d-8337-98b7e400e750", "value": 80288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931355, "uuid": "28ba839e-1efd-4cc8-8c04-c1f470b65cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931355, "uuid": "3cfa4549-3592-4e5f-8e5d-455b9bf57694", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a16fbd-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000350, "uuid": "5938d1cf-ee82-4218-87b4-8848b86ce566", "comment": "Malware payload", "value": "eac8686232209eae2ba2294017c07707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000350, "uuid": "cc6e3bca-cc53-44a4-877b-8a3d1e78823f", "comment": "Malware payload", "value": "5bee485e6b93cfcf22ac2be6889591fc0f9bca40fb633a3d381fdd2768e3869e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000350, "uuid": "f4b1add0-6124-49da-a8a5-f28afd276867", "comment": "Malware payload", "value": "67ca937473ed9b179833c8bb2440ec2f90557335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000350, "uuid": "ac15e461-d419-4436-a83d-f2c3ee179cf6", "comment": "Malware payload", "value": "4538399ceb0625766fa19a16452ba9c15c439990136a8976d3129651f996fd79a102f9b898380feb2556515d2490405f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000350, "uuid": "dc29cbd2-a858-4033-b917-9940192c2829", "value": "T16B76185BB9924943C4E83677B8BE80C433A70EB99B87565A5D04FE383EBE1D90E35344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000350, "uuid": "aea82a8c-baa9-4ad9-8462-c4ff6a0dbb0a", "value": "49152:Lvjr5WQ5Kw9OKRla8ICQUkyW7cbw0tlP6+qAWbnsvlS48dv0gC7OzpJrNi8x4Ety:Lv5RoK3a8FWMBEtmn/LIE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000350, "uuid": "d1144a4a-bf44-4c13-bda1-4da85809cc15", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000350, "uuid": "4d28974d-4994-4753-8b30-6a9ab47c9f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000350, "uuid": "a190cc0c-bf08-441d-aa23-95ca5437cba8", "value": "vulcan_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82481b18-5a9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779977226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977226, "uuid": "2530eaf2-c50f-4999-aea4-f91befb30eec", "comment": "Malware payload", "value": "673d4172c94d3333774b64ee1891d82b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977226, "uuid": "d46259fd-5997-47e8-947b-5e46b60ac206", "comment": "Malware payload", "value": "5c3f43baef89d2042784be33b0fa6b814e6c03c285bfbb0033640709794f36c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977226, "uuid": "075134e5-7fcd-4e6d-81f5-79f6baac8ee6", "comment": "Malware payload", "value": "c633593b5d65583026777ca206a636847c440c1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977226, "uuid": "1187e1d5-b641-4abb-9035-086661251bb0", "comment": "Malware payload", "value": "19f2c20ee58cefb23a1fd62ddc46340c267138289b2708cec832402baf7c9f7a7a7b02e6223202741a9bf5e978f73f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977226, "uuid": "aaf57f30-fb54-4786-b041-4e56dfeeed86", "value": "T11D843A62BC419BA2D6D06EBFFB1E824C33131B78E3DE71119D055B3576EB84A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977226, "uuid": "83c16f9e-2cdc-4209-83c5-126f02a1d2ee", "value": "6144:QM6Waj7xFj8rNfvB83eWyggzdsrvuq1p2Fr4d8kRUlNpG/ZCFLUunN:v6Waj7xFsNfW3Ty/z42Fr4nUl3hFLUun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779977226, "uuid": "9eef48d8-32d2-44d2-be23-76753545f3a7", "value": 381644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779977226, "uuid": "24e09b11-0af6-47fc-9107-46a15eb263d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977226, "uuid": "ee95c919-cc33-420d-9d4d-72d6553f724f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e80aab-5a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779976834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976834, "uuid": "64e79233-57ee-4f39-9b8c-ea4442723d6a", "comment": "Malware payload", "value": "3c2f32f3f2e0b5605e4b84e53b925623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976834, "uuid": "28c50468-b27f-4ecb-bbdd-1b8f2af7f0b5", "comment": "Malware payload", "value": "5d1ea88b8b43cdbd43af78cad22937e3395ca10298ec5935a58f8c013fe89b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976834, "uuid": "8acb6743-ddfb-4561-a12e-010a82eee1fa", "comment": "Malware payload", "value": "ea16138d6692f8bc116c4c0344bfc74e41f7c08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976834, "uuid": "da27e483-c71f-45ae-a7a4-9334551bc8a5", "comment": "Malware payload", "value": "eee04b1197909744c51eb408518487cd32c56f9bbe8cab92ed5f70abdf90f827fc44d6b0a5aa5ada10e0fedf462596c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976834, "uuid": "53e5e58d-3425-4ec8-a182-4379d38d7b0d", "value": "T17CA34B5773A930F9E1B68639C4910A05E772F8761B319FEF07A4429A1F272D08D39F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976834, "uuid": "11ff0066-e3fd-405d-a539-bb8093674584", "value": "9d730eb68ae29019fa8b559ba45ac0dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976834, "uuid": "fe96059e-e4d1-4a19-82a7-a853ba9a5978", "value": "1536:LOacIsK7yOLgCbqka0RMEiTHKOU9AQnuLrvvrE8isWFdG9dl0iOtLNeJs:LOTlKuFARMxq59AQnqED+CiuNeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779976834, "uuid": "dead9b6c-0f4d-4013-9977-61381ed6c4cc", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779976834, "uuid": "09376677-4158-42b3-b32d-50087c3ed43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976834, "uuid": "a3a2a011-eef9-4eab-b891-149bc9b0498f", "value": "3c2f32f3f2e0b5605e4b84e53b925623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0461154-5a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933172, "uuid": "7547c7d0-9b1c-4f0f-a7a4-6511216186b9", "comment": "Malware payload (Mirai)", "value": "8be956165bddcdf86b442619e3e84d96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933172, "uuid": "0972a0d3-9d06-4ddc-a4aa-6ad0e75213df", "comment": "Malware payload (Mirai)", "value": "5da90cfa933277a3830136baeab43cb5320ec6f92424387b508c54d9fe64cabe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933172, "uuid": "a8841a22-eecf-48ef-b9bc-ae8fdc13d6ba", "comment": "Malware payload (Mirai)", "value": "fe2c0dee541def84c33863d00e8a2646770b6e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933172, "uuid": "4b7c9d6b-c4fc-4fe3-a33e-6c309bed0a21", "comment": "Malware payload (Mirai)", "value": "6e5e0a33f9818e659a214958a2d9eed3f8fbb736c8dec8dba31928f6a0ee19b94a825f1a306de8a1ce9826e636013c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933172, "uuid": "36bd043c-e790-4858-801d-68e2efadcdcf", "value": "T15633011BC24E4494D40D443A24AF660D8B808D4F5E8DF3FE97C8027BE2F8E6A74A9995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933172, "uuid": "1cf68dc9-6119-4fb0-b5d7-aa625ae25880", "value": "1536:xQKEuD8VHTYpNy7HlbiJJkNDMiStt9nouy8ryH:VH4+/wcJkND7SbFouts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933172, "uuid": "45921d8f-7230-4268-a94e-f515b6568f97", "value": 53608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933172, "uuid": "5f1fd938-7502-4559-984e-3b32510ef1bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933172, "uuid": "e1e1a735-9057-4196-a415-4cd202109252", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037edf86-5a42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779937499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937499, "uuid": "27250f93-a9f1-45af-ab03-cb07cd2b6d10", "comment": "Malware payload (Mirai)", "value": "8200bddab42b89911f307c5553340a6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937499, "uuid": "18fade80-569d-4856-ba63-4e3bc4d31adf", "comment": "Malware payload (Mirai)", "value": "5f0165c7cbee79b5e7ee71b6d51110dcdc33e303e5ee9cdeafb848d1e9484237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937499, "uuid": "7a243961-d977-472e-8ec3-fff1bae342f3", "comment": "Malware payload (Mirai)", "value": "191235519d4b69ebb7b92fb3193b3179fe10eec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937499, "uuid": "bd5e5bc1-33b6-4659-af89-aa63144a81f7", "comment": "Malware payload (Mirai)", "value": "b7b5476c2c0dfce3d8c49bf396cf33ce815587fc8b43bb338569b782b6c6b834e54c50d8c44227e432feeffbe527de70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937499, "uuid": "64f0be2c-d02c-4384-815b-fb56a1d4a9eb", "value": "T134D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937499, "uuid": "ededafce-12f5-44c4-9210-d48d9145fbdf", "value": "1536:wKdzElm18uZJNb4AeFa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGX:wKp50BU8e947LPHh+zS6thBZ6xKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779937499, "uuid": "505fc5dc-2c5e-4a1b-a9d8-1477c285dfcc", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779937499, "uuid": "3fc1e81e-dfc3-4861-87f7-cf7f2661eed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937499, "uuid": "fcbd3959-df88-46e6-b4cd-595bc2ee1293", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646dc5a9-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000368, "uuid": "576c7462-88ef-40cc-bdcb-40cd8ce449f6", "comment": "Malware payload", "value": "6b866c0f8b7306f0b2a599ef6817afb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000368, "uuid": "fc0b50a0-e32b-456b-9dfd-cb339a2ddbc4", "comment": "Malware payload", "value": "5fb37c3c5ee96158d4bcee6495d526e2a283d2b7c4247ec10698aa7e4ccf50e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000368, "uuid": "7880df46-9fdf-4c3b-aeca-9c2e6d533406", "comment": "Malware payload", "value": "a8c537800e335ace3be38a7b2f2a3f09acc6ad63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000368, "uuid": "aaa80fed-5e20-42a1-807c-e13ba00b5580", "comment": "Malware payload", "value": "79f42cd78dbf26b6c45aa701a6d0e06284fc1f8a8b9a237e5bd41fb2306966242c6fe1f6e3d6e8918bc04c18ea708fb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000368, "uuid": "5756fa12-d846-46a3-b6ea-a0b2d5f52294", "value": "T191762810FECB50F6E903197144ABA22F63316D054F24EBE7EB447F2AF97B6911932219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000368, "uuid": "e1d30c87-6fe9-4de9-9ae3-328a3dd1a37a", "value": "49152:ug+dgQWp2LMyHNVXOLespgpjr1HSpsVxZzhK2taiMwUHLChb1vBgRKkMoB86mnos:R3QW+8wp1DFDqL+5kGaMbEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000368, "uuid": "257dc452-171a-45bb-8c4b-1b81633e0b54", "value": 7286968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000368, "uuid": "070440f1-43e6-4090-a305-c7247871d5d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000368, "uuid": "7dd55352-f5b6-4572-a599-cb504a85e134", "value": "vulcan_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99d8a1a-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969668, "uuid": "46606f7d-e091-4169-8b89-8e32e7274c2f", "comment": "Malware payload", "value": "cbc0f3ab2fe1b0c0286c54642d70bc0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969668, "uuid": "b11b1067-0859-41b4-800c-9f0b6764a3ff", "comment": "Malware payload", "value": "5fe4e5d595928d084ef9dc977222d8738b92a9dadecdb17d0cce29f2988ce3b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969668, "uuid": "2ef966f1-927f-4df9-aa3c-f3a0d4c80e93", "comment": "Malware payload", "value": "1a11e6c9c17c32e88ed14c7a104c748246cb0906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969668, "uuid": "55e832a0-2e2a-46c4-8cfd-887aaf935ab2", "comment": "Malware payload", "value": "04cd7901c0d20587c0efe47f52addd935caf039b2dc43a89a5785dbc4c3aa752d956c4b558f5e5c26d93332cb0153ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969668, "uuid": "4228051b-6013-4e19-89f7-83fa86626b52", "value": "T1A7432A1B635181BCC816C27491362A26F436BC950770E9EFBB9A97215F787D0B73E0E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969668, "uuid": "461d3925-d74c-4fe1-b441-8be8322a0b0a", "value": "3c5a84cec6d7e9301fbc05ed25d65f9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969668, "uuid": "ce0a14f7-af12-4caa-a1c5-f2c3c001c055", "value": "1536:lnxTQs7/BTENC7fsCf3h9ZyO6WWnjux5dOHHeozVmdc:lxTHjBXfsyR9ZyO6WsWOHHeozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969668, "uuid": "a98ac895-5e8b-4c1b-9057-e7a760fc1729", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969668, "uuid": "e4252cf4-9253-4e56-bdcc-08401508ea35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969668, "uuid": "3b0f1128-e1eb-4e7b-8293-00f3e26af2ce", "value": "5fe4e5d595928d084ef9dc977222d8738b92a9dadecdb17d0cce29f2988ce3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e53c9fb-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "96a789bc-4459-43c5-b76e-241b7a3f0a7e", "comment": "Malware payload (Mirai)", "value": "753cd1c2abab2b708c7b1a183d84a536", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "0e293169-f379-4a2b-9611-60899e890661", "comment": "Malware payload (Mirai)", "value": "605f321fea64115df7664ed0f50d749e758f20258ee0191c31c51dcf44f4ddaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "15472ad4-fb65-494e-9715-7a308fbd3e89", "comment": "Malware payload (Mirai)", "value": "35c08afb8ec223c7a4d3047e6ae816e4376c9c2e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "d71866b6-9277-47f5-9bb3-5db8d3cb26fb", "comment": "Malware payload (Mirai)", "value": "03d3688dd8f38e75473c837dbb4301de3c5ec0f448e5fa51b7224ff8f206b555c3894f5a5973e174615ce087237dd7d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "01d326a5-c3f8-4e58-8702-05707695fbea", "value": "T1A631219066D06E78C8E852BF9D52471473649F84E0C732A3D6087718BD2EE7C5D1704A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "828bb4da-8a7f-46f0-a695-9515c70f1e76", "value": "24:vKGpa7Urz/jlfxXK1hH9Vev3gRGaJ9iMDBBuMvJlxrR+zz2KpQt:vKGpa7UrLZ2I+J9BuMvJlxrszLpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969032, "uuid": "78a09f37-2c63-485a-a2e8-9c546b06f508", "value": 1460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969032, "uuid": "68a88c7a-3cd1-4e8b-8d72-755accda8785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "7e397901-faa4-4932-8988-f5a7bdcd185f", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e70a99-5ac6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779994485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994485, "uuid": "a527a2e7-9111-4617-9405-bc3f81139abe", "comment": "Malware payload", "value": "2c47c8e206d2e327f57dcb1b38fd87fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994485, "uuid": "03665fb4-7e7a-48ca-b107-002960e159a5", "comment": "Malware payload", "value": "611098bda926daca63629bcc87546faa5c575fed6910893f87ffe81c3c87ddaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994485, "uuid": "4559ac27-1655-461f-a150-4c10cbd33703", "comment": "Malware payload", "value": "9082e2fd2ca660cfad5d56c1b383ff4548e43143", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994485, "uuid": "5f9c8df9-8036-44cc-9804-7f686b4f792d", "comment": "Malware payload", "value": "db043588fd25255b1c052ad55aa184669e269161a1d6e3030bb5270713429cf5f0b71a213c15cbe0af624d399f34fb9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994485, "uuid": "5287f9d8-5af0-4890-86af-0f1f1e656dee", "value": "T18D27CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994485, "uuid": "2b216729-b039-47b2-b241-a2e08961377c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQX:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779994485, "uuid": "f37bdc8a-7a4d-447f-98ba-896b4599c035", "value": 22052864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779994485, "uuid": "3031f112-5aa0-41a9-93b5-fbc3ce753234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994485, "uuid": "4d4f11fe-e937-4816-877f-4c5cdbe7eedc", "value": "611098bda926daca63629bcc87546faa5c575fed6910893f87ffe81c3c87ddaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf8e973-5a64-11f1-a769-42010a9c0008", "comment": "Malware payload (SparkRAT)", "timestamp": 1779952252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952252, "uuid": "baa1f0d1-58da-496d-8bb4-1690ef8aa6ff", "comment": "Malware payload (SparkRAT)", "value": "0fcca312d8085f3e0bc1eb8665538211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952252, "uuid": "2f983a0d-edaf-4710-b769-8bb82fc5b22e", "comment": "Malware payload (SparkRAT)", "value": "611a42a8710860c4d73f53f14d478d13166ee549006b6d48f518d4ddb7fa0dcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952252, "uuid": "5497b55b-d61a-43ec-9079-231db87a128e", "comment": "Malware payload (SparkRAT)", "value": "3edd83b0a62151fcc7a8e49732685db9b5c49eb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952252, "uuid": "b94e2f92-4faa-4696-b600-7ebacdd0ea50", "comment": "Malware payload (SparkRAT)", "value": "a4133e5816c4e739fe77acce84e6f0b39e51e815433653c48a21d7ce479859a10ae48f93f28d0724da83ac046e0c762c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952252, "uuid": "0b51be25-f901-48c2-bf0b-a6cddb3aee96", "value": "T1EE864B47F89181E5C0ADD130C666D2A3BA707C895F3067D32B50FBBA2B36BD46A79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952252, "uuid": "7b2a8169-86e3-4f2d-b341-5bddfdfcd966", "value": "49152:+/YyphSrb/TMvO90dL3BmAFd4A64nsfJpTVVOp6Z7arBNkLdw6f/8M0Hx0e3z+S0:XPOgZPqfeEGcAkpwuS/QRyMP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952252, "uuid": "4171f117-ac4a-40d5-ad1a-b75b646a74a9", "value": 8519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952252, "uuid": "95baf310-dcaa-440f-9ea7-21ad42b67b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952252, "uuid": "0e5595ab-6116-4bb7-a2bc-7c690021b2f5", "value": "611a42a8710860c4d73f53f14d478d13166ee549006b6d48f518d4ddb7fa0dcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dc4a2b-5a6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779956537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956537, "uuid": "8c1c441b-e0c7-4fb4-aea7-8dd6256d46e0", "comment": "Malware payload (Phorpiex)", "value": "82089be2f9ccf69250c0f8d1d37fe8c6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956537, "uuid": "8115d0c2-ee37-4a0e-b78d-665946074da4", "comment": "Malware payload (Phorpiex)", "value": "61657d4b1f8b622e044b38b9f2141269410136451323e7102e59794f41dfd32d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956537, "uuid": "4a66fc04-a142-4d5a-a7b6-e7220ced2689", "comment": "Malware payload (Phorpiex)", "value": "89f41b5b3959dc4c2d7b91f0edd94994350dfb15", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956537, "uuid": "25e55623-6b86-45b8-ab63-9280d3021868", "comment": "Malware payload (Phorpiex)", "value": "fc84dfa9d8ddc037b2c20b6b68bb003c224efc9ad8384b6b5d55497f8a4d7dfaa441ee7ddcfb85be8baaa7f3b6e4d352", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956537, "uuid": "d8e226e6-4e41-4b5f-8f21-5912d4cdd5f2", "value": "T1BD824A0FB9428216D1E210B05676863BD979987237C854DBFBD18AD90FA82E5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956537, "uuid": "0c47e578-c9b5-4100-bfdd-dfd8bc1ffb9b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956537, "uuid": "a9119092-f0b4-47a3-b74a-dc2e5ba66ab0", "value": "192:XKSSCngTBv5/dVfTHD5DIS8ukle6I93fKUSvu9zw+ggSmOiMbO5Ot1EdkF4U93md:VI5/dVf+juk0RSu9JgPL7NWav8U9cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956537, "uuid": "9db596e4-1c0b-403e-b705-cf1a4b26ba36", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956537, "uuid": "f6756567-93f5-4896-a675-eae181c7cb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956537, "uuid": "f23f39bf-2be0-41a3-8a68-00ed26c622ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7807d871-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966471, "uuid": "7af8362e-005c-461e-a9de-68cb07af188b", "comment": "Malware payload", "value": "30604cf98efd137b7e21556406011f6e", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966471, "uuid": "c9392a08-fd12-4842-aa75-4a94fd868307", "comment": "Malware payload", "value": "61d00390b3b86dc9e4a19ec491293a0054d2f03389b7610a032255d4ae1f1a36", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966471, "uuid": "f37e7989-aa30-408c-8462-790e706077a1", "comment": "Malware payload", "value": "280edd8bc126fa5aca9378b5ddb027c87ea728a6", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966471, "uuid": "c8166286-9bd9-498a-964a-2cd2c8cbbe10", "comment": "Malware payload", "value": "dc82ca032c010bb3805926bc674e65c0737e412f1aa11a4d1ee1c45552d264c0895c98b1702c427872db588ef86d84e9", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966471, "uuid": "497a9c98-546e-4101-a09e-f7658be9e7c0", "value": "T116C53377275E0C99C03EC8C32A888AF4F210615D1CDA059EA575166293A3E61FFDCFE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966471, "uuid": "5f33bf1d-07db-46cc-be8d-710041a52a31", "value": "49152:fsr7uej9JQERPXszyjq5OG3v8Drefaq5xAmP3BooknaafRr7b6KFoPadI:fsr7j9JQERPXsjt3AqSoymP3uZZfRr7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966471, "uuid": "4f56e159-c3ec-4bca-868d-30ed44e72678", "value": 2579849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966471, "uuid": "8eabc50e-490c-4b6a-9db5-de709d8fd860", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966471, "uuid": "f00c5ba5-fc15-4873-8f07-cb27885ee3c1", "value": "dk2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593f0631-5abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779989612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989612, "uuid": "771184b8-7b1d-4fa2-9a23-d7e2c8944ca9", "comment": "Malware payload", "value": "c0793920e09d4528be031e3ead87edd0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989612, "uuid": "d0beb645-5cbe-4260-b2a6-0942ae4e0886", "comment": "Malware payload", "value": "61db1447817fd3b40db67ed261238e15f6338dc642a7a5a4bbf0c0ea5248594e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989612, "uuid": "7fd2c7af-7894-4522-b222-1f86725604d2", "comment": "Malware payload", "value": "5078a8c4406dfaec56404f8e327aeacfb9de5061", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989612, "uuid": "2c0857fc-cc44-411a-98d0-e49fc9b3d963", "comment": "Malware payload", "value": "4ac7e7e9a56eef701bf1f512d83c6fa41e41cc32dee7660a7127e30c80e51bc78a2152ebb1cc2cfdf785e3ba1bb72f04", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989612, "uuid": "d03fb9ae-2761-444e-8736-2d94b0f56e81", "value": "T106252B47E2A344E8C52FC17487679772BA70B4694634BE6F1E94D7322E20E605F2EB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989612, "uuid": "4b3e5b8e-1e22-490b-bfaf-c0656c8b02e6", "value": "73e6e3dc010272b3b8dd4629c95768af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989612, "uuid": "25bc9e4d-dd03-4943-bd4c-5d943e485b4d", "value": "24576:wSa8Vr3PE75QvjlEh2HyXH8Q8B9LmyNQ9aR1gosP:wUVr3PEySh2HyXL8B9yoQ9zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779989612, "uuid": "44caca70-3fdd-4fe3-918a-b317b2f34638", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779989612, "uuid": "3b616115-6ae8-43ee-b035-4de80694df07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989612, "uuid": "ed66644b-8db8-43a7-9a2b-2e593afcaabe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49f4cf2-5ae4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780007429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007429, "uuid": "eedfe73a-7309-4a0f-93b5-4ee6246563ad", "comment": "Malware payload", "value": "95353f04087412d8adf9c9c4f01a1fc3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007429, "uuid": "ff1d32dd-a138-49d6-b233-3bc3777e98ff", "comment": "Malware payload", "value": "620e9a7dc1090c48edae5bb3374b9b0a7fc7fa3d1f4063f49e9fb10d11df8b15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007429, "uuid": "24209750-743c-4959-b6d7-d0b014b39b2e", "comment": "Malware payload", "value": "d9313fcea6c221a4f634eeb3ddff27007e3c76e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007429, "uuid": "63ad6487-229f-4f14-aebe-e1769fe2f11d", "comment": "Malware payload", "value": "c9bd3415ed52dde25243c1548b94d8fa785c2c6ae3e268cf1ae7c4497367d2fcd48dcdd9aaec438ecbae969d7712528a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007429, "uuid": "43063ceb-19d5-49a1-83f3-fcd96d01a294", "value": "T1C831CA9AA0B891418588CE40B0F54DCF773BA69061A5463AF8433EB780C9D6A311DAFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007429, "uuid": "b5db6d3d-c90d-46a8-930c-d8daea990c6b", "value": "24:T+kuoDdBHWtIf1CvRWFPFBM/hf/u/1bC/2/2waZf6fF81o7jt4gKJWwJbHR4BYWd:qq1m5No72A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007429, "uuid": "b55087f9-bfbc-490d-887c-4f9b7bbf9d06", "value": 1845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007429, "uuid": "a2f40c4f-b0eb-443a-9198-43d5f0cab5f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007429, "uuid": "a27cd0c1-789c-430c-b190-2e77027d33c1", "value": "620e9a7dc1090c48edae5bb3374b9b0a7fc7fa3d1f4063f49e9fb10d11df8b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b55e2c6-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931070, "uuid": "fdb0fc6a-3ae5-4c81-84a5-34d531a26260", "comment": "Malware payload (Mirai)", "value": "bd2823b5e2f70d39d6b077fc56f6ab35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931070, "uuid": "1b0cf7ee-f46c-4f14-b741-fbdddddb395f", "comment": "Malware payload (Mirai)", "value": "6297684517909983f054dd231a580d29267f960982465132a00e1455aa5ac519", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931070, "uuid": "a92a253d-348a-4524-bdd9-3e871217f560", "comment": "Malware payload (Mirai)", "value": "3e898e9cc1b8e3f918fab4505ce854a2ec68445c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931070, "uuid": "ec9b9e40-9736-4d24-a1a6-2dc4272e352e", "comment": "Malware payload (Mirai)", "value": "40bda25811ead51b7d7b1bc11991b52342aa6f999f6385c43c74942d4de2663886c58cee51dfccc06f853d0f1db37698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931070, "uuid": "8c6f74ef-8c93-4c4b-9ead-bbbcad641803", "value": "T1E4E3AEA3F30B1091C82346F417CF6B9C2D2315425F7B86E3BCAA313A2A365DE5915BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931070, "uuid": "c660e623-189e-45a2-ba91-5140c6303588", "value": "3072:2mE71HzadS14Fm1TmTaA+3oNwV6LuGn1I8g5CA0tBhlDub01eQ0qq:fix4I1+a7k6Gn1I/CA0tHcQ0qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931070, "uuid": "e8f5bb12-27fe-46ce-a8a5-bc66617d137f", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931070, "uuid": "df183123-0fde-42e0-b5a7-abc69422cdd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931070, "uuid": "1d257293-b8b6-4024-9543-8c9e1809b3b7", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbc94c9-5a6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779956874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956874, "uuid": "c79ca261-3852-49bf-978a-b4d1dff0ccc6", "comment": "Malware payload (Mirai)", "value": "6dcf2916efa5dd2a43e0a9fbfe18377e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956874, "uuid": "51d86830-9d46-411a-b13e-233b31efea8f", "comment": "Malware payload (Mirai)", "value": "62a93bf9b8113efcebe6b8f291d318b789d44cfc9ab47dfd3f5b541320079b66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956874, "uuid": "07674240-f102-460e-840a-a86959a25fcc", "comment": "Malware payload (Mirai)", "value": "60e9e17167545bfedc3ef1fa725b38165556a294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956874, "uuid": "cd0d3b0c-c514-4acc-9e63-86c05e25e7a5", "comment": "Malware payload (Mirai)", "value": "0768f779c2c6795237ef1371089951d219e50d94c59434b2b9b94ea2f4344de0977ca40b7d7c15d1729b67b4c502ba66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956874, "uuid": "d1167aee-3368-4782-800b-b5a64b9d3635", "value": "T1914302A2C2B7B4D286383274F79C069F3A47CBF8E59B74BB36804668D84F1181E5B305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956874, "uuid": "fa42c267-4d26-4d12-bb68-2b111cc02b7c", "value": "1536:8BL5WOAomafxtRkBGj2KXpx7sN53gTQbLw:8BLcaAGj2KXpV0i6Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956874, "uuid": "262dc09c-7148-497f-b376-362d0fb951d7", "value": 57268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956874, "uuid": "06ae1861-edff-42c5-9cd4-346d6a57e462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956874, "uuid": "25755d66-61bc-4ee2-9389-47bfc3fce68d", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c0bb0f-5a42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779937498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937498, "uuid": "cc6baf34-44bc-418e-9488-d512129d8519", "comment": "Malware payload (Mirai)", "value": "3e8ed985823c7871bb0c80b32aedaa24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937498, "uuid": "cf740d6e-daba-4623-992a-fb704594f887", "comment": "Malware payload (Mirai)", "value": "6329b4cef7d27ee11116fbd66b4ff07735ffe4063b1fb154047e856d57360ae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937498, "uuid": "12e81f40-25bc-4234-90b1-2b29b0947650", "comment": "Malware payload (Mirai)", "value": "fb81e384241fa3e9c922c505ec623b9dde6a4c21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779937498, "uuid": "3a350d45-184b-4538-88fb-ee8d6e71aa65", "comment": "Malware payload (Mirai)", "value": "ccaa55e0b503964f54300f5467d03d66789cc9e5f4e5c4c5e804b99b383ef29895dfac5f4cca7670af9964e1a7a60738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937498, "uuid": "8d77cef4-26f7-4adb-b47a-f6e358a41dc2", "value": "T16E937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937498, "uuid": "9ffa1187-e0c6-4669-b2c0-7220512a4489", "value": "1536:W/QCZaxGdvts3i5JPho4IxPu++ALtgUIKqI4FrS4LSN:WYCZa8dvm3oJPhdIxP5htSKfUmDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779937498, "uuid": "40966bf0-51da-4eff-8661-5aed5b44be1a", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779937498, "uuid": "93362722-ccf9-4757-ae55-41920a4e0686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779937498, "uuid": "939fd4a5-4ea2-4edf-9d36-d89ca43555d0", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24f4b05-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969602, "uuid": "8d7d91b9-4a57-4e93-9800-2d09f24f8487", "comment": "Malware payload", "value": "d370e7a800e016226081638c5a325475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969602, "uuid": "f1b900d3-cf44-46f2-8309-5319e09863e0", "comment": "Malware payload", "value": "63a1a7e93fba79e3776a9abd479b8d36b4007aa29b89d812eec3611c33c6ee84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969602, "uuid": "57110db5-2e87-4b3d-a6d3-737b4269d9cc", "comment": "Malware payload", "value": "782d868e41cb98245ce55578b6e50684517209ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969602, "uuid": "ae048a8a-a540-455f-90d9-d3a42971fb22", "comment": "Malware payload", "value": "704ce299675560ec10e7a88a03cd3a372ccc059a60612b4b8b9aa91547f07edbfa5a502ea650ca9d7137918f99a963ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969602, "uuid": "169a7c6d-6691-4945-8c1a-1b612e8a8291", "value": "T1AC42E804E79484FAF2FA13F888331B46E631BB4887A5E38E13A0414A5A1370F7526FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969602, "uuid": "b813f1b8-9278-448c-9da7-196afd4aaa41", "value": "0c90e89142e1e0bd6814a7bda9a2f694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969602, "uuid": "0c2b3b4a-7780-4a01-90b4-ae7b42b49dbf", "value": "192:avMzQwYDTXr6+chkq5K4ud6m6cSkvVdPLxmIcihToFBoYW0QW8nn6LW:aUzZUrr7CS2m6cSkvVdPLxmIcihToFjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969602, "uuid": "8d322c9d-f499-480d-ab57-db52e28c711c", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969602, "uuid": "7ec88bf0-a443-4292-ba1c-812776ad489d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969602, "uuid": "ca2b8c45-4bf6-4d44-b803-52ae4099242d", "value": "63a1a7e93fba79e3776a9abd479b8d36b4007aa29b89d812eec3611c33c6ee84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e8223b-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "d1bd3217-4b08-4d11-bbfe-884b3ffe5594", "comment": "Malware payload (Mirai)", "value": "4039f079a36590eb0ac43a74116655fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "56d3180c-3a53-404b-88ef-8feff2c783eb", "comment": "Malware payload (Mirai)", "value": "63b0c60e3e6f493aa2a4a06036fb40c681f6cc446fb5060ceae212d78a39e1f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "19f1466a-21ad-4cb6-ac88-39979aa58f51", "comment": "Malware payload (Mirai)", "value": "861608114e9ceaa1c3cd7fff3dcbec42469b9d6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970283, "uuid": "3cd731e2-f09a-44f0-95f6-203eabdf4a47", "comment": "Malware payload (Mirai)", "value": "b4bd1216b88193a32e8977ae1c099e324ce85a993e8a89d6d9e337f9100e584ebff5488bd8f9d5be479bab33ea910a6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "f51e23b5-42c3-4891-aae7-bbd45a79544d", "value": "T1B0A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "cc9553ff-a9f3-4c7a-887a-3dc54074e9d0", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0o9j:bbbmPTO930bkbRl8869j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970283, "uuid": "1ed97e86-c04a-47ef-bc52-94fc9f3c78a5", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970283, "uuid": "514ea337-6491-4b61-ba9b-b8fe04cf8791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970283, "uuid": "8f8f8b12-f730-4f47-8ad6-0542b0035da9", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c502d25-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "0c41357f-e3db-4c2f-88b0-3f37b9c73e63", "comment": "Malware payload (Mirai)", "value": "1bb000134df2aa8f70e877f8f7e6d59e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "13eef6d9-916f-4ce5-817b-32890b097295", "comment": "Malware payload (Mirai)", "value": "6402246840693890760b46e0d3392fb886eb9d973bfd425f7886535b9b2a861b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "586b0884-a128-47b7-92ee-654f8cdd3257", "comment": "Malware payload (Mirai)", "value": "2f150f7c82b82ef81f1ffedcedf08fb714343352", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969082, "uuid": "bd0ecea1-5ccb-428b-8984-246f5988b2d5", "comment": "Malware payload (Mirai)", "value": "60dbaee24cc3b529d321219aca842cbc88088cee561f95c28f253188d3d02c3e3fa52cdc9f3eb86eef07af9bc385beb4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "aa06c9c7-1e6c-47da-9704-f3ec592fd1ce", "value": "T161635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "9a2c9f95-8d06-489b-a042-1f1d97a2e202", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnPp:zGYxpTGASC4XTfyyLpIoYPsPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969082, "uuid": "07ba3873-b901-4e03-9842-27b897112e67", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969082, "uuid": "18d1cc1a-675f-4227-b7b1-00263639733c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969082, "uuid": "5bb32772-1b67-4bbc-83f4-eff82030b4a5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1749dd-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012382, "uuid": "7a69a6be-51a1-45bb-adf9-eb4a4ad2c0ce", "comment": "Malware payload", "value": "99f942f227f3c7595840593c1a77e5b1", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012382, "uuid": "83a2dcc7-33d2-4a9d-a4ff-97ad59bde49d", "comment": "Malware payload", "value": "642ecaab44fc4a09fce541bc7c639e77a5f9aa5ef28ca87b595df3c87afb12f8", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012382, "uuid": "e83a75ed-671e-4ea3-987c-bb4d17570c2e", "comment": "Malware payload", "value": "0307b9ea1e3f916e0f247cdb004cbe792d32fd9f", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012382, "uuid": "03a4b9b7-5695-462b-9249-54aa79908b51", "comment": "Malware payload", "value": "a82e86c94a388d1a83da8eeeefcb34cdcd026aa893b70556c443122f5c4875a7e2c56ba985f4bbf5578bea8842eee57b", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012382, "uuid": "41636eac-c46d-43c4-b08e-fd2cc4b9fcee", "value": "T1AC76334637A478FED939C0B28F1DC7A99732EA7412414DCB509C5F6B2EA7A2103DB1C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012382, "uuid": "1f985f86-46af-4425-b857-f9f2d1f24606", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012382, "uuid": "26cd9b36-af13-4e0c-932b-7a76672ca270", "value": "196608:+p8VXfNsbQPOSPyKxfKj37C5s6wxgqixWkSLFBVfvHaciH9:+p8VXf6bONPyA037C5waqgEl/Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012382, "uuid": "bead2144-0d1e-4641-827b-dfe28130c6a1", "value": 7212968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012382, "uuid": "6ab59cd8-2e7c-4251-962a-b195f1be15f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012382, "uuid": "31dddf64-5768-4127-9a64-36cafb544fcd", "value": "INUS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb0d373-5aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010153, "uuid": "80299d1e-d5b4-427d-b87f-29ddc495d84c", "comment": "Malware payload", "value": "5654844cb8bdef2cdd26e902524fd0f2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "grok-seescanf-cc", "colour": "#424C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010153, "uuid": "47e69c1a-6615-4096-bb88-68981d6aea3e", "comment": "Malware payload", "value": "667d9c727916cd2a568ac3cdc6cb450491648e5d7f973180f172f160834a28ca", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "grok-seescanf-cc", "colour": "#424C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010153, "uuid": "556ceb5f-6f94-4488-99f0-3478ab22d672", "comment": "Malware payload", "value": "8d6c235fb3229e3760eb74d7e6fe28eb50564a15", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "grok-seescanf-cc", "colour": "#424C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010153, "uuid": "60a05ada-df4a-4349-b8dd-68f12c7a6e54", "comment": "Malware payload", "value": "7c73dd36f2e59d125b1474eaea29a4ae344042fb3d8d899b8e25d79c0c37fd1d20553da1f6053f2aecaa55160f3a728f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "grok-seescanf-cc", "colour": "#424C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010153, "uuid": "560a3f88-f887-4c94-816f-86ba3fee9fea", "value": "T1C3873364C71E0447C24AB137385F1549BF63CA48D3E96E6F94EC0D9ACCD3BBB1A86606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010153, "uuid": "358397f3-c418-4a31-827b-fe9de2c2f265", "value": "786432:k/W1uolPlmMYGrAc1laYv5y86zz/SQkdk8QyNJLkyjh0XqL:kW1uolPQG8cLtv5yPPeKqJ4MMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010153, "uuid": "e0407259-6509-4293-bb9a-82980adf7642", "value": 38928205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010153, "uuid": "9c50ccee-836b-4b1f-a95d-002bcd9b1246", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010153, "uuid": "9a2c0841-0f48-47f4-a3a0-4d7f1dc788de", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05818431-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1779931919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931919, "uuid": "cd093617-7952-4060-a699-556263bb0234", "comment": "Malware payload (njrat)", "value": "379772f6081b3d98906ec7524956eba5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931919, "uuid": "db8162a2-a5aa-4866-8f52-a01199d8cabf", "comment": "Malware payload (njrat)", "value": "667f1f97d015b53c367e228ccef93007fe58300260598afcc85ced93854159c9", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931919, "uuid": "8fbc2492-800b-475d-8cde-c190af4fef26", "comment": "Malware payload (njrat)", "value": "3b57ba3fb219fd85d4c89c51380f4e92e0fa1f43", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931919, "uuid": "1c9b2f3c-1603-49f3-bb75-2b53b5c1d837", "comment": "Malware payload (njrat)", "value": "8655716bae18371543b1b800501439c4535947e19ca98fe54eed591a9c1484be687988bc84a5a6277513a754ce919911", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931919, "uuid": "401ff42c-965a-4549-8804-93226468326e", "value": "T106C5011C33FACB18F1AF4BF4A57189664771FD179C62DB6C48A2399E04B6F44AA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931919, "uuid": "eff8f4a5-556d-471a-a70b-d0dc2c17dbe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931919, "uuid": "5109418f-358c-4ee5-9d5d-efa598a44a78", "value": "49152:33gVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4U+fTZ:33gVUuHjkDGjYQDGuRxzewL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931919, "uuid": "ac1ab338-33ae-4dc2-b071-70e808f55a54", "value": 2508288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931919, "uuid": "fe2f2af1-7ac9-4cd4-920f-debfa9b2a99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931919, "uuid": "e7e5c4ad-2a4c-45e7-8789-1c752f4de4c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015d044e-5aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010081, "uuid": "a54ab054-ee8e-41eb-9ea3-45403d6583ac", "comment": "Malware payload", "value": "b5f6024f8989fb450089fd8ba31d9c32", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "pw-3891", "colour": "#6D3692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010081, "uuid": "168a2004-5f98-45ed-bdfa-71e28aecb19a", "comment": "Malware payload", "value": "66bb9f4695be4ef4343a13d0c4008195d12ceb90971b6bd2c80494f9dcea02ea", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "pw-3891", "colour": "#6D3692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010081, "uuid": "daca7167-9499-4f3e-87fe-27d94d25a701", "comment": "Malware payload", "value": "ed4d322e93484f035523feffd3e13ba98d41b1c6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "pw-3891", "colour": "#6D3692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010081, "uuid": "8dccfcef-18f1-41e9-94ac-e108b351de48", "comment": "Malware payload", "value": "67dfa21a9268f4fcc9e2e34263e9d238d0179923eb08d77edb4d5c725133a500d4c67b7da784596173511923c8cbc731", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "pw-3891", "colour": "#6D3692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010081, "uuid": "f92467f0-c9cf-44f9-9c9a-f1eecc61a093", "value": "T19107336B1849B95DD00BFF0EEFCD52B06503EFCAC8BD7D1F294CFA255A92AE48144681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010081, "uuid": "d0983886-dc7e-4003-a84a-cd51de0d7a07", "value": "393216:jeql/NUkwTsGb0mZBR3jGrKN/a845FDNvX:/l1UpTLbLMrVDNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010081, "uuid": "872a2e53-78fb-472e-902e-6fbce25b339c", "value": 18014819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010081, "uuid": "2c1ad3e1-70ba-4316-a777-65981b36f20f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010081, "uuid": "2b92fad9-dbe3-4e91-840d-3df241b71a67", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cbd566-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779961924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961924, "uuid": "a4780908-4a58-453c-ace0-e6af786d0ae1", "comment": "Malware payload", "value": "fe911e9f8b1b346109e115baa99d8c95", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961924, "uuid": "01e2b0c3-80bb-48d5-8b46-b19cb572b843", "comment": "Malware payload", "value": "675ce62d4dc425501aed62fe13b4f0880d6d8970e7d73ca0868d318657fb962d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961924, "uuid": "58f48c3f-e790-4a84-b3dd-4c311cf38de5", "comment": "Malware payload", "value": "fc4925b8536831634851c8e0bf0b544e0d2e95fd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961924, "uuid": "e09b42d2-5557-45e5-a6f8-8c5409db190c", "comment": "Malware payload", "value": "0d150bbacd188f45c482d366062c3697e46c9e639462d7b37880346efe15f8d75f0026e2f8942fb83ca9725f148d20fc", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961924, "uuid": "84b92b0c-07b3-429f-8d75-79b398e2e729", "value": "T16DC412067397AF52D087E53DCEC863F9145CAD299B22E10F7285778D2276BD20A6E31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961924, "uuid": "c1710543-9bfd-4d6c-9751-b1dc19a413ea", "value": "12288:oY2EcwekXhepkVpJYK4UVIGDDRykrXRnqb0vnd:OHtp6pJAUxlr+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961924, "uuid": "929bd1d1-103f-4de3-973c-823d00b21a85", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961924, "uuid": "c32ea261-a996-4ce1-b1f3-3d65325e88bf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961924, "uuid": "803eb729-4d0f-4c3a-9df7-1eade3b67c09", "value": "SWIFT-103-25052026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2478a3c2-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "7d245a5e-7512-4e04-b53c-877aa77bbee8", "comment": "Malware payload (Mirai)", "value": "ddcbe7ad4090e0b41dc8d1dae030d87b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "b5a24054-2df7-45a4-8732-471fb9414d65", "comment": "Malware payload (Mirai)", "value": "68ebcf207a3dba62b3560042d7f977833054b02976ff501ccbac54208d92136d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "ab877e29-9df2-49c2-9df5-a227b20d224a", "comment": "Malware payload (Mirai)", "value": "066814f07c01e24bdd8778aeecf417aa936c1e44", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "112cfbdf-b7fb-4621-82f7-c9985f32cc3a", "comment": "Malware payload (Mirai)", "value": "44ddc2556581f9e502164ff4cc6fd8fb67ffed968a0cfd7b4d8a7035a02c99f16ae505ee4706a88a137202687bf7408c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970626, "uuid": "97e5411c-d15f-4c9c-b556-b9036ad806b3", "value": "T150732B81F94B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970626, "uuid": "41d9af94-15c7-4226-af7f-f7c6c2bf7ed2", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHt:uVFrPNQn+WVQ3EXVUk29jgxOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970626, "uuid": "c0b78ae0-c659-4e38-bfb0-824f4d93aefc", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970626, "uuid": "6dee182e-b3f6-41c1-af8b-57456209f1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970626, "uuid": "1a0026b8-bade-4397-a8cd-59531a1d7153", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad490be5-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966560, "uuid": "0c6d9677-f789-4563-9b16-3de0be44be6c", "comment": "Malware payload", "value": "6783ee7a29cbe7937ef30ae11de3298b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966560, "uuid": "195a1233-f0cb-4fe0-a5ad-26cbb430d4be", "comment": "Malware payload", "value": "690bfb9bcd652da2ecf606536a64be7400d6c14b56d6d5dce34cd6602ec0ac6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966560, "uuid": "4117b63e-c708-476a-811b-555f42c88a31", "comment": "Malware payload", "value": "4f95abc81d4882686208cc2908989dd7b90fd2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966560, "uuid": "967b59e2-5e9a-4e6d-98b8-2479505785de", "comment": "Malware payload", "value": "027a82ed22b140f978e25ff2ca3dfa9a2a65b3505bf80e94b7297df57864e7fba046b68c384d298e5b9a72a99914f345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966560, "uuid": "473ec862-84ac-4166-8796-c69f156a5fe8", "value": "T13675024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA71F23BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966560, "uuid": "f8bbbec4-9a3c-474f-bbf1-57674535fe61", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966560, "uuid": "a57d84f2-0ebf-4d43-ba13-1bc2af3fd7ed", "value": "24576:eeLZKAy+5tmx1Y51t05ZtP7gQA+YXIySn46BKuKHXaMsG0TM2jlX6cL:1By8h51t0jaBm4MKuKHXaksjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966560, "uuid": "033cd859-39d3-4ad0-b4f9-b2efdf8a7993", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966560, "uuid": "d33b39d6-5212-455b-a0d8-e70ac5f79fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966560, "uuid": "1c70eb7d-bc15-4ccd-9648-b584952c65f1", "value": "sd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccb4dcd-5a66-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779953192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953192, "uuid": "03420d6d-da88-4faf-ab37-e5e779886694", "comment": "Malware payload (MassLogger)", "value": "6265c405f856cca22702f9a5a64d39e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953192, "uuid": "30fe2e01-8ed8-4ff7-addf-749328f2392f", "comment": "Malware payload (MassLogger)", "value": "6a2cefdd2b5810aef5388f4b23392847ae4abe6d4142ea7145e0afd04c00fcab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953192, "uuid": "eaa04110-1d55-4b98-b96b-6a4bcb1cd76b", "comment": "Malware payload (MassLogger)", "value": "5fde2edbb792d16ff8c4a1453aed7ad18ce4f31a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953192, "uuid": "f1820871-fe30-43d0-b9e9-2e2c39a8ebc5", "comment": "Malware payload (MassLogger)", "value": "9f8ed4a22877458ae1efe54992a89b97a60d1e4dc2030906d005dca5a2c8610ff4c6195f74a2b956221bb8330ae211b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953192, "uuid": "a2426700-ccef-4d22-81de-850a51506a38", "value": "T17D350250635ADA07C0D69BF40D71D2B41B785E84A912D713AFEBBEFFB87E7102901292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953192, "uuid": "2a86bbf6-45f3-4baf-a616-8e6d96595101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953192, "uuid": "32cff2b4-a360-428b-b590-1f71901fe434", "value": "24576:iAEFT0DkHOsV6s5YNZd3picX2xS+OPUwIXs8vO+zT/eLR0:i3FQ4FVX6ZVpiskbOPJIc8VzLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953192, "uuid": "2a8cb64f-8114-47fd-929c-53c1ca726228", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953192, "uuid": "12e3259d-1041-4724-8ef6-24ef31912eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953192, "uuid": "0c7e5d14-d0a4-4190-8064-9be407694b98", "value": "TLQ-3116-26 attach pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8415cba1-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972504, "uuid": "5422381e-f3e1-4f28-a3f8-166860e38c19", "comment": "Malware payload (Mirai)", "value": "e6c45b021fa09c9a5e6e9ccf4aed7cf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972504, "uuid": "5ac6931f-6140-490b-ac99-b2d03ab0fd1a", "comment": "Malware payload (Mirai)", "value": "6a77ba42b8640c16ff78741cf6c082827a85534a317dc39e6e3a8ceb352938c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972504, "uuid": "3fe985ff-54b1-4952-babd-a3c499e674ee", "comment": "Malware payload (Mirai)", "value": "3bb18a28d0d57f33082ef012b57e893a07145fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972504, "uuid": "5245a826-8ae2-485c-89df-498bb5dd99f2", "comment": "Malware payload (Mirai)", "value": "b0c578d0e0f883b1408397b8d6375bb187cf9c0b9d79060560e7f4a35f0f1c3b409098e348560befafa8abef071b3ae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972504, "uuid": "2e845487-edda-4949-bc91-b080e894e4ea", "value": "T1DDA34A11FC75183BC5C0723B51E34631F5B643A9267C9A5E7EA31D5CEF18720322BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972504, "uuid": "ff45ccc5-fe35-427f-80f3-d024d90f3aa5", "value": "1536:dLwSC8VPfpLGrDQMn+sCebInXgZAWmzTHf47O0NW56ApMPbi:hwIrLGriCNlF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972504, "uuid": "fd848377-3ae7-4c4c-bdcc-5e1ddd22215d", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972504, "uuid": "7afa384d-38b2-4153-9c5c-37ac4b17bc38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972504, "uuid": "a306ca4d-6a8e-4cc3-8816-1b309894fcbe", "value": "SecuriteInfo.com.Linux.Mirai.9853.31351.27739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83578fe0-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973792, "uuid": "e75bd983-b57e-432c-95f3-be3bd8b17f4c", "comment": "Malware payload (Mirai)", "value": "4f0dc1d8a155e21f8fdbeaafd6b920d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973792, "uuid": "a45ce1a3-36d5-4924-8624-03388ef010b0", "comment": "Malware payload (Mirai)", "value": "6aa3914ef7daf22b3e6594088c37d1a38f90bdc4e83f71c82984846968fccfa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973792, "uuid": "8245d116-5c2e-4220-ae91-f307345cbf9b", "comment": "Malware payload (Mirai)", "value": "4b80df39a0369f3dcf2e388e11dfae0d55be6034", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973792, "uuid": "2af0a2ca-8b6f-46cf-879c-a7e12feef353", "comment": "Malware payload (Mirai)", "value": "81267e6963c7ad624071d085a934d04dc6d921fae204fc9e6bf732ba41f0d0d0f6e7d6e75da39ff260131453fb431f5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973792, "uuid": "3fe3d846-d1d1-49b1-8abb-e53cffc6905b", "value": "T18653B74A2E719FFCFF99863497B38A205248379626E2C9C5D59CEA010D7030F745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973792, "uuid": "0badc81a-7b09-48bc-888c-92baa06eca0b", "value": "1536:Og/8Kv9X+ykHb44QyaRUwUyvAAa27oKolI:iKvB+NU55Uyv5a275o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973792, "uuid": "db7ba199-e1e2-4d0c-b443-5f79a680990f", "value": 64560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973792, "uuid": "f52c29ae-afa4-4c6a-8d51-eff5886b1099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973792, "uuid": "43c09038-663f-4574-a373-51c245b4120d", "value": "000503de34028005e123e8202ca18e8881a6cc8c11adb15f6b3a171fab745f20.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f7260f-5ace-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779997791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997791, "uuid": "40441f81-3223-4778-827b-67a5fe567ad7", "comment": "Malware payload", "value": "9ef6c754f6e71ffbc4bf42b5405df6c6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997791, "uuid": "2348ab4f-6593-4c64-9a1c-a9cda9e69b63", "comment": "Malware payload", "value": "6baf80c1eeefc7c02d0ad16cdc5e375253bf104e7915f8ececacd8f4b372d15c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997791, "uuid": "b5450443-6752-4707-a5ed-626011ff4be5", "comment": "Malware payload", "value": "841093175911833a74a434adc5b7d0ba057b0fab", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997791, "uuid": "ff821485-6925-474a-bee9-5610759b2150", "comment": "Malware payload", "value": "9d2700ff269ae7c32ec9c2fcefd5cb7e2938c30f110fae0fd94e383e9e1e4732601fccdf3624c0f1aa78f400864a8fd9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997791, "uuid": "058f9aa5-9088-4933-9d6a-b120b0b874d7", "value": "T1ECC58C0B6CE109FAC46A633289A766917B75BC490F3263C72E60B33C2F726E45D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997791, "uuid": "86dac796-2e96-4927-88fc-f7c88c447d47", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997791, "uuid": "ebd42519-1796-4e20-bbf6-b2f46734d8b0", "value": "49152:L1sdd0NV0FwgEAMEcQx3nqfN74xztQ6JLXJqO:L+MO0xpcnqlcxzBJL5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779997791, "uuid": "fc776329-13eb-4303-8c25-5b20bf4a8d5b", "value": 2556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779997791, "uuid": "a13d1d14-45b0-4111-a0f9-91d94f52726b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997791, "uuid": "0a87a5a7-3370-48dc-8f06-3ed1ad5e5ff0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd3d6e9-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779949543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949543, "uuid": "095555de-a333-4ada-85fd-4d70053db254", "comment": "Malware payload (AgentTesla)", "value": "b18e34c16b775f2307abcf3d52101e99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949543, "uuid": "4224b1f2-1abd-41bf-98a6-d3563c3aa4c4", "comment": "Malware payload (AgentTesla)", "value": "6bba90e398a1387232b43fe32f6cd8cdb0c2514524ea03939456fdfb1ef1790c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949543, "uuid": "415e93b7-3fc4-447c-a676-008e343adbc1", "comment": "Malware payload (AgentTesla)", "value": "3120910116f8995faa04e0e39c346037d9f9b6f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949543, "uuid": "347a1858-80b2-4c19-aed9-aeac76719e54", "comment": "Malware payload (AgentTesla)", "value": "aed192cb49360ea85797dd2d1fede89ca26fcca0dfbfff7e582a8ba2aa878244473f9da4819c2017e719e60b4a4139b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949543, "uuid": "d4055d37-f87c-4dd4-80db-d090da125ad6", "value": "T1642512692B039010CA5667355FBF1FD9D373DE280639824B8BA31AADDE37729E1D0E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949543, "uuid": "404dae00-6c69-407f-bda2-06019cf3f039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949543, "uuid": "a0e74f18-90c0-4940-816f-46a221166587", "value": "12288:2L0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wKgbkNEQCvoGFarGtY:FFJz7c5a8uGrx5HEQCvoGFxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949543, "uuid": "300f60e7-d9f2-4f6e-bbed-60600bac2a1d", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949543, "uuid": "d94cac21-f1e7-4b31-bd2e-384e52144868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949543, "uuid": "8aa95ce7-95da-4818-888f-117c03b5337b", "value": "\u00f3rdenes de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d031329-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969540, "uuid": "b986d1e1-0c81-4838-8d8b-e117c58cc2f9", "comment": "Malware payload (Mirai)", "value": "e756826fe38a88254cc6146ac0f53b72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969540, "uuid": "b4f8c0d7-02e8-4e15-bd01-646599b52ba8", "comment": "Malware payload (Mirai)", "value": "6bfb29b1665c33bd8d6117d986ec1e0aec5dfbe3fc7d40cd4922886f07161b06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969540, "uuid": "d8c483e7-c836-4869-9295-441d85b9ba09", "comment": "Malware payload (Mirai)", "value": "9f16984bf1d63b341d5f54d085ee46c71bb120d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969540, "uuid": "ccd6bb21-4ff8-4b2f-8030-8e651f372683", "comment": "Malware payload (Mirai)", "value": "dadf4baaf4f05be92195437a264ecb2bfdee9cd85c70b7c1724c8886594c629f81c659f1c64f2cbfc3e25bddfa69725f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969540, "uuid": "99405b10-dbb2-4579-90bf-547493edf4c5", "value": "T109932BA1B810DC7EF41BE6B784470B16B124A3A40F523F2FB527FD63DA790741A26D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969540, "uuid": "f53dd8b0-defd-42a3-93a7-24acb7ee3585", "value": "1536:z+VnZm4D5mvJvsY3C00prExQixYrrbZiOD42w+S1t8ilpB:aFZm41mv1hy00prEy+Yb9Dpw+S1FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969540, "uuid": "443f3b6e-9315-4951-815c-96ea3172da46", "value": 92192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969540, "uuid": "f0a9bd84-ff5f-47d3-8fe0-9f163820c690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969540, "uuid": "740e46c5-f864-40e7-9c91-86e2539f9bf1", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7e7527-5a82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779965032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965032, "uuid": "b52b592c-37f7-47c9-967d-7a527ce6c42b", "comment": "Malware payload", "value": "1e8a35bec88d2c936f0b9af96ef8700d", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd-extracted-rezipped", "colour": "#CC7243", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965032, "uuid": "ed6651e3-fbf9-455c-9051-6c4999bac80a", "comment": "Malware payload", "value": "6c88a492f753cb10db03eef496e24f04ea3170fe96fd439368a3769b75e66a0b", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd-extracted-rezipped", "colour": "#CC7243", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965032, "uuid": "8d75101b-6c1f-43ea-bf96-65ea5e07b7d1", "comment": "Malware payload", "value": "f28bddd5142882bf46b54bf45be221ac69686f70", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd-extracted-rezipped", "colour": "#CC7243", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965032, "uuid": "9ec1bfbb-7f32-432a-bb99-0023e08eda6b", "comment": "Malware payload", "value": "0799ee6876ae425634eea451e9cc8312da2acacaef380e0452442b5eceff703686efae994952ef42796ce5f5301a9505", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd-extracted-rezipped", "colour": "#CC7243", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965032, "uuid": "f66cb1b2-e0bd-477e-b96a-1d789d108e78", "value": "T1B6A63366DD07B9258CEB3AD397874211ECDA916606635A773CC2A3C9840D9F0E067F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965032, "uuid": "7451c236-39f7-43cc-a12d-e17831a32b1a", "value": "196608:Pc54v4Yoopaq0EOsPe2Brds4m2ZvU75T+LvaKuSxo3ZdQL6VDuLhOeKzRD8XvLQ:PVvyopismurxmYU75avUSxcZdS6wLArz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779965032, "uuid": "834c8968-7c05-4962-a27e-f8d3c6eb90b8", "value": 10360541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779965032, "uuid": "4993ed88-b367-4b07-a224-6f646893e499", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965032, "uuid": "6264c83d-5340-4bd3-bfa1-6f6322960230", "value": "Invoice-Vertex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061009d5-5a38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933209, "uuid": "f655be31-f8b9-4afc-ad0a-d4abc330a533", "comment": "Malware payload (Mirai)", "value": "bd54e6a51cf1890201ce68a1ea2a4a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933209, "uuid": "bfb7d1a0-78c4-4d7c-baf3-c90a85b77af7", "comment": "Malware payload (Mirai)", "value": "6ca4d2a3df42013d563a93c958e44d4624d96a5832aa164b2dae85fc380ddab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933209, "uuid": "43a3fb70-739d-423a-9632-768c3396043d", "comment": "Malware payload (Mirai)", "value": "d03b4e3a0d59ef8fb5c23b47cf480eeed3e0142c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933209, "uuid": "8372bfbd-8a8d-468a-b510-da72049f98da", "comment": "Malware payload (Mirai)", "value": "27c6437654f2ca5bf62d667d188414aa595ba3ad01054b610fe9484b9450b9b0693b9334c46e872720cc795ce731b31e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933209, "uuid": "d113903b-96b1-483e-b97a-be29402d5426", "value": "T181C32A81F98B80F6D9078C306067F73FCA3285798077CAA9EF949E35CA379815617399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933209, "uuid": "98d1d7f3-458f-4a62-a5a6-585aff7bc342", "value": "3072:EvC64lvvP5Ibby+JCUlURmgsY/7qSjGliRdS7X6Jb:Ea/5Ibby+JCUlKzsY/VS2Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933209, "uuid": "414be62b-f4d3-41c5-9008-84004831f114", "value": 128340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933209, "uuid": "2380b937-a145-4367-bcf8-41b0d66a3268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933209, "uuid": "4d159654-5d44-4e5b-bc82-0ba0064bf5ad", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f85e718-5adc-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780003662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003662, "uuid": "ee06eae3-fc18-45a6-a39b-2263fe2e1338", "comment": "Malware payload (SalatStealer)", "value": "51c94144fba3bdbbe6edd5da65bf31a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003662, "uuid": "2c517bfe-0960-420a-8bdc-fbb314844f14", "comment": "Malware payload (SalatStealer)", "value": "6d8ecdd14970065d66b9b2ecb3297a370d9a31241419ee6ec37a4069b7591085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003662, "uuid": "dfbc5774-f270-495d-be15-4120310fb0c7", "comment": "Malware payload (SalatStealer)", "value": "b019e4268ed15e5a477fe3c4ead20e714eac372e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780003662, "uuid": "43490859-e21e-4acd-91fe-079dcac01f28", "comment": "Malware payload (SalatStealer)", "value": "425f478e6308689eedaa47b8d258e40cbb7102d9c6f4d797c00c820c3fe48235bc3e648e61976395294536748a26e1c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003662, "uuid": "a55a2135-f831-44d9-9ebd-ddb44055a12d", "value": "T189C66B11FADB95F2E9035831406BB37F23315D048B28CB9BEB547B2AF8776A21D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003662, "uuid": "c394e8eb-4d9e-4dfc-97e3-2dcc387f0c60", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003662, "uuid": "a9861646-d339-4706-99e8-9ab883c2f01b", "value": "98304:fMWrvhBbL0C3Xh4u+ebJH2l4P3HNHKENO/:pv7pXKLetHk83NO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780003662, "uuid": "40206bc0-1454-4414-8a70-c522bad01826", "value": 12573696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780003662, "uuid": "616960ba-19cd-4d56-8f67-3c6643fa1210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780003662, "uuid": "16960fdc-0640-46fe-94a3-a2bc93fe3a38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3040b55b-5a65-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779952607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952607, "uuid": "c87a5d22-df6b-468a-9dd4-75a8049b3625", "comment": "Malware payload", "value": "cb3af0331ba5c2fb9fc06e618196a41a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952607, "uuid": "7f14c96c-4216-41ce-a78b-4d5537c66611", "comment": "Malware payload", "value": "6e0692783491afc794a4a83470ebb5f2fc4ada38e0e4a6f9d1a059c52c3fb651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952607, "uuid": "bd7204c8-ffe4-47d0-8540-dded32706a02", "comment": "Malware payload", "value": "e8f8d89627a74e0c5ae7f3be4196d1b75d677e82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952607, "uuid": "158f4506-dc33-41f0-bc9c-1a0009e16cb3", "comment": "Malware payload", "value": "ef72af13af10646d85f05ad9ffe82b34ed99cf3b04b2a1aa67d16468caafe9467f5c0554424009a5db45b6b8e4af2304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952607, "uuid": "bb62e340-404e-438a-afa7-800d748d4df9", "value": "T1FD28AD11B7E80712E67F8238D5639152D7B1B4472321D3CF348CEA983F63BE19A76266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952607, "uuid": "583844e0-d6ac-4b86-b253-0b00813333c2", "value": "354308318ae54a65b5d9ec5f6c43fd91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952607, "uuid": "57df055b-9340-45b8-bfe7-38b1eac276d5", "value": "786432:wt2pS9kMLfqpHCOdRIeoxOTx9ylpHf5M+xx/I:wtJ9kMyi5w9YHO+xx/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952607, "uuid": "0d2a69dc-a16b-481f-9e94-d486d03e6ce6", "value": 102414454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952607, "uuid": "bca464bf-ef52-4efc-af3c-71e4fbfcc86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952607, "uuid": "5cf7a6c7-cd8e-437c-84db-7353053098bd", "value": "6e0692783491afc794a4a83470ebb5f2fc4ada38e0e4a6f9d1a059c52c3fb651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edda99c6-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970534, "uuid": "907666a0-2e03-4f55-b3aa-3698b7cbed05", "comment": "Malware payload (Mirai)", "value": "fdf7ee73ac4e0dd2929f22abadc01d24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970534, "uuid": "1f411c45-ed8d-4f08-a2e3-fad81a196246", "comment": "Malware payload (Mirai)", "value": "6ef5b922ea10d149d65181f1f28be77d8fbe6ba27dcf785329e8666f0a65ce7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970534, "uuid": "6861b514-adcf-4701-a29e-ef1bfb820fa1", "comment": "Malware payload (Mirai)", "value": "edcc359f286edfa79e96c1460a75747099871430", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970534, "uuid": "98abbe9e-9354-4090-98fe-8eef7678aac9", "comment": "Malware payload (Mirai)", "value": "e06d324bde03b989438f7796f9abf2d0e26a768c2586124f4cbe89b8dd2c718989d4148420a8ab9ec8a27dc231a67a22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970534, "uuid": "057155f7-9234-4b06-9c2e-b7944e7f38ee", "value": "T1D9B3E085B210AE55C02672FCB1870A90A3B17E7B4B5A150B4473F9B46DBCCD47E0BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970534, "uuid": "b9a938e9-9b22-46a5-a064-8db7816fd5a3", "value": "3072:jx63zpjhO5z01nCU375P5wk5SOez7wu1:as5zqhr5Nzy7wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970534, "uuid": "51b929b6-bc8d-4231-ad21-66e07f88e5df", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970534, "uuid": "848bb156-0d7e-4e64-a4e9-214980f17174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970534, "uuid": "4b2a09cf-ff70-438b-b006-622a135cb135", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47488b49-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779970255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970255, "uuid": "0858874f-9680-4422-9d02-0f728b436740", "comment": "Malware payload", "value": "c2887fe2afb63ca20fd71cf3d0852b92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970255, "uuid": "e22d4085-0963-4565-8907-178f7fa5cd9e", "comment": "Malware payload", "value": "6f4de3f972e1acf8ca603ff87b65ab4b92abf303f98b87cc7e822bfd5828d132", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970255, "uuid": "f2d38d50-b375-407c-8bc7-6c981a6e9541", "comment": "Malware payload", "value": "6e396c5ba8e48adf4de051c2b7f3fced311bda32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970255, "uuid": "6999dfc3-ab84-40ab-9815-6308c61a8194", "comment": "Malware payload", "value": "4e632255d6cca24848b472ee495e12df9316fbd30f80458d6b061cd987ac7ba07168e50acd540edb2fdffc276fbf59a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970255, "uuid": "0e8e528a-b71a-4a6d-b6ee-2959f5046469", "value": "T1B4E3C7CEA5AAB0E845C1607F6C366076D5A6CC487ACB8850EDD4FB1DB85372ADCEC434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970255, "uuid": "97a9ede9-c1c5-400a-ac3c-c0c2833d5e44", "value": "3072:nWunFszRznAeuTTNzb6NE+60bPAh5w/fAMGzZ:pFszRrkN+/+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970255, "uuid": "12ab7f72-e76b-4e34-9b2a-26bbf69964f9", "value": 145957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970255, "uuid": "c878d6dd-abdb-4f53-8131-10f13fa3807b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970255, "uuid": "3695708d-e1a7-44aa-8e29-dfb7337ce36b", "value": "protected-code-1779889785067.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e488b449-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970948, "uuid": "18d747c4-215b-4bce-919e-bf6c3424e186", "comment": "Malware payload (Mirai)", "value": "0de82f3dc9aebec05111c4d843ff25db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970948, "uuid": "0b6bdd78-a894-4327-a30d-ad742b6a6ed7", "comment": "Malware payload (Mirai)", "value": "6fb9df7baa050b7f32067909d7b81f23efaea00f2a5bd763e255c694cc17f9aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970948, "uuid": "4e4f86dc-0a23-4add-a0b7-62c19c1ec253", "comment": "Malware payload (Mirai)", "value": "cf074b99721097a8f5d13b3db08f5200a0c470f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970948, "uuid": "c2b30c26-4243-4d25-a0d2-55caca44933c", "comment": "Malware payload (Mirai)", "value": "aef45f4cc3bf0704b36dccbb98bc1fa7a810eec5ff65c4417e53b26e779f228e44bf2a0ff421b9242979cf983937a48a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970948, "uuid": "05798224-3719-47be-9f74-b299e55c8cef", "value": "T1A7838D12CCB85DA8F4297D7520F48AFA4B17A044985B6DF73C4782225047E9CF6DABF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970948, "uuid": "3babc67d-b8ef-492d-9485-0b89bcd28651", "value": "1536:b2Lh/xuDotO+WWr5Zis6CHCMCZ6vDflr47OQAwPNJbeM79b9CaNEQfez:b2Lh/xuDotO+r3is6CHEZ6vxr4EwPH78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970948, "uuid": "08aff34a-4d94-405f-a25e-532d8f6adbe5", "value": 87256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970948, "uuid": "c45a52c3-c5ae-4983-8c79-811c4cbb47b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970948, "uuid": "a7428a7b-27f6-41f8-9f38-eb1ef8daa4e9", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4382fbc4-5abc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779990005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779990005, "uuid": "90fc4b66-94a8-4860-8ff2-b1676a0c8725", "comment": "Malware payload (NanoCore)", "value": "161a3fa385c4eda09aa8b7772ba70958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779990005, "uuid": "7ea11744-e349-46f3-9954-806120dc5d65", "comment": "Malware payload (NanoCore)", "value": "6fd44b4b2d1157b3d46081fd5c7b5fe1565adf1a8a38b54fd021f59fe680a2f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779990005, "uuid": "e4dd6ab5-0518-44b3-9d80-fb1c314f464f", "comment": "Malware payload (NanoCore)", "value": "60637b60c25229a335de4841775ed751bc460f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779990005, "uuid": "bda5cc61-bae7-4a5d-9364-d9ee0aea4ea1", "comment": "Malware payload (NanoCore)", "value": "d17d724a0b0ba4df0cbf8ff94fcbe716b48d9dbcf0cf53cbda55abfa23468110fc8153540af422008c0223910234d8d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779990005, "uuid": "b3ec5214-7818-4179-945b-24edd11bbff6", "value": "T1EF14CF6677A88A3FE2DE8679701246039379C2E398C3F7DE2CD455B68B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779990005, "uuid": "72aceaca-49ce-4c68-87e5-ae4496d06ea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779990005, "uuid": "5b766dc0-4c7a-40c8-baef-bb44e4e466f1", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI7ALZFSGH+2AgQ7S8xaP4W9rsD:MLV6Bta6dtJmakIM5nLZFFYSEY4ers3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779990005, "uuid": "335ca2e8-3c77-4bce-acc4-f74b187af114", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779990005, "uuid": "b02cadf2-d7ea-4da1-b4f6-078a63a85689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779990005, "uuid": "5782cff9-0e4e-4ec6-bb6c-57a295ad8fe5", "value": "161a3fa385c4eda09aa8b7772ba70958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7724f804-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969047, "uuid": "5c2b9922-8f2e-4a97-b1c4-5658f088190c", "comment": "Malware payload", "value": "d946a816cc2c20d8673f4510c60a9e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969047, "uuid": "ed40817f-d4f4-4ae7-a571-906b00897910", "comment": "Malware payload", "value": "6fd490e8ccc865a1a24233195ccdc7a6b7bab16c07dd004b3d053ee85224075c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969047, "uuid": "51de77f4-9ce2-41bf-81a7-ba754a613737", "comment": "Malware payload", "value": "328ae663ba21578c84b68e061c4fdf0cf7a4a555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969047, "uuid": "77fa3138-0207-4344-bcb7-9d6e4a1eedb9", "comment": "Malware payload", "value": "0d088e499971a6d04ae0f2a03edd82e326e84f19c400fde327c1f0ba282c6e24939db4f212d9be1e8efc1e15536da53b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969047, "uuid": "d0b8aee3-cd0d-4e06-b8a2-6d8496a7b4b6", "value": "T1FB75025A63B850FCE1BBC178CAA2050BDB72BC1507709ADF17945A661F23BE05E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969047, "uuid": "e1a2edf5-c8c9-4aef-88ce-7e618efa3c34", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969047, "uuid": "4258fcaf-570d-4bad-adaf-348189ac69e0", "value": "49152:ls53kJqHIUEgjfAH8UQVHTFj+klS2QdtcBlfxkgqXaksjl:+lk4oUEofA/QVHRjXQsGgqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969047, "uuid": "fc221adb-7af0-4d90-bbad-3d1bd62cc29b", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969047, "uuid": "5963036a-f133-4818-a835-2b7ff8de1f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969047, "uuid": "c0fcc948-af3d-4659-bc24-7a2bffedc497", "value": "t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947e7386-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1779969096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969096, "uuid": "624f21ae-3341-467c-aebe-0f52726b83d3", "comment": "Malware payload (DonutLoader)", "value": "e5b8995822e86ca8e2260c3b814f63fb", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969096, "uuid": "5cca9c65-c69a-4937-983b-e59dddeeec51", "comment": "Malware payload (DonutLoader)", "value": "6fe897bbcea84b3a07e87e5327592b8a58d4084b1c0e503a6d04281021fc2462", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969096, "uuid": "cfff5ebd-abda-462f-8656-56a89c04b59c", "comment": "Malware payload (DonutLoader)", "value": "05b7fae8da3530c6578d808c028372aa42329599", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969096, "uuid": "5d882e91-266e-48e5-a5c8-09ce6fd86dac", "comment": "Malware payload (DonutLoader)", "value": "9eaa74e8b911f5f5489395dd1754997069eb76dea1433e9a0d0ba2baf9b05692be58001e705c8f7042aeb5518c603078", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969096, "uuid": "c3d2ec99-9925-4d7b-882d-20630c0d0e2a", "value": "T16256330A1CF8D2F2DADCD35AACF21373F9B41CD4B3A931B9E899941837522F56C85846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969096, "uuid": "caa004fc-54a3-4328-b41e-d792bc6a887c", "value": "196608:eGdFrjsyFKJKTOYzh+yQF319Fqqb9cV0loEKaR7WE:3dFr4ZKSQ+ya3XF8Vc8aR7WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969096, "uuid": "4c19a193-c16c-40b9-99c9-f5df84c46971", "value": 6460387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969096, "uuid": "4cd8f5ab-38b2-4964-b11d-b56daf5b682b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969096, "uuid": "e6add3fd-c1fc-496c-a739-c638da219650", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9914ed9-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973909, "uuid": "fcf227d5-102e-45f6-b85c-6a7fbba68deb", "comment": "Malware payload", "value": "562432c008f2eb8cd3f852059335e9a7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973909, "uuid": "53a1b21e-ffc2-4d30-8a6e-8523382f9429", "comment": "Malware payload", "value": "7069f1acc60b8d19d8c31edd77db128a4519ecdde16d2ac52f5f807a7fa68135", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973909, "uuid": "b31ab20a-2c9a-4e46-8729-1828c5a98b19", "comment": "Malware payload", "value": "b69c437b5bdfcecd5bb23aa4f93e8ccc4879a7ca", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973909, "uuid": "f17fda10-2a97-40b3-9d5b-7a01343c9776", "comment": "Malware payload", "value": "42e9b93cdee686b55ff0abf40b79698484c86a8fb897c853a6778359a4bc76cb3d7943a8308ced65d76a7b01489b6daa", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973909, "uuid": "debb5469-b167-44fc-85f3-f63e9a3f5c68", "value": "T11994238801AD65E39E34DCF3A5D68F109A3F17D0A6E53FD396B52540FACE06ADD88407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973909, "uuid": "fc2b0353-5f35-4d57-9a77-c453d8068da2", "value": "12288:1a7r5Kwi/v41hsdh1BIlix9iephjycGtQt:Oo/wrsT1oi/HeZKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973909, "uuid": "1a5bea55-d595-434b-85aa-fe9a8580e19d", "value": 435626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973909, "uuid": "7ab69227-71f5-4006-8721-dcf8e3ea689e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973909, "uuid": "714523f2-7bcc-4f6e-b773-832d322a7a18", "value": "72ed946b7495655933878c3d2cd9d58ae2a29e8daf557a68b52a08fdea1de4b1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f526768-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969544, "uuid": "246c5f3c-e4c9-4574-8d21-6998f2a5ca8a", "comment": "Malware payload (Mirai)", "value": "22bd14ebaa9c59e772e8597ae99f30a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969544, "uuid": "b93b9a95-08f7-4ad7-88d8-dacd8b672d7b", "comment": "Malware payload (Mirai)", "value": "70a4046fd4bbe18d890efe6509e511a7fdb7aebd9b71f89740135fcd664e7e21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969544, "uuid": "fedb9578-8cf4-4ea7-9a15-3d5d756a1b6c", "comment": "Malware payload (Mirai)", "value": "f62fddae3ef19f6be9e68f72a237ed583052cd48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969544, "uuid": "2e5eccc8-20e6-412b-8fb0-7cd89db694df", "comment": "Malware payload (Mirai)", "value": "0429d0c00f1bdb3244fed896607108f652c6c23b469730b789861fed690541efb91d3cf2bdb618eb99e33078cbcad804", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969544, "uuid": "ede44efc-1a22-491e-bd1b-3b9471378e71", "value": "T115934A41736A8407F3A74DB11C3F6BF193DFD5A121A0A185A94EAB4F8231E326586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969544, "uuid": "bd762f55-2855-413a-8f34-cd26a6154814", "value": "1536:dUYZGveKtta9DikrLYIHiv2/deqNc9uzVN2T1NpePqHIK9zN9pFZzoE+:mYTKnaFdeSANn/9B5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969544, "uuid": "12805255-7180-4e74-80d0-54c100b28ddb", "value": 93216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969544, "uuid": "a25231ba-d59e-4d53-9c88-d00c320cc4a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969544, "uuid": "d867e22c-a873-4303-821a-3ccd143b6f36", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4c352e-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "7dd9479e-4566-4e15-af17-720e716f26a1", "comment": "Malware payload (Mirai)", "value": "9b4c46a3fd4af2215695a4dbcbbf545e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "8d530c77-c9b9-43f5-9694-0c3d8d0e0f3d", "comment": "Malware payload (Mirai)", "value": "70b2b06e2b4aa0dbad773c6b9ce224bf0ca4ede4f4dca5d074fbc19c173b9607", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "ad4fe870-def5-42e7-aa3d-a0541f83f168", "comment": "Malware payload (Mirai)", "value": "c39c828e8dfaeb60831ca32d2f10d1b8788241bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969512, "uuid": "1733dafb-4ac4-4935-87b6-d4e3ee9109a9", "comment": "Malware payload (Mirai)", "value": "4c874af7d7072c3efbece9340377d57feecbb50c0d9e4e3426fe179865cff3bce5c3f8f0e9563a3447ac51c2a1b157af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969512, "uuid": "01e1b12e-82ab-4f2e-b277-5d4e02e32e34", "value": "T17FB3D90BAE529F7CF32C83354BB78B399759239533A0D585E26CEA105E6034D286FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969512, "uuid": "159d4e25-eb0b-4070-9e65-e3b38579b437", "value": "1536:H/2dM3v9Om8yXe6q56qqZqT8x//VE2oY8ccOZxisabUkpxT7HrkrjSgRu:Hekv9LXvfXIOZxisTelvQjS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969512, "uuid": "b0ae1e93-b1c5-416a-8123-b4bc11ba69e6", "value": 114004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969512, "uuid": "6ef8a248-79f7-494c-916b-002544b20e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969512, "uuid": "b95fa9e2-dbac-4f21-ab87-6fc0f9bbbd01", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb0b483-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974509, "uuid": "071a502b-bbb1-48e0-9e3f-53f1905740c6", "comment": "Malware payload (Mirai)", "value": "f78c041ea62b093dcbc2265c4beba55e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974509, "uuid": "52f1be8d-2d04-4c60-8151-77e2b4788eaa", "comment": "Malware payload (Mirai)", "value": "70d0d91a05a442f352e81df128329361034861c26eddac37441ce3ee737b3235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974509, "uuid": "b918330d-2766-4e65-81b4-c4607d6c4cb7", "comment": "Malware payload (Mirai)", "value": "b4bde32590746fd5a33adb5aa16fb909af719f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974509, "uuid": "92ba7b4d-aada-431d-8bcd-4891097cabd2", "comment": "Malware payload (Mirai)", "value": "b96c9c5a2ca8d5c316551c907f878c25cb0f5d76c56b9a75a9cf6e11f2b68a3cdc183012d189ec605d920214b63bf53d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974509, "uuid": "553c1dbc-22f1-424e-9942-54ef6f52e8a5", "value": "T1B6D34C46EA408B17C4D61776FAAF41493322DB54E3DB73028D289FF43F86A5E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974509, "uuid": "88ba1bc9-167e-4026-aae9-2060016f721b", "value": "3072:mgn0A7pzOszjSv4d+TfJvWaFdCAnhEJhLfHCBaFddiY/glFnb14wM/9b6C3:mgn0A7piszjSv4d+TfJvHFdCAnhEf4a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974509, "uuid": "6e7a5857-d78a-4887-9eae-4df72fc3b26a", "value": 140885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974509, "uuid": "c141c016-435d-4453-aace-b13b7e2a26d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974509, "uuid": "1b4d7a32-a944-4a99-8cdb-466c97e2ae0d", "value": "0040611ca75906dd078983aa19376168837aa4cf1882baaffeaa00ca6607041b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df6be02-5a9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779975393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975393, "uuid": "d8610b95-e889-4369-b9b3-37fd4ab1d557", "comment": "Malware payload (Mirai)", "value": "a5bf2dc99f419e1bface7cea7078f5cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975393, "uuid": "ef21f79a-4752-4d2e-96ee-78da8ce47485", "comment": "Malware payload (Mirai)", "value": "71336a558d000a7b075c59e9e365686a73581b799a73ce4ffb7415090e01b6c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975393, "uuid": "8d60d1d5-4b2e-4dc7-9c7a-54bc0595bcd7", "comment": "Malware payload (Mirai)", "value": "d277cab29faa9cf80c344d5a7aecb3102f9f5d8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975393, "uuid": "207d2e95-0e57-4278-b348-2c7f7310d1b2", "comment": "Malware payload (Mirai)", "value": "f2882c9a6ff69e89f730aee9495689fe299b0a31dc2f975dd931007730bb3390c4119f35daf9a085205a0e67605fa12b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975393, "uuid": "5da60aa7-4b1c-4e1d-9ba6-43a948ec128f", "value": "T12EC4080B2E318F6CF67486314AF30935DB6833D623E19685D1ADD1242F2069F995FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975393, "uuid": "a9f0e0e7-7ec4-453b-b354-6d7390001472", "value": "12288:Gifq8O6BVwga7lKnROY0xG34yCiJKU5hqvmk:xwlKnROcfCiJKUzmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779975393, "uuid": "5b073ae4-2543-4596-9d63-99752ed53ec4", "value": 581020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779975393, "uuid": "93eacefc-a8a3-4cb3-92b6-451d6cc0b0f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975393, "uuid": "4b86b3c3-77e0-41ac-b16d-7d7b9a58ab49", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc856390-5a86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779967069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967069, "uuid": "2a548238-7d26-42f2-ae82-81d95abcc7fd", "comment": "Malware payload", "value": "c82f875ddea10e32230be104ef80af93", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967069, "uuid": "3b202298-51a9-4165-848f-b0b729a948cf", "comment": "Malware payload", "value": "717e2ff320f68260983efaa5b8710e09a2aaa2f75baac5061a5289770dcbed85", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967069, "uuid": "0a145c98-7d7d-4a36-a7ae-9435d9e5f25b", "comment": "Malware payload", "value": "a826e41960f42890b5154675967a017ecf5db49c", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967069, "uuid": "51f16402-5213-4d02-b619-a828ec19b98a", "comment": "Malware payload", "value": "8bee7ccba8dc99a1a642f05455a09bcc9719b379fe478299264d0417141ef87e77814275ae06110676515bd508792dde", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967069, "uuid": "9cc59d09-8a30-4658-b85f-436d9a31b22c", "value": "T10BB18824E6A40C6C7097B0DD460F805A1E5A39AF9F56BF26354E03739F8EA3CA730C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967069, "uuid": "e0431426-3ec0-4629-9e94-0de3accf95d2", "value": "96:funjlSjTIL8qV0875D6G2kzNxQz4SGxVVVPI/KscRYpCbmvP/oBWWL1p9ygNwnit:WnpLpwL/e5wYq4MV2XteMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779967069, "uuid": "25787b95-56b6-4d3d-8f8a-db6667285695", "value": 5107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779967069, "uuid": "1f04d684-073a-4719-9e70-40b3c1e724b8", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967069, "uuid": "e43fbb6a-f53a-4134-8668-a60b40c871c4", "value": "definitions.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879d96ce-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946311, "uuid": "65fec0d6-7f69-4990-ab9b-25fcc186bc2f", "comment": "Malware payload (Mirai)", "value": "02eb3bda29aa80ad800fa7c6bc3b49f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946311, "uuid": "00c95292-e3d4-4691-9eb4-86a029a944bc", "comment": "Malware payload (Mirai)", "value": "720eedfbb23229cdaf925160043f19987e109520149f02d44f735e7e9393234f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946311, "uuid": "cb6d1fbd-71e1-4729-ac16-f947b80933c6", "comment": "Malware payload (Mirai)", "value": "bc28c425a02ea0aa91024b3408bdd552c956a86d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946311, "uuid": "fd1a194b-c286-485d-ad1d-d715533669e9", "comment": "Malware payload (Mirai)", "value": "fc56f16a1190b7586d6c0d91ea4629ee7266dd5c08f9420e90906bd57b18ca0225097b5ff12354d9834e78535cd72788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946311, "uuid": "f93d17d1-639e-4805-a824-39b632da428c", "value": "T17D439E65C9A89D64C21845B4B614C53DD323E404AAE33EF6CA46CA5AC06FFECF0997F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946311, "uuid": "20a49945-0b94-4a13-9f55-633da388117b", "value": "1536:J/At4MX2Ma+Kb7gv7n2ppfs3Gd4o+kwfzPC3U2:JYtN7d0I7n2Tf+A4o+kwfzPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946311, "uuid": "eb44b6f9-14be-4687-bcc2-f74f2453d70e", "value": 59644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946311, "uuid": "cf556e9e-c111-4616-94db-7e4d03adc5c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946311, "uuid": "98191918-2c4e-4b61-beb1-47542f97096e", "value": "uranium.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef445d99-5a2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779927587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927587, "uuid": "a3df8360-83b8-4079-bc6a-7a697f45a3a1", "comment": "Malware payload", "value": "64168990fc484e7c62a61f55c535730f", "object_relation": "md5", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927587, "uuid": "678b3f96-f60c-4938-a449-638cc284bc3a", "comment": "Malware payload", "value": "7213e78737d5364647a6b0f8a777f133f9e60cb33bb0507d12154faca2c9da3c", "object_relation": "sha256", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927587, "uuid": "089b5e98-2ab9-4150-a43e-98c9dd58f44c", "comment": "Malware payload", "value": "6fb32626a30a0aa2fd4117dce618de229055e10e", "object_relation": "sha1", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927587, "uuid": "9ef89467-4dff-4676-89ca-5180cd058d05", "comment": "Malware payload", "value": "ec21bb432b6ca6ba06d28571296a63d8e1fcbf76e07f8f03ff9adee38e8f8321b45a2e272bfa1453cb27b012b14c7b10", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927587, "uuid": "d4770d83-7068-4ead-bee7-35d4e716fbcb", "value": "T151558C5573F84A15F1FF1B75EA7251088A73B95AA934CB0E0859A40E0F72F808DA6F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927587, "uuid": "1526876e-70a9-4c07-b818-55875a2ce5ca", "value": "24576:dtkGwtHaDS7kmpngU0/SZilOBonsVSlEI6:TA7zFz0/S2OBonsglEI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779927587, "uuid": "54a96ed4-7a6c-4077-a5ba-bacf975395f2", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779927587, "uuid": "28dd5bcf-305f-4970-a592-9868b31108c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927587, "uuid": "c9b95143-b16a-4357-8f69-2034cf6f165d", "value": "7213e78737d5364647a6b0f8a777f133f9e60cb33bb0507d12154faca2c9da3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ed83e0-5ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780002005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002005, "uuid": "fec0dbee-e1a4-413a-ba96-6b2850c27b8c", "comment": "Malware payload", "value": "5cad41aba8edee99fced1e07f076bf8f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002005, "uuid": "61c6f993-718f-4b26-a799-6f900f7bd7b7", "comment": "Malware payload", "value": "722160e50ac308f41f17b961ff0fa04be3e56d6375587cb2ff255eec8bf651bc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002005, "uuid": "8609afc3-9733-4f6d-b98b-26e6da8d5c9d", "comment": "Malware payload", "value": "2519963276cf12970cdebcc9a0ce5795cf23dd44", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002005, "uuid": "56292530-6f9f-4df4-b8ac-ce2cc271b06a", "comment": "Malware payload", "value": "da1b6f28c4d66819e3e05c225f874b8203a15f4734af1925aec9a40563f60de27e488db006cf934ed9159a60a302082d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002005, "uuid": "3198ca20-7479-41b2-b5f7-47d78d4fa887", "value": "T1D1A30441F7F94119BAB72F442AB946B8493BBFA2253DC9DDCA500D4D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002005, "uuid": "01f89c8e-cdd3-403f-a78b-6afa4615b21a", "value": "768:i4CRWahF0TVpw4+U5kXznCXMf/tkof3G7qIQYcLVT5kRGakAQVOm4iJRKJfSdc23:V1FsAHbzsXSNZLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780002005, "uuid": "d0483b82-780a-44ac-928d-72f279f74aea", "value": 105838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780002005, "uuid": "20a7a793-0b60-4edb-a6e2-94fe34497877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002005, "uuid": "a7e28d04-a86f-4a5b-baae-9068c2f5a245", "value": "rlembrete_4a0f19a2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb98321-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780012301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012301, "uuid": "0d308575-6229-45df-b54a-21f573bc7d70", "comment": "Malware payload (ACRStealer)", "value": "c68b5ad9c5c041875d863c190bf627db", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012301, "uuid": "ef320843-c3b1-478b-b93a-dc39ecdbd530", "comment": "Malware payload (ACRStealer)", "value": "725dc07c0f1b552ac6df04855134a866679c97b320c27514050c43be51516c91", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012301, "uuid": "6ed13667-8022-44aa-95e7-4cc72031f305", "comment": "Malware payload (ACRStealer)", "value": "888f690169ed3507b4a83c032e4ead344a22d65b", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012301, "uuid": "35067403-af2b-4b05-97ac-968bdafb1ce6", "comment": "Malware payload (ACRStealer)", "value": "56c542b67e3ee4b925c9ebf3837580cd8870277622e87559f3b42c2b345068acba9bc8aa22ae764d1176ef322ea5559f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012301, "uuid": "c5390d2b-8fcc-4ac2-8698-b3299fa2b111", "value": "T1EB967C4A7CE049FAD0AA533288A362917B75FC490F3263C72E50B6383FB66E45D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012301, "uuid": "6e23a532-815d-4e6b-99af-5c130166a737", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012301, "uuid": "b0b973f0-9d3b-4bff-85ca-019d3c0f5bdf", "value": "24576:B5eppoC5egD8eYUVFfE9DQ9mdlhaAoJI7pfnBele5yK2tFDy24:B52pt5v8eYeJQk9CcAo+CXZyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012301, "uuid": "57eea163-4907-42c2-ad57-f72db96d0fd4", "value": 8626304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012301, "uuid": "e1746d84-6469-4652-ad96-38cf22d59ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012301, "uuid": "09dec4da-2f05-48e0-9053-d4723be7f8a7", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28d36c4-5a30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779930089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930089, "uuid": "2a330f8d-d9f1-40ec-ba06-44bbf631addd", "comment": "Malware payload (Mirai)", "value": "b620f8db59e703cb8bc6d04dcf91aa97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930089, "uuid": "fb45da2c-1336-4efc-97ee-142747ddba02", "comment": "Malware payload (Mirai)", "value": "7358e2d3808a50712cdb6f86be4961e36622b4214408c85ec8731f5c9ebd3b85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930089, "uuid": "c4aba275-c7b0-4360-94e9-7266d546417d", "comment": "Malware payload (Mirai)", "value": "28fadccc89d94711038d4b29cb497422db394d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930089, "uuid": "c5e71d27-2cfc-4c78-b814-861ccb20aef7", "comment": "Malware payload (Mirai)", "value": "94ba6edf828908bbce07b542e26ebcd529dc4ef3008ecd3ef842c92624f3a99f014eae9ca5a657976300a3d5707b6b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930089, "uuid": "46c49611-adeb-4786-bef7-b7283735d25e", "value": "T1082302D743ABD524CD7E923F05D97D3E1119940D4EE80E7FAD8A7218142FD2A323869D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930089, "uuid": "c0f2bd41-1811-4aa2-94e6-4104695c13a1", "value": "768:cUCVmUhsuq0Tevf5uGg7GGCT/u1uwrOsWiTTt35zvcfzZIC4V5fDNwTr0SFnbcuf:cZVhuKepufpCyzOsx13SBJTr3nouy8os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930089, "uuid": "192ced4c-b101-4c52-8752-b92d8f95589a", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930089, "uuid": "8aa2d985-86cb-4701-a840-e11767bc1738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930089, "uuid": "bfab16d2-4a69-4060-b426-aa01a918b347", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadcb0c4-5aa1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779978636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978636, "uuid": "d6aee6b4-de70-4fa4-b74f-e4feeb35edf9", "comment": "Malware payload", "value": "d031296e562b596e535a938323b9228a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978636, "uuid": "570b8415-8ca7-4814-904f-9d7f1d376198", "comment": "Malware payload", "value": "7368efd7b91d1de55f6502181641269b4547a4d67b77628c595b2e5be6716053", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978636, "uuid": "e9b449c9-3b29-4ab8-a604-8a82b37eae1b", "comment": "Malware payload", "value": "f99492b2e15cf623ac04211bd20af9a404210be4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779978636, "uuid": "3d6f5b8c-5443-4db3-82cd-b09782fcac62", "comment": "Malware payload", "value": "cbfeb2e3a90946da7b020a08f7036fa515609e8e7b70b181b388f6f1e81c33a3a4792ae02f729d8c9f63e407d14138cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978636, "uuid": "fd808fc8-db7c-4839-89e6-6160b77cba0f", "value": "T112136C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBF8B3CF18C15A9CE61871C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978636, "uuid": "4418431b-4daa-4c39-a04f-6f26ae51bfa0", "value": "768:Jr9NyXsZztCM9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:BHusZEcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779978636, "uuid": "c4380a90-fdba-403e-a7e2-4035929c0198", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779978636, "uuid": "4538d545-c434-457b-98f1-a4ebf1b1978e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779978636, "uuid": "62bdc00a-f595-4b92-8b84-e99e41b42ba8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e1c045-5a90-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779971090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971090, "uuid": "2c41a407-8724-4dfd-a7fa-6e2179daae0d", "comment": "Malware payload (ConnectWise)", "value": "7a9d870deb779cad7fad392c87d020bd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971090, "uuid": "9e3842b4-592d-49c1-a7f6-e1c291dd55d5", "comment": "Malware payload (ConnectWise)", "value": "737a0ad226bc63ed710d07768f01608dac0bbc90cc58dab4623c0093dfbccbbe", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971090, "uuid": "0fbe7c17-522b-4a82-b7b2-f554760b7230", "comment": "Malware payload (ConnectWise)", "value": "b8254404a10ca5b3c4a73d77471ecc76d0f25055", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971090, "uuid": "b208b3d6-fae3-44d6-bb09-cabc53d4fcc3", "comment": "Malware payload (ConnectWise)", "value": "72261c20b92b6f2878327090ec29988dccb3727591bc7285c5f596235fb1ee56532fc9405365243f6ec140a825514b92", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971090, "uuid": "33322069-0140-4bbf-9123-c33e6e1d5780", "value": "T1E3646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971090, "uuid": "c4c9a332-8346-4db3-a1a7-627cd212b18f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971090, "uuid": "63e6c8fe-9d39-4825-902d-216725f552b6", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9k:p1iw7gryNkSV1hy1Z1u2JLu9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779971090, "uuid": "01f8672b-68d2-4692-95b2-3ae11eb3a2da", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779971090, "uuid": "f9eae03a-6dbb-4a74-b7a6-d2d3cd0e3e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971090, "uuid": "7d7cc2db-f8d3-4da0-9e01-f1e77797d23b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f4c18c-5a82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779965345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965345, "uuid": "eff4888a-dd0c-4db5-ac1a-39165cd96aed", "comment": "Malware payload", "value": "bb448d4f8845cb3bcf62e1fc0219bf4e", "object_relation": "md5", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965345, "uuid": "340b383d-51f0-443d-970e-d4c6ea907b04", "comment": "Malware payload", "value": "73970d425e073416ceaf2f35f29fbfdb1f4711a89f839a915addc6688be489cb", "object_relation": "sha256", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965345, "uuid": "cd05254c-b8aa-450f-be5c-8da38976a53b", "comment": "Malware payload", "value": "d52b758afd73b7bcbe5974a8fb7f90b16c3db345", "object_relation": "sha1", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965345, "uuid": "2d4a35c3-a26b-4300-8c94-7f16a4346497", "comment": "Malware payload", "value": "e78a540763abd15707b757408fad3b85173b3449f6ef170419f4f0a859bd584cbd08f32632a04ad061133dbeb6a04904", "object_relation": "sha3-384", "Tag": [ { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965345, "uuid": "9ffd9ad8-a04a-49fe-812d-3684083e735f", "value": "T13C04022F202B243AC42FDC79F7C4E8A4C9A778F9DFD802664E41967464E78958A4C1B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965345, "uuid": "999939aa-fe42-48b3-bc51-8c9748f37fd6", "value": "3072:37dcN5l/d8TS2LuwZJflVrWKOMsKIeMbsdbwcI1TsYJbNBZPcoL1Ja94zBy:Sv622ywZJjlO26bimVsYJFPNC94z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779965345, "uuid": "47142d16-7231-40d6-b783-dd0735b9bd4a", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779965345, "uuid": "22abe16a-5eee-4983-8090-37c35d777e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965345, "uuid": "e9e21035-b6d1-4e5a-be70-4aaf6fc9c0e5", "value": "UMPDC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a150bc6-5ac9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779995653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "8b138502-a73c-497a-871e-998d5db91b5d", "comment": "Malware payload", "value": "75f5866c88aa9e38ed28ba6af9b3c620", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "1f5bc55f-0c82-479f-afab-d09bb4b81386", "comment": "Malware payload", "value": "73ad1a361a24e5d558eb1e0ef184f90064d1234cff82f228957e31afd1525a29", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "9e1d111d-bba3-4147-bc33-f895181f038d", "comment": "Malware payload", "value": "3dbf9e081f9097e91745df28afd75a0490cdc9d1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "0f79a34f-6910-4d01-b8ff-3cef6e34ec54", "comment": "Malware payload", "value": "bd7bf94a51470d19fefb3e098d8522606a76a913af77a9c57f7b0ba61ccf1f5a6efa61574b5f7be37a5fab87f534b1e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995653, "uuid": "de6f3d66-d87b-41e0-9ae8-70a1cedeb154", "value": "T12902AEC6D190AEBDB8B5DB2AEB81FAF54B00891F3E5C53D0805AC5195582F7B3F02167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995653, "uuid": "d9243c5c-acef-45e4-ac56-a0446ed87e31", "value": "192:/G9ORFsAUB8ym4Qo0wTXAfXSIJhgtTlphuiWYCJ7MTTMETcb:kORFsfB8mpRWFCtTlpVhCdETcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995653, "uuid": "2d45073c-3582-465b-97b3-bf41b01545c6", "value": 8943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995653, "uuid": "5e7e9734-8c59-4209-be54-9fea0ed52b44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995653, "uuid": "2c77d186-f96e-4eff-b7b7-7cf92facb497", "value": "202690_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3eafb1f-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961928, "uuid": "db48f738-203a-4a5c-beeb-54fc9543b8cd", "comment": "Malware payload (RemcosRAT)", "value": "ecd762075825d47854be0496b6c8eac2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961928, "uuid": "649f80f7-31dc-4957-8061-22e3ab58ab23", "comment": "Malware payload (RemcosRAT)", "value": "7542668fbd197ff685a84163b8b5f309bb126035fe69dbc6c548d39d8092022e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961928, "uuid": "0cd40cd3-eba1-4582-af00-b833b90efd89", "comment": "Malware payload (RemcosRAT)", "value": "806af7f08da84425eddf6fa79a07294be982e993", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961928, "uuid": "4f1e82fa-d108-4365-8bde-abb6a4a162ba", "comment": "Malware payload (RemcosRAT)", "value": "256b68eafedaf517b0304ea411231e22e9f3c054ab5b68e0c295b7aa9a34e75f8904dfb9d93dd8675fb483c79de96e55", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961928, "uuid": "410419cd-bb48-4d03-9baa-3f0fa7770339", "value": "T16163022067FC7F9CD35E812AFC26C9E634F5815AB79E8121A3BE55A71F8C864F14E012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961928, "uuid": "92e6d875-4c39-4c7f-8b63-de2b16b10c45", "value": "1536:pp9FY4faTPiqT5IaS1QswSkaGLgynghkhjlSr:ppnpaT5TrHaJGghqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961928, "uuid": "7fffa8ef-6536-4063-a386-9b488ed6633c", "value": 71652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961928, "uuid": "e7ffd844-a053-4498-942d-9641c3db41f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961928, "uuid": "ccbbd1aa-51d1-41e0-b276-f602f4582489", "value": "20262705.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7cc9e0-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970616, "uuid": "5df02315-cd0d-49a5-8df9-3e77586016c8", "comment": "Malware payload (Mirai)", "value": "edfd520077e35c41ca2883ed51fa62fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970616, "uuid": "dc8b5b37-beac-4e86-9ec1-cc07584ce2f6", "comment": "Malware payload (Mirai)", "value": "75481f6469e9324b1d132bfa9a3a86d6d121647f566a4b2d933b17e197065744", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970616, "uuid": "1ed8707c-3776-4380-a230-58fc7719d822", "comment": "Malware payload (Mirai)", "value": "5f5ef5cb563638402c2cb386f367389f24133e19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970616, "uuid": "c1456359-1604-40f7-b7c8-f230148fc398", "comment": "Malware payload (Mirai)", "value": "01c1a58a19bdbf89fc82b1e9e9f436711ff6aa11e297b99374aecce2fe8b49d9ef20727625be6876af73a54d92cb0415", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970616, "uuid": "b4c46d75-590e-4317-a2cc-e454b6623007", "value": "T141B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970616, "uuid": "611148af-8f4e-45de-aa82-88fd62b4864e", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJg:4azwz102cPPaRl+AS97Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970616, "uuid": "5a7d47ce-6067-4d0e-a3f1-c3804c302864", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970616, "uuid": "a9535b54-0df9-40db-a8ec-7ff391bf088c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970616, "uuid": "1cb3963a-2ecc-42c1-b654-fc83423d13db", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81be269c-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972500, "uuid": "f8633ec4-6abf-415e-b4ac-c8093977db40", "comment": "Malware payload (Mirai)", "value": "a3a7ce626bd67780b4bfcac462d040e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972500, "uuid": "f03dad3e-0c93-4ea4-9eb0-b6a1321815a4", "comment": "Malware payload (Mirai)", "value": "7607e5693cf4a031a3731e574cad9610ed070bb514cd2a7cfa2defa1712c1084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972500, "uuid": "929bd66b-6a68-4eef-8e53-00dbd348aeb5", "comment": "Malware payload (Mirai)", "value": "03c1ce8d079f81c043cd7a52055bdb34fd7f62ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972500, "uuid": "50522f7b-d705-493e-ba41-027bf1b13e67", "comment": "Malware payload (Mirai)", "value": "a722cfe7f62637d13266aea7b23b59dcf2555a129759c018cf3861ebac2a5a20ea297bfae7dfa54e0294a7860dc21079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972500, "uuid": "b323ae20-f393-4be6-958d-82f6405cca92", "value": "T19FA31BC6BC818B11C5D165BAFE1E21CD33134BB8E3EE72138E145B2D678A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972500, "uuid": "e98d1058-a07c-4dce-a23b-c148a1bcf330", "value": "3072:wpkRAXjtOwMmqekE3w30CvQW4/0dljKOlvCO4clPmH:/le3M0CvY/4lj3vCPc1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972500, "uuid": "809b8a49-1036-448e-8ea5-cc93ab171807", "value": 98780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972500, "uuid": "6bdabb93-fc69-4f2e-a3d7-3555928cf734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972500, "uuid": "4e69d73e-cc07-4cbb-86b2-b8c0e3540e92", "value": "SecuriteInfo.com.Linux.Mirai.9853.14952.29482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce72613-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969083, "uuid": "af2f5dfd-64ef-4027-8e5e-ceed63d6386c", "comment": "Malware payload (Mirai)", "value": "cc7661d78f3a4fcf9f087d8b268954e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969083, "uuid": "0375a116-4d32-4c11-966a-688767807f0e", "comment": "Malware payload (Mirai)", "value": "760ae81e5735a4933718cce68d17162c72db8c9bb65f00b1caa37a894b4cfc7f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969083, "uuid": "de35e4fa-d898-4bb4-a0f3-fd1c6127be50", "comment": "Malware payload (Mirai)", "value": "4e83198c0c029fbf0508f072b2a53ee5cdca0bda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969083, "uuid": "d71513c6-45ec-4412-bf16-1c036ca8d8e7", "comment": "Malware payload (Mirai)", "value": "187b9fe1fc1b2eab8f329455b106e0dfaa49ac375da74101d5f0f83de3ce0f4b380c053e6beebf63faf0cb3f32bc56e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969083, "uuid": "52e2031f-4199-47c4-9557-16b916254955", "value": "T108256A2AB2B3F1BCD117C13017EBCAB16535B07926316DBF67C49A313D66DA11368B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969083, "uuid": "75fd15a3-bf9e-44a5-9e20-412cd5056d11", "value": "24576:z7ePuRDNyi7NWne5ZiG5EKWff5Cg9WhSxQ:T7NWe5ZinKWX7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969083, "uuid": "32d5c298-22e6-4389-a3f9-5ac3eb567897", "value": 1027240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969083, "uuid": "138e3747-413f-4772-8b9f-d02319256125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969083, "uuid": "3907bde9-5357-4bcb-9174-bd8f28cfd688", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0f648d-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779969194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969194, "uuid": "426567f9-ebf7-4045-a77e-524c1b3320a8", "comment": "Malware payload (AsyncRAT)", "value": "5cc39f5e92756eb58885bf470cfa2130", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969194, "uuid": "241a0a06-81f4-483d-a2ce-a1cbbd90ee14", "comment": "Malware payload (AsyncRAT)", "value": "76204ee3fe474906b8b47dc349bc44041ee68fc524d746a26e11350a7e432988", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969194, "uuid": "bafde512-e529-4fa4-8495-c9e1a596fec2", "comment": "Malware payload (AsyncRAT)", "value": "f95f9c4900077ea5c8feb6ad9f3a45d08e628384", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969194, "uuid": "ae01b2d9-cca5-4b5f-b720-06219906eeaa", "comment": "Malware payload (AsyncRAT)", "value": "483573928a2bff614bafbd0dbea8747e1b7af5c335e7a4d69b995cd9acdf8454b573998c2e8432fd94ab4ccaf1f75fbf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969194, "uuid": "c141c37a-37ff-442a-a37c-302c5327f892", "value": "T11F233B003BE9812BF2BE4F78ADF26145467AF2673603E54E1CC451971623FC69642AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969194, "uuid": "f2e71687-2a0b-48e6-8bc5-f92b31de387d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969194, "uuid": "01592e9b-b7e0-4882-8c48-da95032b0d66", "value": "768:ZuG01THwoPNWUtmT1MHmo2qzvsPktaOJPIYzjbmgX3irGrIG/kw9CBDZUY:ZuG01THb01m2QTaOmY3b5XS23stdUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969194, "uuid": "645e1a8a-d457-4045-8420-14e93d795885", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969194, "uuid": "b911c1ec-7bfd-4e14-84b3-4fae7bd83660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969194, "uuid": "da40319a-6dc5-493b-bc1c-32c12d7a0df7", "value": "STu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4a8a82-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970641, "uuid": "b9edb881-a673-43ce-8b40-b5026427d526", "comment": "Malware payload (Mirai)", "value": "2607f1077b1654e5e90057388906e692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970641, "uuid": "36b3227d-ac78-48e2-9dd7-bec84450bded", "comment": "Malware payload (Mirai)", "value": "76a76794986d4047bf84a6a119f5759f3a9a9b8c11eab4bf249693a747a5b2ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970641, "uuid": "c4fbadb9-d7f5-4fc3-8bec-5f7cb176de77", "comment": "Malware payload (Mirai)", "value": "705f1c25df62a3dbd2f16879dd82f31be6eddbc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970641, "uuid": "81987146-04d4-4182-b25c-84cf0f12c1ea", "comment": "Malware payload (Mirai)", "value": "717fb868862570047e439e5371329f8ccc83e1b242df286c0cef589d9d04c262e9eff43b12f65bcf6ebc45d9c04cd1be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970641, "uuid": "aabadea1-70fb-4d54-8240-281adf3cccaa", "value": "T18D148D68FE4F78D2D2C7E37DAE4A0FA2302779749565C0B51A00A29FD5EAFD488C0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970641, "uuid": "1ae1cc89-103d-4f5b-807b-ce90ddcf1ba3", "value": "3072:badBpAIWIfbEdOcdY3rZiigZ2eNRzPx7:bOVfbEdxm4iubt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970641, "uuid": "6f3d9be4-3299-4300-a294-f7b9e7d6b337", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970641, "uuid": "37508bcb-9a00-498b-9567-c06aa89309b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970641, "uuid": "fa52d312-0cf3-42ce-a9db-43f4bd8af31d", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1632e9-5aea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780009991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009991, "uuid": "d0b09edc-5e77-4ecc-9fac-bd76b9d47efb", "comment": "Malware payload", "value": "ce0ab287422e52c298847f7c6308b7d3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009991, "uuid": "8e349e36-11b1-427d-934a-3a97b410ac04", "comment": "Malware payload", "value": "77009dac1615a2543685c33bde79efd0218bd7e672b7bd8038daa5bd6e1e12e9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009991, "uuid": "c05ecd19-55dd-4180-aad6-aa06cc161a97", "comment": "Malware payload", "value": "b2b219f19c25200c6bf74aa5a3ec3ac78a0cbe63", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009991, "uuid": "e9f8698d-74c4-4369-aa08-4675403ab618", "comment": "Malware payload", "value": "4a86d906de0c82524db51b3f794de681df7036c47e8000160e9d12a6c2e037e1d55d15e0db1788ff4df3ca99c415cf22", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009991, "uuid": "d6051ff5-b461-423e-9233-0e946bf84e41", "value": "T1DC2733CE31215B0F85AE84FA38FC155D10501927F8AAB921823D1BF3BD9F667AB2C1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009991, "uuid": "d2b8ccf2-b6d2-493b-abdd-574988d6f3a6", "value": "393216:3iQzGIgIEs5jYIQj+76uan7a/bsg1JL0EGM2583illPT9onoG34v5R3:t6IEsdC+o0eEGLvllP+l34vP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780009991, "uuid": "2a7e97d4-ab01-4dcf-b8ab-97676ab66806", "value": 20628035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780009991, "uuid": "e40067ca-9dfb-4856-89b2-d14e528782ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009991, "uuid": "368b3304-a3fe-41e2-9362-e4b4f442b2e9", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587dde96-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970284, "uuid": "849d90e0-1f44-4925-99bb-232992876a24", "comment": "Malware payload (Mirai)", "value": "d984ea88ec86e537d66f48ad60be939b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970284, "uuid": "d8a41432-e57f-4a15-ab6c-36d1e0b33844", "comment": "Malware payload (Mirai)", "value": "77b55c53f9249d9b611f462b0d659e7e5ae1fc111803b3b7486bb3643e050100", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970284, "uuid": "3714a014-2388-485e-b3b8-d4592e948bca", "comment": "Malware payload (Mirai)", "value": "d928a56e143aa96282e04f641153f458bf7cf0f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970284, "uuid": "6ca6733e-4a7a-44bd-8af3-5d0fd9c0ad37", "comment": "Malware payload (Mirai)", "value": "eb8b74e24ca457482318f8f4bfbf8f1c366aa62af19dbf51f701f8a0f3214e3c173e030cea933ece8e6eabdaa6563f6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970284, "uuid": "48d2a3de-16ce-459d-80d9-411efcf4d9d3", "value": "T1A1635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970284, "uuid": "8c916371-ef02-43ee-a499-71235f0c9c9e", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGc8z3WyL35IUfA5PGFjfnP2:zGYxpTGASC4XT8yyLpIoYPsP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970284, "uuid": "8308f99e-6ae5-40e7-ba05-107c32a6d338", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970284, "uuid": "844c7940-a647-4787-8797-963c0e1e5622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970284, "uuid": "e77f20e2-5155-4609-b7c8-e2f51deaae43", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa381c6-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969517, "uuid": "a0a80058-dff3-42f0-a6b6-da1991538a06", "comment": "Malware payload (Mirai)", "value": "14a692464c0698aaaf9375ecd78edfb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969517, "uuid": "77f3da0e-b91c-4baf-b89d-904972a96408", "comment": "Malware payload (Mirai)", "value": "7854fef3cbf76537d87de239229c81d2525dbf788a618b7b9c9248eea06a9b19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969517, "uuid": "3a444609-5c9c-4f0d-9b09-a7d468446bce", "comment": "Malware payload (Mirai)", "value": "56a03c7cb0c1008c796290c7703bf81ffe7b4212", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969517, "uuid": "13d35316-4de3-41c6-9bfc-929a6c421125", "comment": "Malware payload (Mirai)", "value": "baf61a187506161b1baa0ea894970aa93d9023a840089aa3c074691ed6b2159add0e1e5377d47af3c1e995c253cdef6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969517, "uuid": "c19d32b1-9026-4cbf-9ff6-a79407b6cfbd", "value": "T128A33A11EC751837C5C0713B51E34631F5B643A92A7C9A5E7EA31D9CEF18720323BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969517, "uuid": "31cb3f8a-dd1e-46b9-8194-eddc33cb49e2", "value": "1536:hvPSRQZbKRrPnsqsYAOI8GkeNung5T/znc7+0NW1qI/MpHvM:RPzmrPzRXNB90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969517, "uuid": "bcaa650f-8693-43f3-a4c9-257e6943c3c4", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969517, "uuid": "ce14b393-8818-485c-a99d-b0e08120c318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969517, "uuid": "35e13a33-a70f-4567-b46b-9ba559f0b30f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07b7ca1-5a62-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779951641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951641, "uuid": "5b269f8d-32f1-405f-8647-e7cef955c7d9", "comment": "Malware payload (Mirai)", "value": "0b93ab59cf973eb9895f6bff785946a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951641, "uuid": "01500278-64cb-495c-9e93-670f443b5a61", "comment": "Malware payload (Mirai)", "value": "78602d36c2fede6329fa049ed1fc0b232c17edd36ac0e6b78a799d8d05306c31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951641, "uuid": "c41052d7-163c-4eee-9ade-c123b9535732", "comment": "Malware payload (Mirai)", "value": "2f025ac979182dff78b296b1fee2834f81af1533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951641, "uuid": "75966026-537e-4edd-a0a6-7ca983f871d7", "comment": "Malware payload (Mirai)", "value": "1b773c92e914039b6c274c915852fdc556d3d5d7390f9dcbfe4a023522d0a0c57be3a4dbf08deba569672eee5f8abdb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951641, "uuid": "384fa3a0-4b69-49b6-8236-505c44124eef", "value": "T1594301FF0A8E91BAD321917A09D523C17F334F6615128E0D7780E287D2CA9517FAB6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951641, "uuid": "f9539235-684f-4443-bbe7-fb1fdf768642", "value": "768:mxGyYWR17RSLVfUNJBaRu80rvhhFzd0tCaUmuk7h+FHYxVPPEJUa/ChPb1tJgGlb:qVBRSLVINDv3t1aU9c7fPE6Ks5HVJui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951641, "uuid": "7373d506-f160-4b7e-a1d2-bf0a7e94a5a0", "value": 56292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951641, "uuid": "5a8288e0-cec7-4d0f-94b9-c71717037fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951641, "uuid": "2e30c2b8-0090-4938-88ac-87f1de5ef9fe", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85732d36-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946307, "uuid": "3ccb50fa-761d-4097-8610-e03d6cd234fa", "comment": "Malware payload (Mirai)", "value": "e8b265e4910edfb2d87a9d39ee743157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946307, "uuid": "6655506f-602f-428e-8354-7d3609fb3816", "comment": "Malware payload (Mirai)", "value": "78de7cba97c7c4b39551b4210a12a9292fbae880401ba2fa2c0624d34f89ffd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946307, "uuid": "ea80916b-7903-4d4e-bb08-1c699f0788b6", "comment": "Malware payload (Mirai)", "value": "20b3756b6fa941d46e48a2bca6a0315e95e8b148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946307, "uuid": "4d39a495-b95c-4c7a-84a4-aeb01607673e", "comment": "Malware payload (Mirai)", "value": "72b49ae406cf66eb7010e55bcb8a15087d83edd86e84d4ddb75f5aff376eb4c19fcd666a8521efca7b5c59bda7d9dbb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946307, "uuid": "0e8292ad-08da-4437-888a-1fe2c7a5a029", "value": "T1B7535CD9B8019E7DF58BEABE40224E0BF532761154921B377733FD83BD32169A816D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946307, "uuid": "15714e03-5807-4b12-9577-4863ccfe430b", "value": "1536:soBAmWmHv11dPBEMURJA87HONbg1pr8QOEawj0GKLUKQf8C:s0wMqeuprJFjsVQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946307, "uuid": "7eaf3a4f-ed31-47eb-9a77-74c7f794f4c5", "value": 61576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946307, "uuid": "1ca8e7b3-73a9-4ae0-ad25-97f30a31cd79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946307, "uuid": "2686a239-e8b7-4941-8eb4-a717f470018c", "value": "uranium.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e466a0-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779953640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953640, "uuid": "1b23067d-cd8e-4b2f-a596-353a626fd6d4", "comment": "Malware payload (Mirai)", "value": "da885df4841e937b2db718fce933fece", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953640, "uuid": "3c18ab34-ec47-4590-8fe6-248ceef26d32", "comment": "Malware payload (Mirai)", "value": "78e3073c632c9cfbe7ccb6d6205c1127c48d0b4d02f31671655d2dd2836b8f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953640, "uuid": "80f666dc-5014-486d-a772-8c9062bb1dcc", "comment": "Malware payload (Mirai)", "value": "1f2a5285174f66c4ed99f03e8190ec1fc32edaea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953640, "uuid": "d18a2392-070c-4b05-a574-cf5b07a4a8c0", "comment": "Malware payload (Mirai)", "value": "291e7d61af3b5f3d02b906afc7db3fa33c2f700ace2dd1cf9127a97961736563f27c34ca558fd92cd01d9a6569c10da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953640, "uuid": "6ab04f39-94c2-48a0-acfe-7a959a824f56", "value": "T19FF2F17CE918E5B2C7B0D635AF29CB13B513432CA2F1146F23504274EC8ED96A9FA007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953640, "uuid": "aa5eb7b6-a33a-47af-becb-1dc0e9b18638", "value": "768:eJzGPK34ZxMASUsmWcjgE0SJRFPcvu/MdLYVdnu+mXVs3UozDx:Gq+4ZaApyEFhPsaUcznu+2YzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953640, "uuid": "ca2d510a-eb4c-497f-8f94-9eda09a5d9e7", "value": 37480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953640, "uuid": "2c6e2b18-9265-4b78-a716-505677ff9158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953640, "uuid": "42bab42a-58ed-4f35-8b2e-20872238e656", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44cc68e-5a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779950681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950681, "uuid": "e13845eb-2e3f-4591-a378-81b221cf1848", "comment": "Malware payload", "value": "3018cd82fba794377cfaec6e229821d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950681, "uuid": "1142186f-53bc-42c0-a41f-d1ba8748c063", "comment": "Malware payload", "value": "79c3b2c84e741af3a9e13492a4cf895e65cef9dfe0010ddd5ea00cc82ce2291f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950681, "uuid": "cc1ddb74-14c0-4635-9920-bd35f5b98b66", "comment": "Malware payload", "value": "72dbcc221065fc3bb0738d72c9e489fab6a87e27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950681, "uuid": "db8d238a-d2ed-4cc4-8365-b5935f32a429", "comment": "Malware payload", "value": "0f903f67902c399d28148688c4f1bf348afdbfae84c093d69cc5e4bbce0a9c9700ef6e2c6a547a0a76300318105c1f86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950681, "uuid": "a9fe462f-d113-402d-97f2-b3d4be8f00a9", "value": "T104E42F6F8FD9126F4863E2981A87B1056FEC93BE330A8D12798D8176CF92425DCF3645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950681, "uuid": "a381c3bc-a2d6-486e-86bc-9ddaaf5785bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950681, "uuid": "23097b95-6407-44e4-9381-7eb813ff7102", "value": "6144:5tA9pquh744Wk2Kt7Wyray2Mvsw2zZyw/v1Y62bWqNr2W8GCVwUtSoWK1fZai7kw:5mvslZoi7nJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779950681, "uuid": "42b91fa4-e794-4c34-9a61-cbfe4670661a", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779950681, "uuid": "bc9626ab-921d-47a9-b7e9-edf8ce7a0ad6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950681, "uuid": "7f56a641-fa38-47d4-a30e-ae14db3f5228", "value": "79c3b2c84e741af3a9e13492a4cf895e65cef9dfe0010ddd5ea00cc82ce2291f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6d6e02-5a64-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779952498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952498, "uuid": "fb31ff51-21f6-4989-bc98-2988274bbd5a", "comment": "Malware payload (Vidar)", "value": "2b3c58c79a9a4eab3afc2c51be40bd9a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952498, "uuid": "4ce6d0ad-8f1a-4c72-a597-f6ce52101bfa", "comment": "Malware payload (Vidar)", "value": "7a6f4163574ae64e2bf678b55d9ae80680b44a1780777f1bcfbd28460ce36a28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952498, "uuid": "bd036274-a9dc-435c-a314-babd0dc27ded", "comment": "Malware payload (Vidar)", "value": "59f25bace8c344cf3ec2873adb68a8130b10df59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952498, "uuid": "48cce3fe-f7f0-4b8d-8582-62ff66865534", "comment": "Malware payload (Vidar)", "value": "8b8e577cb9972cf93bcaf4d5a2827003d50cf23645c6dccba81ffae65a1bed117d865191ff533bca40c093885893e1a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952498, "uuid": "943ca803-dc2e-4521-9d1a-3aff4a36eefd", "value": "T128C59E06BD914AB2C5AA933288E652617739F8480B3763C32F14B3B62F777E45E39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952498, "uuid": "c2ae72e5-7474-4a8b-b375-91cadf7c5c33", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952498, "uuid": "2ed33031-583d-40f0-9a0a-01cb206918fe", "value": "49152:eYjA+CjRJGcfD1bXJpcBWP/cSCPnnOSgkwt+Gx:BoJGSXJpcsXcSr+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952498, "uuid": "dcb8c29e-2d09-4571-a89f-f3d46618dc52", "value": 2632968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952498, "uuid": "adcc1e3b-d56c-40f3-96ec-6a76b5347e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952498, "uuid": "0c01cdc5-e16f-493e-8597-6df2a873a659", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3778857-5a69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779954625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779954625, "uuid": "e6d721eb-31ac-4199-b8d5-706977274c75", "comment": "Malware payload", "value": "ad18fdef364460961c68bd6aa308a5f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779954625, "uuid": "47f562e0-030e-4c54-a158-4680bd84182e", "comment": "Malware payload", "value": "7b20df52bbe915abf852026ca939889a94d48656d5ec98f438a2b5b95c6a5dca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779954625, "uuid": "0aeea97f-e910-4961-9732-5664feb9af12", "comment": "Malware payload", "value": "c73dfaa32c98b9994fd940a492bbe85340d27c86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779954625, "uuid": "d4018a61-043d-4f52-a350-00119eee334c", "comment": "Malware payload", "value": "1e4bb81da2615fb326d229e3df224efbbdd2ed91efc42b9e7179c31be8c4b414a8782e453b17255253b400ff68282201", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779954625, "uuid": "ddcc4a0b-6296-4eba-aeae-5b4f7f89a328", "value": "T1E086DDAB6DDC361E3000B1C6F48521F5E6621336DBDE12D9B8F924337AFA49AC42D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779954625, "uuid": "c4f0b5d4-e38e-4ade-8fe3-36435946f74e", "value": "6144:yubnYpsc+3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfsQ9wpNWVwS0msFJvXiESUW4:vPB2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779954625, "uuid": "1cc35810-00e9-4769-b200-ff8d2c1e0579", "value": 8608919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779954625, "uuid": "2eb66a81-8e08-43e6-9a50-17af4a2387d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779954625, "uuid": "6d85f324-7dc2-4fd5-b77d-8ad9f9963d7a", "value": "Update_14.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423dd93e-5a68-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779953925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953925, "uuid": "578f470d-e015-4e5b-bbef-5449e9c3b037", "comment": "Malware payload (Mirai)", "value": "fc9c4679dc7c630b861b8cf35d932573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953925, "uuid": "d355f893-0172-490b-8969-c3bc75d68fa3", "comment": "Malware payload (Mirai)", "value": "7bf619a67abdde9c2142a85c418863da80e2e356d43837fb3d28953b39166cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953925, "uuid": "5908a60c-fdb3-43a2-9b0f-d0c81e906002", "comment": "Malware payload (Mirai)", "value": "18e36347860f8cdca852a6b3a2f12f43dcfe7a6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953925, "uuid": "e9f6bb86-5b88-4c06-bb8d-638fd82474b0", "comment": "Malware payload (Mirai)", "value": "52d04ab673cf1e22138e6f871aa641350701d137008c3d90053439089f906d651a1b0842cf6a2555a69f2741cc818811", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953925, "uuid": "2a8b39e0-51f2-46f5-8d72-94cb38846043", "value": "T1C433F137D38C1ACBCB7C9EB5C225B9926B705F58F267C9CB52419216A301D917F04ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953925, "uuid": "e86d2c2f-cc1f-4b36-b2e5-ce86237c5638", "value": "1536:Y6HqiK0xlHvOkdYNgmxuRgfxf4u+qgw09o:YkqiDvTdlRgfxf4u+qgwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953925, "uuid": "ffbd22d0-8407-4460-b95a-3ba05222badc", "value": 52124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953925, "uuid": "db52ed83-e1b4-4232-817c-1de777e85136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953925, "uuid": "f28fd05a-3c06-4ab5-9c2b-56009da31d0c", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd0c0aa-5a81-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1779964874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964874, "uuid": "95a3fcfd-9a5c-4cab-9995-5f575571decd", "comment": "Malware payload (CobaltStrike)", "value": "1e7793ad49725c8562218bffd1de8759", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964874, "uuid": "c06f2e9a-dc45-4c0f-b8a8-02217dc66de9", "comment": "Malware payload (CobaltStrike)", "value": "7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964874, "uuid": "039233db-8ee1-40ba-b297-2052b98b0bad", "comment": "Malware payload (CobaltStrike)", "value": "39eb147d7b7fec6981a213d5607e42cced1b32a3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964874, "uuid": "06377ccf-9770-45b0-9e3e-e115e5582d8b", "comment": "Malware payload (CobaltStrike)", "value": "6750a29456df0075e2ea2ae80f3fc3e3b6e215292db9e75f528da24f00d4a23989bd276d3d45c52ccf2bb59bf7f1b538", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964874, "uuid": "3597f0dd-f806-4bd6-948a-4dc8874a1eec", "value": "T115322A04F3B86AA7CCBF43764CB30101D7B68A4A463BDF2B0D9C906D69677684611BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964874, "uuid": "9447ddfd-110a-417d-8a90-6dc0bb91350a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964874, "uuid": "5194f23a-5c28-4e73-afc4-1425f0acc2e3", "value": "192:3wA0lD2X60EnANAbQftKE/tlkhIj5x8sajNnLzvkWmdrNnVJ:3wA0loE2tFv4c8zv3SVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779964874, "uuid": "0212d83f-d593-4eb8-8d78-bb94c7daef01", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779964874, "uuid": "0200e520-0acf-4374-8434-dc8f463c04e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964874, "uuid": "b377f977-3260-468e-be57-70639269c087", "value": "7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6760ca4-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970012, "uuid": "fbbb0990-ae55-4f33-a3ff-41699a9207f4", "comment": "Malware payload (Mirai)", "value": "b9320ad666dc60ff67d28aff5d3d6854", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970012, "uuid": "d49b9366-e1ef-4fb7-af69-d3688b08a3b6", "comment": "Malware payload (Mirai)", "value": "7d44dae30ebfe351cf4ca6dd00da9b8429e462ed950d1e56723cbfbc14f151f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970012, "uuid": "a699e654-e8cf-4eb2-a148-661af406dbcb", "comment": "Malware payload (Mirai)", "value": "846e20d62e1cbdf51435011993757396bf5be9f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970012, "uuid": "57f12431-7fc7-48d4-a0ea-f34c6be923b7", "comment": "Malware payload (Mirai)", "value": "7547afede55bf1dec70218f0f5e55e6847108e122e46c5dd9a579bca606c35c0ef6bca9e12367e466aebfee52b92842a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970012, "uuid": "61ad43a7-9d3a-4f4e-abc2-8e8e64345c76", "value": "T18CF0FBF91066BE03C96CAE19393AF07FB130C789406F2F4AAFC5143E96C8961A134E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970012, "uuid": "8546f218-9213-47d8-8333-a80f574e752b", "value": "12:afqmotfWjduStf2/BtfDaLBCRItfwNITESStfZNw:eqmo1Wj0S12/B1DaLBCRI1wNIISS17w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970012, "uuid": "2e53fa52-2f6a-4836-a379-4b86c6306aac", "value": 648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970012, "uuid": "5d51eb2e-50d6-41ee-835a-0f8acdb9a0be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970012, "uuid": "f98e90cf-93f1-434b-9a5d-fa76ae3311a7", "value": "phi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb5b2a9-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970964, "uuid": "3bd0716a-500e-4031-82a3-6a1e0a8921a6", "comment": "Malware payload (Mirai)", "value": "cdbe0738f54c2b7d9e4a80c8458ad707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970964, "uuid": "482af06b-71ae-4ab0-9aa6-4026093dd49e", "comment": "Malware payload (Mirai)", "value": "7d69fcd4a72a0ae9c9e4540159ef2176412b31b11cb5213768886f5d0ef119bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970964, "uuid": "9e32db76-6649-4fdd-8c41-3a2f1d70ddf4", "comment": "Malware payload (Mirai)", "value": "0b5dced367490992e3a970863be1c3facbe48d41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970964, "uuid": "b4da111c-b56e-4dd9-a711-00387d850507", "comment": "Malware payload (Mirai)", "value": "f9fcf7007d1d8e4c1ac14880c28fe01b7e521e14f6df27ed73272584c7d488384e2c28f378ca344fce35ce3973743b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970964, "uuid": "a7c30c39-f87e-460d-9359-afcc96b9a063", "value": "T1D2B3C80BBE529F7DF32C83344BB78B399755239633A0C585E26CEA105D6028D686FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970964, "uuid": "81d60851-7e34-4a86-be51-1be6dcffcb5c", "value": "1536:qPMly3l9Ogfy1y6q56qapqD5UyPkUl3d3HTO5ApCabBVCoPVhKuDglOj:qkGl9c1K9tjO5ApCygWrgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970964, "uuid": "0d0b33b7-ec16-4ced-be86-b090ca263e2f", "value": 114356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970964, "uuid": "b7f58297-5d04-4da1-91d1-a5a633b22ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970964, "uuid": "771c4738-a15f-498f-b44a-a5d676003896", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ea7b54-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779974044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974044, "uuid": "1facc757-4efa-4992-9f0d-5b0a34ee8f99", "comment": "Malware payload (ValleyRAT)", "value": "bffbc91b713615bc76cc2078fb245f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974044, "uuid": "c51cc6ff-2e83-4570-bf9f-0155ce7d4040", "comment": "Malware payload (ValleyRAT)", "value": "7d9c7fabd525a058351c31fda2a8c34102afd2dc446500ecca9bd59d36bd8fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974044, "uuid": "21db87f8-64d9-49c6-ba5a-71940e316997", "comment": "Malware payload (ValleyRAT)", "value": "efc3d37c1fe54e74c85997d4921c9ae75abf25c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974044, "uuid": "3f80d27e-b697-4140-97b4-b8ddba8ae6a0", "comment": "Malware payload (ValleyRAT)", "value": "6781133fd5d02e150eddecb6fd26f59ec2da8ea4e26b65e46047b9d9214e0d2df08df4bf3ec14839d7f9279d5b2ddf61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974044, "uuid": "8cf7da0f-b13f-4baf-990e-2a93c2d8e4ea", "value": "T1D3D533D8136E14D5D48A827E90A345B6CEE78C3EB3877923536193EC9A333EE153A057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974044, "uuid": "6ad08c31-7afc-4315-8453-ca1bbfcdc799", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974044, "uuid": "d1a7db6a-4485-47c9-ae12-f996215cfd43", "value": "49152:qZKohFouO2ZOOjmhU8gJcNGB/UlTfujhMUGpPIG61NriQ2W1uivNr+o1LF:qZKovixG8gJcNE/MTfu1KpPkTP1uKd+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974044, "uuid": "419913bc-9454-453e-8f8a-d9a0a7df6342", "value": 2776133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974044, "uuid": "49ceae19-67de-4aaa-ba9c-33d1b6ab9242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974044, "uuid": "595683eb-fd88-4853-ba60-0bc8eb60a1eb", "value": "AI\u8f6f\u4ef6\u64cd\u4f5c\u7cfb\u7edf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12099d73-5a2b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779927645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927645, "uuid": "f42f94a3-d846-4c32-8d44-89168bb4a1be", "comment": "Malware payload (ValleyRAT)", "value": "eed843f800c190c28cbbc9c36eb64ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927645, "uuid": "66551208-ef78-4877-91a0-4830c4fd5848", "comment": "Malware payload (ValleyRAT)", "value": "7dc5d926d6f83fa5b23ac8024e87f6552364053a55ba7704f0811fb203223350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927645, "uuid": "7f68046f-188a-47b9-b365-d169d9f40d40", "comment": "Malware payload (ValleyRAT)", "value": "7fb143ebdc017d0f7b860d05ee84fc83826fe98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927645, "uuid": "609d5fc2-b0a7-46ed-8d08-25bb340dd9b9", "comment": "Malware payload (ValleyRAT)", "value": "24902c19167a9afeedbe00f8d7b511b2c48518b41c9f5977d3f805033af00b7ae553b61f6f774a66893eb9770ca67f03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927645, "uuid": "5b8ec355-1e0e-4513-85ca-06a2b2c7dff0", "value": "T1C5F59D52B7A800E8D9B7D13CCA464717E7B1B45613709BCF06A046BA1F13BE62E3E764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927645, "uuid": "594386a2-1864-4810-8191-a55b22b2e3fc", "value": "6a46ae2b050184803c249290197e742b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927645, "uuid": "d2e1cf78-2299-41a8-82ef-206280100f56", "value": "49152:BrevQ25D7bVhcSgV8pCZ+JSeWePqlcdakNwl3QEWVrOnwnQkLneTCap+Pwi0MVJn:BivHbQWCoucyQnQAfY7i0sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779927645, "uuid": "6ca99843-555b-410d-a6a4-48c62b76a8fc", "value": 3613632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779927645, "uuid": "80b64b8a-4a1a-4722-ab83-5b62c59fded7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927645, "uuid": "93261c4b-e053-4583-a686-73a44ef1be63", "value": "\u70b9\u51fb\u5207\u6362\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290b2954-5a91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779971493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971493, "uuid": "f3d9a65e-feb9-4e6f-bc2f-e8966b685a4e", "comment": "Malware payload", "value": "1d3bc186e672737b6751c5172ab5c62f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971493, "uuid": "585612ed-a30a-4627-bcda-f447da36cebc", "comment": "Malware payload", "value": "7f8c49231298ef810a51c32f6fe9e554c68651729c1a97e24739b2e5e28fa340", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971493, "uuid": "0a15b9d1-5184-47b4-9dc0-43df3ddfd5cb", "comment": "Malware payload", "value": "6de70d963ddc01d770bc34ff8461e800737ad043", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971493, "uuid": "0488da60-cb48-4c2d-b813-ae45ab7eb046", "comment": "Malware payload", "value": "caa8fde1a999628cab3f86f2ff7fc7323d43ebb85eac3a03976aa3137fe7d64ec785ae12fcb9ac30478b83d51161db57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971493, "uuid": "4cb1169c-5001-4aa2-910a-18bcb1c4b425", "value": "T111C4122DC105EB2B7539D7988470BC8F2C4555EE665B226C9C7BF33FB2C04C86A6A097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971493, "uuid": "9920f4c8-088a-4abd-bc68-00344e074b33", "value": "6144:KlsKtIQO8gv4o40VjsqpHyCdGZoH2diADK3esmIq/+SQ7f4XwtdkIi12+/EjlD3J:c9OVVjruqw8z5S+Hf4Xs+/caaZbXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779971493, "uuid": "e77c7e04-0ed1-44e2-8762-aa83b95baa59", "value": 560168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779971493, "uuid": "db8f79a1-d1f0-4277-9a9e-4f98d0e5520b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971493, "uuid": "2c911990-da34-41f3-87b7-a8d0bdfca4e0", "value": "Bestellnummer 1564319 vom 28.05.2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d04fc30-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974479, "uuid": "8d799beb-36fe-49d3-9909-067b0cffbd5a", "comment": "Malware payload (Mirai)", "value": "e9bbfce80a7a63278c4efee9e422e75c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974479, "uuid": "24e31d34-7f89-4b46-89f9-367507d24c63", "comment": "Malware payload (Mirai)", "value": "7fb6b6c0a3d6128230d4933e66d6b2f676af4afff39edfefa0def2fd0f534a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974479, "uuid": "ea3bfee3-9a11-42b0-9674-341aafba9a48", "comment": "Malware payload (Mirai)", "value": "17505e2efa7f3bbd572f07fdaaee0141471e8818", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974479, "uuid": "cc70ea5b-75bf-407b-a701-7223bd052a20", "comment": "Malware payload (Mirai)", "value": "301ad01c94ef91188ca6b810973f748dc1c6f662accdfcf5fef7bc44dfc4d0e9cd3a3c6883c14f724eaf4cf58804e3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974479, "uuid": "71645dd2-908c-4ba0-9119-68808d1ffb26", "value": "T19383831D7E328F7CFBAD823447B78E21964833D527E1C584D1ACE9115E7034A242FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974479, "uuid": "84b296fd-fbb1-4041-b0cb-826ecd4960e3", "value": "1536:nH3YWx906mdlkVpN/+HMM/YNc+xtKp+kdCKJjlW8W2er:XF06mUVpvhxtKp+kdC4pW8ver", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974479, "uuid": "e33fc520-1d5f-49e0-83cc-066410db9b92", "value": 84296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974479, "uuid": "8de139e2-3eb9-40d9-b490-cdc22a445f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974479, "uuid": "3aad6b8a-d83b-42bc-bf6e-98496410b518", "value": "002cf64953d20dae077980108b5651751035cc1f5ab5f72d6d63bfb0cc276bfb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57fe812-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "53dca3c5-fff8-491d-ae58-ba26392fd61c", "comment": "Malware payload (Mirai)", "value": "fa549ff5b3124db08d2e8c22a1462fbb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "22dbc3a9-a1f7-42f2-85e2-2c1d7539e2dd", "comment": "Malware payload (Mirai)", "value": "80ac2c966abd4d253a157ceb10ef78a2e7bd55bbe06cbd64f3d4dcabdebf8b5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "d95a8486-884f-4166-b441-768852a967d2", "comment": "Malware payload (Mirai)", "value": "8a6272893d0d25744f5e33d7d55d518fed05eb64", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969554, "uuid": "5d2e7c66-2046-446b-8887-fee98a4ac1c6", "comment": "Malware payload (Mirai)", "value": "13ffbc486b5345efe1579bad0061eac40190b4ffaabb3818430868ae31614827f994d4e5185575522001fb48ab84b754", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969554, "uuid": "43b13278-2789-416e-bc1d-76e1315172cb", "value": "T1C2731AC6BC858B11D5D526BAFE1E208D33134B78E3FA7113CE145B2E678AC6B0A37515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969554, "uuid": "00430647-a55f-4122-98d3-dc53ab537cf8", "value": "1536:+YnLmGDLFRAWLB2CUaip2i3ETbsX0HJOQ+sLErp2J+BTMAiGfy4DifE:pDxRAWLQ7aip28ETbscJh+Fp5fy4Di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969554, "uuid": "a4defd6c-2f50-488f-92db-b0ad7515ec73", "value": 75376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969554, "uuid": "d8ceeb0a-57c7-4ef6-a4c2-e0f2b5ec5123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969554, "uuid": "ef2cd079-ff6f-4c9a-8055-8dbf66cc1860", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928d849f-5a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779976824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976824, "uuid": "67f33997-1264-4401-8c94-12f9e90de544", "comment": "Malware payload", "value": "6a4e9cce4da35cb4a686b9ce354ca5e8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976824, "uuid": "1a600d7e-6c20-45e7-9c3e-b227132be73a", "comment": "Malware payload", "value": "80b27643c54d5f2d56b6335fe51129ae46f0d7bd0a3cb0d2a5b3f107d9a954db", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976824, "uuid": "ea28527d-b6f5-4c0a-bc33-7b5483301978", "comment": "Malware payload", "value": "0b3a2c2b8ae65171cf295d049ef4571d202c82f7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976824, "uuid": "44dc0002-c948-48a5-b6b0-2be9d9e98394", "comment": "Malware payload", "value": "a3971668d8e6fcaf65b6c1e9a8ad2eec213bf633fcb76e1b256c5eb029198857850d39fd79216a6fd88d6cb12fb1881e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976824, "uuid": "294ca248-2f03-4988-8ba4-03be08aca32f", "value": "T19DA30641F7F94119BAB72F442AB946B8493BBFA2253DC9DDCA110D4D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976824, "uuid": "e88949a0-a527-404c-864c-763be4f9ef6c", "value": "768:XTjXS4qHuke/l2BzSFmOSIG/tB9XJg+fu6Teq3Uplv+m6Ta74L5QXFCLZQT45DBQ:FcB9sAg68Gk5tFhcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779976824, "uuid": "11f5650c-6269-4a8e-aa17-d1db01eb30cd", "value": 105966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779976824, "uuid": "4cf2aa42-b0d9-437c-bda0-462ea34bb818", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976824, "uuid": "5ea6d333-549e-4cd1-a1ec-38bfdb85c7df", "value": "rimportante_b54eb367.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c996487-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "b493d747-6ac8-4741-9d9a-4927b5fdc4b2", "comment": "Malware payload (Mirai)", "value": "f44a24fabe8477d17aab23ef4974754d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "82ddadcf-e40c-4c10-b76e-a5b6c9b3b585", "comment": "Malware payload (Mirai)", "value": "8251992cf7e6243946107c63cd31f71edcd96974ea5584989bc3fb67e2dcebfc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "28c39930-32f8-4574-b30b-fcccb855cb36", "comment": "Malware payload (Mirai)", "value": "06d6f8e052f068b2272873bc5b52ef9f35825bab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "ec2ed917-5962-4201-9a11-d4f9d57e45f0", "comment": "Malware payload (Mirai)", "value": "4d9550b8150aa6d0a8e96a832a5104c6492b3a98e11fea979b2c9875db5064ddad22caf76ff4d297d8984428afb13ce5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "f49163b2-19ea-46c1-a295-f333fe38666c", "value": "T1A3A32CD6BC818B11C5D166BAFE0E61CD33134BB8E3EE72138E145B2D674A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "2c82ed8c-a4ff-4975-a276-36408522cd2a", "value": "3072:WxCRAe7xdE06UmEE5kzgNj+zKqliLxMf9y8OmGcDU5:xnmZEgNjLgiLxOy85GOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969539, "uuid": "6197c853-9452-4a4c-9b97-2f4f82383e52", "value": 98400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969539, "uuid": "36481667-71d6-48df-933c-1208add0b5fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "40d56781-c594-4c2c-9ad6-fc7a3ba616a1", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458e11bb-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1779953502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953502, "uuid": "344b536c-4915-4cbd-90d2-091967fb51a9", "comment": "Malware payload (SimpleHelp)", "value": "abadb0e2e4cae59461b3ff02ec3aba2f", "object_relation": "md5", "Tag": [ { "name": "209-87-166-233", "colour": "#FA5268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953502, "uuid": "404849d5-3b61-4a76-ba15-097c4c3beb6b", "comment": "Malware payload (SimpleHelp)", "value": "8277505d5e8af01ce2ebaca8aa89a0b9211d05c1337ac7aecea68717e19f66a1", "object_relation": "sha256", "Tag": [ { "name": "209-87-166-233", "colour": "#FA5268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953502, "uuid": "076fb83d-5849-4e71-8ec4-deb97338c765", "comment": "Malware payload (SimpleHelp)", "value": "efda015e581590f35ca25d879a2c843ca236d388", "object_relation": "sha1", "Tag": [ { "name": "209-87-166-233", "colour": "#FA5268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953502, "uuid": "f9233237-b5df-4198-9326-ff32b5436462", "comment": "Malware payload (SimpleHelp)", "value": "71a1e2e8fdf83cf00ee659ba7d68e1804f3ba0070e98edf716ef919128d49f82b30ca6a861d2933d221b442ec1407bbf", "object_relation": "sha3-384", "Tag": [ { "name": "209-87-166-233", "colour": "#FA5268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953502, "uuid": "2f4dda1b-9209-40b6-b002-d180d1e9da11", "value": "T1E7F6332BF65A04FAD877D538C99542A3FB71B156032962D707A48C361F7A3E5223B30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953502, "uuid": "85badeea-e98d-4297-9f21-1183f5bbee55", "value": "4dcdd102066c792bcf91dce0ad10afac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953502, "uuid": "23c10c53-5ffe-407c-bdcc-60c54b87c943", "value": "393216:wJrPSIwPrxgU5+0QXcZBae/2TonNiY/x10CFDN3cccQrgeQToFFWJR:groPVk0GMb/Ji4x1NDa88JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953502, "uuid": "4ecd63d8-6584-4377-b6c7-0050834e54ef", "value": 16663128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953502, "uuid": "af83e038-e80f-4060-84c9-3e78349d1fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953502, "uuid": "fc53cad7-8048-4414-b832-9e8cbd280c28", "value": "8277505d5e8af01ce2ebaca8aa89a0b9211d05c1337ac7aecea68717e19f66a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3c971d-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "8e2c0827-aa36-4295-b7dc-5a4cd9e31fa3", "comment": "Malware payload (Mirai)", "value": "be647328fec3b7c939dd939191f944b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "18127831-b609-43a3-a33e-4e38c2e19021", "comment": "Malware payload (Mirai)", "value": "82f3fa5c99208d37e1314a0304f29ebbd2a384ad18d42e7eb965d40ae3f0143b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "ad984bbc-fdd5-406c-ad70-6e029cf0f124", "comment": "Malware payload (Mirai)", "value": "4ec4ce258f6ac675dc53ca319d95e68bbabef8bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970958, "uuid": "297dca1b-0432-4baf-8afa-4c8963371e15", "comment": "Malware payload (Mirai)", "value": "56e17fc09e35fcbe8106d8eacb6a45e0a824e2ab38232a58ff09b5054bf01524f0ce4a43a385e05b94dd3bda70c915cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970958, "uuid": "13a2a21c-0d00-4a6d-9904-f196a2e72094", "value": "T19D63290133A94057E3E71EB12C2F6BF193EED6A531A0E185594E9B4F8175E322486FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970958, "uuid": "683ea5f9-bb04-463f-ac80-036e6b5cf245", "value": "1536:lFaVs9zf6aoVkwKkrLYIHiv28DXS0ZfypRPqfa/2J5:DaCrCWDXAJ/E5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970958, "uuid": "4ab91738-ac73-4446-80d5-27052b14253f", "value": 68376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970958, "uuid": "4bce5149-2232-4bcf-9c20-9f8f98ce0c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970958, "uuid": "7c7ee25d-a90d-4279-a46f-342f28998d14", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e548c968-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970949, "uuid": "a96bba2d-5338-412b-ab75-e6ce5cbf45f4", "comment": "Malware payload (Mirai)", "value": "12931f6f48ed0df8fb11c042560e8a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970949, "uuid": "959666cf-f837-4168-8a1a-0eabaaa76ed9", "comment": "Malware payload (Mirai)", "value": "849c3566a9d5d7bea3c6b6b22ca4cb0d0d444af56c666cdb4013641ebda0c2d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970949, "uuid": "f16836bc-7a39-4cd1-9d1d-327baf0cba4e", "comment": "Malware payload (Mirai)", "value": "8fec32124618993f34a0323200b5d039ba929f5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970949, "uuid": "4542015b-ad70-4f2a-9dc2-2c237a7c689a", "comment": "Malware payload (Mirai)", "value": "c7c0c0e9a6b6821ad269a8b7bddf7b9d7a95335939558466fdcf3df1966b348ba39b74bcb84e7a4eb7ce506e63e91681", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970949, "uuid": "7a62eb27-1fac-4a16-9a07-778eae1115c9", "value": "T13A636C138C745DD8F02A7D302034CAFA9713A04A991B6CFA3C478665545FE8CF6ABBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970949, "uuid": "4bab36a4-65ae-4365-854f-e990dbdf8fb1", "value": "1536:ui78/O3OoxXqcP3wKZxMPaLENZH4ZQKC1:ui78/O3Oi6g3wKZ6a2ZqQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970949, "uuid": "fb45026e-02c8-4b8c-9c55-20e90d1db50e", "value": 67180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970949, "uuid": "f8702410-2e78-4219-821d-22f61ce780c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970949, "uuid": "b23eda27-7cd6-498a-886e-940e674bd57e", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388d208c-5ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780002013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002013, "uuid": "91c9ee14-7ec6-467c-afd6-0cac36c635e0", "comment": "Malware payload", "value": "1ee8eb3ca1e3031c2ecc7e271e3916d9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002013, "uuid": "40fe270e-9154-46da-b95f-7d711e3ec51f", "comment": "Malware payload", "value": "84bcb1a25e8d2cc64e0829b4f2ef0dd35195aa22366e55f36603fda009111d95", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002013, "uuid": "132820c1-ce73-42ba-be9e-a83317978a5f", "comment": "Malware payload", "value": "680afb5abb04e1004030376d51d60db3992f8597", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002013, "uuid": "2d39d29e-bd1e-4be7-a7b4-0f9acdbd5aac", "comment": "Malware payload", "value": "4de16c9d1e28d9cae56112ab1111da6d3672169d9ee8b3b03bea3b6c56d51388b60fd35a1bffb3ef91da55d9ebd23efe", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002013, "uuid": "1766a8c3-97ff-4f3e-9b3a-8d4753e693ed", "value": "T174A31641F7E94119BAB72F442AB906B8497BBFA2253DC9DDCA500D4D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002013, "uuid": "9be6180b-ed79-4454-8892-9d5ba6c06eaa", "value": "768:BDN8i7jalf0RUuVykO15uqi+TP4uJJ7eLRMsHrxy9KiLlJHhQ2VBYKD4risR1x4s:EjwUNs/5juqXnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780002013, "uuid": "7c3c11a6-aaec-40f9-95d2-3b61198f13d5", "value": 105824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780002013, "uuid": "6dcdbb6d-868a-44e6-8e6b-12585445ce13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002013, "uuid": "2383296e-ca18-4d40-adba-5c8f0f2c5625", "value": "rmemorando_0ceba5e8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3865de-5ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780004921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004921, "uuid": "cd5a4ce2-9965-40e7-b7e2-8a162803903b", "comment": "Malware payload (Mirai)", "value": "1d52980163d72933b60f2d81750a0cb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004921, "uuid": "d12baf93-2927-45d3-9c67-711334719c8d", "comment": "Malware payload (Mirai)", "value": "84e93a1cf6297d82ff89e6d6acc342768dd7f87c72a53988ac1d55df4a0a4667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004921, "uuid": "316eb7a6-1142-4a95-84bf-00757f6d2433", "comment": "Malware payload (Mirai)", "value": "be534443a4526f4b030c34a0842c8ab7380e942e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004921, "uuid": "f017a85a-e5f4-4b53-817d-b444d8fcc02e", "comment": "Malware payload (Mirai)", "value": "32f4769ff5d8135f5da7715be284324ac8517d4a2c5761654ac5ac14596526f54f5e272b2e5cd84b831824d7272e7638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004921, "uuid": "0ffd1d4b-f3c1-406d-b8ca-71015accb5a0", "value": "T1DA633802F9E280BCC545C075475BAB2AAB74BC49431577DF6BC4BAB13F29E902F69324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004921, "uuid": "2f8c0f5e-8afd-48df-80ec-7ecebaa6e182", "value": "1536:ZcNrNdGMnJYypMcd7kHYDSKR3yQ79v3AroTAa0KJ3RtO5YYpo9xbQk+KMDVN9S8U:+RvG8JYypMcxxDZiNhAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780004921, "uuid": "6c2673e4-ca0f-496b-975f-6c1ff887d213", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780004921, "uuid": "11a3f17f-4ac3-45b4-b786-adb0dfb029fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004921, "uuid": "9a939981-0b63-4a40-a7de-e0910abb8268", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7895ee-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972497, "uuid": "8e79c7d8-89e2-4281-8d23-4f11bb9cbe9b", "comment": "Malware payload (Mirai)", "value": "d3bd37c6843e3002fdc13c999d5af22c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972497, "uuid": "a54b09b8-068e-4d51-b2ad-ed22a0e9ed61", "comment": "Malware payload (Mirai)", "value": "8568d294aed80f7d660982356cb6e1456ae16f2ea7749f54346673fc0a1df69f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972497, "uuid": "ee0c4953-0528-453a-8bf3-ae1e4cf61db0", "comment": "Malware payload (Mirai)", "value": "06755ec6445a163f06392c5bd68235db08b7aa59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972497, "uuid": "51e396aa-859a-4bab-b13e-f02080bdf4d6", "comment": "Malware payload (Mirai)", "value": "e92b8c9cdf5e7ebd01e67fc6008dfc8bfd297f42b7a72b046052f85d4207047977fd6455fc754243f905d567f7a1e4bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972497, "uuid": "e3b3a55f-afe7-43f6-84d7-87a8ef887a8c", "value": "T18193394173694407F7A70DB12C3F6BF2979FD5A122A0A2C5695E9B0F8231E322586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972497, "uuid": "a14341a7-a4cc-4529-b2d0-89438e025525", "value": "1536:y/Mqjty7lhHNAikrLYIHiv2PbRseA6s1v2IwlEwUm05q4o9b+5oxjpT3Oot:ZqQ7l0Vbue1IwUo9bg0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972497, "uuid": "3696057f-ed79-4e7d-bc3b-5c59281b236b", "value": 93640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972497, "uuid": "42d3aac2-d29d-45a4-818a-e3bb3f0a4408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972497, "uuid": "39884f70-83d1-44e5-9a10-655fc83aa1b2", "value": "SecuriteInfo.com.Linux.Mirai.9853.8943.1753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cef2b94-5a6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779955554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955554, "uuid": "2d869f84-8689-4411-9bc4-cf2efe143cc2", "comment": "Malware payload (Mirai)", "value": "eaeebc1698614ceaf44454315b41079b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955554, "uuid": "fd9164ce-13e6-40be-ae83-f0abd14d51ea", "comment": "Malware payload (Mirai)", "value": "85ceb36efabf7c6488953b278be7344a9f6e5740dea0afc484bb3eade0f2e7d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955554, "uuid": "28567306-24fb-4299-bcbf-e438519cb195", "comment": "Malware payload (Mirai)", "value": "40a24877adb0db9431071290343a76830e802960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955554, "uuid": "bcf352c0-6bc1-467b-a3b6-7cf7f38e308f", "comment": "Malware payload (Mirai)", "value": "19ad182d736d654782eea82a81f8602205afba2152bfa5bd2a2f0af5fc5d2d2a3f7563008194822070ea280c933f2078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955554, "uuid": "e02ed3ab-1b3f-46be-9aa9-abe3c9a94093", "value": "T19FD34C85FD918A12C6D512BBFB2E228D331653A8D2EE3203DE245F2437C659F1E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955554, "uuid": "f30ecb64-6844-49ec-be81-cb2e4dbaec9a", "value": "1536:ed6HjkM9CPPl2ZzBOV7MkbtxM85YTGLGchB52R+0PN5JQfa6oShZJ47qVUP0NW5N:pjkM9CPPlyOWk11pd01WoShQWGfZ1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779955554, "uuid": "a0c7031e-05f8-44b3-96d4-c3186f334d80", "value": 136744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779955554, "uuid": "7bafd33b-3f0b-4bd4-a2d8-9094d0715d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955554, "uuid": "2a6727bd-ddb2-468c-8b16-7a4f05dcaf44", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafcacd2-5a6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779955497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955497, "uuid": "a48e5a3d-6fa9-4c94-b6c6-01f7afed5bed", "comment": "Malware payload (Mirai)", "value": "cb5ef35e0d636b25e0eb3b33fd8b51af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955497, "uuid": "d8315dd8-0f9a-49ec-8dc2-96eaa0a1ccd5", "comment": "Malware payload (Mirai)", "value": "865db99fc673005756bb2a0a5110ec0962a78e6e0f680857da2918528e366b15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955497, "uuid": "1baca1e5-493e-4175-b070-8c8fbf899b11", "comment": "Malware payload (Mirai)", "value": "ebd7f7ef81551ef1ceda67af49c9fe049028616a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955497, "uuid": "c91964d7-0796-41fb-b807-b146071e4cdf", "comment": "Malware payload (Mirai)", "value": "0aaa34bd5e8c234bad1d6f6924eb11604d2dfe44cc72a03496d70b8d10099e5d8120aab50582c4b2fc7087c24dee872f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955497, "uuid": "020a35b5-a76b-48a5-91be-34af4a05f26c", "value": "T111330218417E1F772C21C536CE3BD8A2F39A6BDB21CE7242062907804D9912ACA3C7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955497, "uuid": "4f8d4322-876b-4f1e-a7e6-53833db5fe72", "value": "1536:SRS3HNaIt4wkPCEdQDoWR6Zk600Ma1dF0Umqzv7P9F0vkb7pVjzn:SR3IQQDoWRLD0Ma1TWuvrdb7plL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779955497, "uuid": "4de00d0f-caab-4d64-b26a-7d1be3c1f00f", "value": 54084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779955497, "uuid": "da250b30-0315-4af9-b510-7ed25542df5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955497, "uuid": "86796e89-b8db-4a21-a3f0-87eaa559791e", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af3af99-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970288, "uuid": "e3a0649a-e78c-40b6-905c-36c9f95f35d1", "comment": "Malware payload (Mirai)", "value": "aa87bb091e6ef4d957e7839699030813", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970288, "uuid": "ac1b3a96-51c6-4d07-8638-09277a02465e", "comment": "Malware payload (Mirai)", "value": "8663d5989d9bfdb82f4afe431129014f8d4bca1addbbb93977b847277c08c247", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970288, "uuid": "1becaea9-c387-45a0-b2d0-e7625d61c572", "comment": "Malware payload (Mirai)", "value": "0ec4d2bdb248cad80b2030feffcb4d7f8d56117f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970288, "uuid": "72ad8914-13e7-4888-b5e4-be337f883daf", "comment": "Malware payload (Mirai)", "value": "d833ca2d44f99c7ff90f3b823481c83443846f6aa0d19fcf7134793b5c936f919df59e7331da912f45e089bf6b1e23c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970288, "uuid": "12f93648-4532-40bf-ad8f-cd2dcc21adc6", "value": "T14A357D5AF2B370BDC067C030839BDB62A935F46941222D7B75C4DA342DA2EB41B19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970288, "uuid": "edcfa461-440e-4d5b-83f0-c69c2bb77c0f", "value": "24576:9E3wyM2j9xxp9VWe8tVAeFEAu1gZqTm8Y/WFGWDVYd:9kDWeeVAeFEAu1Ey5UWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970288, "uuid": "f6bd681d-db04-4adb-8353-f97bff6d53c9", "value": 1098784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970288, "uuid": "63265a62-1536-4fda-b571-00ecd6988153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970288, "uuid": "3fd3114e-a2d4-4521-a876-9346fad4f0f7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a9929d-5a36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932723, "uuid": "878d34e2-fd44-43e4-b8d5-a2462a83e13c", "comment": "Malware payload (Mirai)", "value": "2c01c8a182b4240b98fe95161a3d5d98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932723, "uuid": "a753ac67-9047-438a-b825-c0b673237ba9", "comment": "Malware payload (Mirai)", "value": "86ae635bbecb875255334631cf33e18f5f44a0c28620c5e1b28209eb55f2e1ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932723, "uuid": "124088e5-682d-463a-8d16-1976b9cd2c06", "comment": "Malware payload (Mirai)", "value": "b945a2801edbbac79ea6d6c764c46589367af49b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932723, "uuid": "3aac766e-c7be-4e1d-838e-6cf9b38ad8f5", "comment": "Malware payload (Mirai)", "value": "b3f05528343f3149d91512f9b4af6c9954cfc1425a2692b162618ce8de0065ebfdf83ae67795b37f681bd4f1d54ab9d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932723, "uuid": "75ea8eaf-70a8-4d27-b0d3-59ca016d341c", "value": "T1D533F123693E16BCD97418FA05EB3A8B8A04DB2BC450D9B2A84C3195E94176DF9343DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932723, "uuid": "d82b5a20-eb77-40f0-a9b0-3b4cf9ecc2ce", "value": "1536:3gcob7f/yssX0YqrM8NEUu7zJncbFcRG6ko6NFnouy8GyI:QcoXC/EYubNJuxc/o6HoutM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932723, "uuid": "a73e141e-43c5-4c0e-8b59-dd611ca1ba8f", "value": 51512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932723, "uuid": "782f7a85-6056-4114-856d-452ef7dd9264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932723, "uuid": "39627378-4c62-4c33-897d-60995fd8f042", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8356cf92-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946304, "uuid": "183fb683-4168-44d1-a0d7-b579b5ac4645", "comment": "Malware payload (Mirai)", "value": "31fd0f41a5e99a021837e252aa0cb17e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946304, "uuid": "83495493-56ab-4acb-8ce1-323f63ce2d6c", "comment": "Malware payload (Mirai)", "value": "870c9007d342adf691383ce0701e5c129bd0c8718ab2ed64bb49427f8fb6919b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946304, "uuid": "855f11de-c17f-40db-bdfc-3fafc2915e10", "comment": "Malware payload (Mirai)", "value": "5fd6de1b3c438c719de9b270bd06e083ea561e2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946304, "uuid": "5ca15875-5fce-4b49-be9e-948d4ed28059", "comment": "Malware payload (Mirai)", "value": "f29b10371cb9220f504f36337143f0d31531cee287042a1188ce83984faa70f77e36dd76a8312b413071e7f6f4234daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946304, "uuid": "0b3f1b67-b8ca-45db-8dda-4145a2212cf6", "value": "T13583834AAF615FBBE8AFEC3749E91B45248D611721A87F79B930D814F20F24F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946304, "uuid": "a329b26a-70c3-4d44-8b1e-bb2106cb9261", "value": "1536:K0XSygcxUwLZ3JPzTTyT+ex/QZIt0uRVa:5XSygqs/QKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946304, "uuid": "b18ae284-b571-4b4d-8a4d-f819fbeada96", "value": 84120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946304, "uuid": "7bf38448-4dcc-4517-a31b-dc2af7fb28d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946304, "uuid": "baea573d-1f8b-44a3-9603-16362039dcb4", "value": "uranium.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7554862-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969986, "uuid": "79bcdc8b-86b6-472e-851c-943ec5482492", "comment": "Malware payload (Mirai)", "value": "d938e38decb5953032b7cda5a23ae25a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969986, "uuid": "38f0c335-8b37-4456-b23d-6edd3ab65b39", "comment": "Malware payload (Mirai)", "value": "894f3cd2dab10a692683eb3b4556e09005812e7771f76c0becdf0105c5c36718", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969986, "uuid": "ce4a818b-3061-411c-a308-aaddad96f718", "comment": "Malware payload (Mirai)", "value": "acf718e63f808039db1be691a6ba116154a6186c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969986, "uuid": "e0ba3f0c-a7f6-467a-8e8e-88f7ac3c209d", "comment": "Malware payload (Mirai)", "value": "42269193418470451fd37706ca533290413f2481e52fb7161fd247f205f400916b8301467a90d0db70870d37be3eed05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969986, "uuid": "7304bc1c-a130-4a84-9ae4-2b8ba8debaa9", "value": "T13C21FF9C478ABD82C08CE5393A46C40C7041CFCB14AF5A545ED815BD94F4DCD7135F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969986, "uuid": "fb86e3c8-14b0-4cbe-b691-5e0708252eee", "value": "24:1XsZWXD51ZWXWZWXhZWX6HZWX5ZWXsZWXbZWXPZWXyZWXenZy:1XsZWXDjZWXWZWXhZWXQZWX5ZWXsZWX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969986, "uuid": "77d57520-5b2e-4f0c-9a3e-967f2034d662", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969986, "uuid": "d144841f-86d0-4ff0-973f-f445e7ea1857", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969986, "uuid": "f9e92526-c770-456e-ace0-05cb75b2ea43", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575caebf-5a39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933775, "uuid": "dc4263f3-0ee6-4c45-9a57-3a999d932692", "comment": "Malware payload (Mirai)", "value": "8ff2998489277b1d1902000f46686481", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933775, "uuid": "659db78e-704f-4d0e-8312-6fb428d82eaa", "comment": "Malware payload (Mirai)", "value": "8acea10a3a6fc952c4a668b206e257cf223ccafacd590035c4ea7cebbf78fd79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933775, "uuid": "950e1764-6e5e-450a-8ea2-00460446ac1b", "comment": "Malware payload (Mirai)", "value": "5c581ed9f722c9761d23c508188df703bcf39d22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933775, "uuid": "cbc1d646-145d-4473-8edf-6fecccf77664", "comment": "Malware payload (Mirai)", "value": "cfe6d55feadc0176715cd94f05f9b75e231d4754e0e9e0db854d5508ff006a25c006237027f12b462ce3b02dace5e8c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933775, "uuid": "96e9c311-a040-41e9-a681-ae8f8b87f22a", "value": "T147D63CC2D562C29DC63C3D31DFD6BBD8A37A2E34E6C0958EC8C8B73918B32159167961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933775, "uuid": "095d7491-076b-4223-a652-2a821bfb3a4e", "value": "98304:tKupTu9/Q6RLi6Mzg++91nz+SGzIGJX+OJsgbqTrz8ZjEW:i9/Q8I0++91nz+SGP3RbqTrz8uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933775, "uuid": "74cef885-4cc3-4d27-8f41-c4bd2029b4be", "value": 13172898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933775, "uuid": "a55f0aea-7c3e-456d-9cc3-434ccf91c447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933775, "uuid": "07f4411e-bcfd-4d73-9a8b-30b107b4cd06", "value": "wife.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da84c400-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "7bb5fbde-36b5-4117-b0e3-6bfe200a86e0", "comment": "Malware payload (Mirai)", "value": "72f63e5a9b2fe80bf96cf1da00095f7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "0577ec46-022f-4fc3-b9a9-d46c0498809e", "comment": "Malware payload (Mirai)", "value": "8af481c0f928d98063236b2778b903bed0c18b995ae627677db45d47639cc6fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "e49c7b0b-b360-4c96-8fcf-dcd7d6057f89", "comment": "Malware payload (Mirai)", "value": "1040d7106d0bbda4c40c9afbebfaeb5fc830c4b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "a000c82c-50ac-46f6-893c-ce12684544b0", "comment": "Malware payload (Mirai)", "value": "aeadc2d205a328ec30b0cd871a191543d6196bcb68e75d7727369100a70da2ad21f164cb28f9acc08464d90a29de42a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973938, "uuid": "0a7ec9e6-c3d7-4406-85a5-4a4bdd432403", "value": "T102F3D90A9F910FFBDC6FDE3702A9074635CC654722A93B763674C928F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973938, "uuid": "9514932e-b478-469f-aa43-9f43eeb2cb0c", "value": "1536:Qa/3MzuD/6ZfkOCPT+QDxvYzyHdz8md7MmAHxnPcKtMeZsUNhQTTcXqIW3BBHb4/:p/MzYXOUH9d7J6JPX3ImEBB74SuKtc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973938, "uuid": "f1597b03-6b14-4640-9bf1-b7bd5926aaa5", "value": 169120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973938, "uuid": "e43d5a8d-9fd1-4808-9c09-5e3ca052c3dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973938, "uuid": "919f4dca-3780-40e7-a045-f4ad9e5cc99e", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84080b88-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946305, "uuid": "ebd7b9fd-0eba-4577-a4db-bcfe295e1f0e", "comment": "Malware payload (Mirai)", "value": "c261c7e9371534626f13d389f95efb16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946305, "uuid": "d992277f-c11b-45e9-a1f4-9cf677fac1cf", "comment": "Malware payload (Mirai)", "value": "8b17007cbcf1d1bfa80bf52709a9bb18a92463400d4cd747f7c57f615dca5cae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946305, "uuid": "dfa2e658-f7d8-4322-91a0-dfdcc2f5a3c5", "comment": "Malware payload (Mirai)", "value": "16d25360102342e936b72b1dd13e556d65bd4a08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946305, "uuid": "4b47c009-d12c-4a87-84db-05307ca3e2d1", "comment": "Malware payload (Mirai)", "value": "d70f074334e2bdf97f3bfa6734f77ccf6c4409027e4bfb9d01588fba3c825431f2eb22ab9bfebde40ab9d2efd56ffb3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946305, "uuid": "da8d1b7b-d750-482d-8f40-40c9b4eefdaa", "value": "T11153F8827C81AA15C7C05777FE5F018E3319A798E0EA73438C191BA17ACED1F0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946305, "uuid": "669f9b2a-bba8-4b27-8ceb-e9aa9252b8ed", "value": "768:R3nEczUZzYHTg13Je1t0zYRx0v6zJpbLA57MQHiLwCVy/Jx+5H8hG1rmCd/574yj:ZEFZyTg61tsYJLA54JeZWnxCB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946305, "uuid": "7fd8fe61-7e18-4329-b2b9-5ca393a30fb8", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946305, "uuid": "dfa158f6-152b-4f2e-b754-f46f14fe7987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946305, "uuid": "4d82e598-156b-4589-bfa1-4cc08451f16f", "value": "uranium.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5e4ea6-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969857, "uuid": "9fa47453-59f6-406b-bbee-6ce2eb0b5aef", "comment": "Malware payload", "value": "a3af028fac22ec9f363396fef0a3e772", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969857, "uuid": "9414ffad-6d35-4ee2-a5aa-72609783a7a5", "comment": "Malware payload", "value": "8b8345125a6bde0480242a9595b407a459a27e9656cab89c2399f44561a1d386", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969857, "uuid": "0ec3b6c3-9168-4949-a06e-5bcd23996a9a", "comment": "Malware payload", "value": "6ab625a779c232620518d778e9285d0bfe13cee5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969857, "uuid": "7d81ec4c-3f26-4b72-83e8-8c602029b093", "comment": "Malware payload", "value": "ec81b3cb84af79ef8cb479def690fac5f815cefd396404c2ca3a17e96996578b315a307515dc206c906b675b89775a9e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969857, "uuid": "6858302e-6815-425a-9b64-b23b59af93de", "value": "T1F2312EC448C13A7FCC9495257792902D602D29C52E6E2ED8EDCE3CD9B780BD2F120E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969857, "uuid": "feca8589-5912-41d3-bc73-f7c468d12b42", "value": "24:FVEBvNq1pNeBFBvpchOA4TtqBvTmBT3i1Bv2iMBep7EByTvT83jOrQtqBVSjb3u9:FVovNq3EB7vShOrcv+biLv2iAeq07oot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969857, "uuid": "df075f1d-4c3c-49e1-ba33-5056744d3d3c", "value": 1520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969857, "uuid": "c0ca44ba-1349-4f96-b805-51658a163206", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969857, "uuid": "03a82347-1f12-430e-80e8-5f2779cc6e23", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d1e0ea-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969036, "uuid": "bda29b82-3473-44dd-b1b6-260076ba1fb3", "comment": "Malware payload (Mirai)", "value": "0631f6d0954bb08aacffbafd939e5f43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969036, "uuid": "919c43a9-02a3-4dce-a3fd-43a2a1fb9c9d", "comment": "Malware payload (Mirai)", "value": "8c64a593f307a54cedc9e29085dfbc6bce9a7c49d1c0ee2c7b83c3d19f44b92e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969036, "uuid": "f898e56e-7c19-4e19-a1b5-4971d81d2354", "comment": "Malware payload (Mirai)", "value": "f20d445204cf42a9e66ad374193c12c130500551", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969036, "uuid": "c03051ff-734c-41e0-a8a1-190059432db2", "comment": "Malware payload (Mirai)", "value": "3b590a2d7393ac0f9de1942c8bf978d9a8a5ab64ac5751dfe9f33eca3b2f8087b725d525c3ad8773fea01dc88123ca87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969036, "uuid": "811922ba-f59d-4b3b-9502-382d8138a533", "value": "T10041F08D1F315EF9F05AD53847370B3A37AA520847C18289E1ACDA002EC030D89DE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969036, "uuid": "076d92dd-a28e-4940-8caa-595c25a3a664", "value": "48:Omr5E4GYg2H7+1eHeu/9LuEpMn3UA/aBl:Rr56WHaCMEp43/Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969036, "uuid": "7771e226-416c-4aa9-bb77-63bf4714ceba", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969036, "uuid": "5bc31476-ec00-48f4-bb86-c991743f6106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969036, "uuid": "7c776bf4-e561-4f12-9b35-a8cffb59e93b", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7429891-5ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780007433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007433, "uuid": "e40f14d3-1657-491d-87af-5900b87733ac", "comment": "Malware payload (Mirai)", "value": "449c2d6d5fe6a5d44b95286459e3e623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007433, "uuid": "cf32afcd-d4df-48a7-a9ae-a69dbbfd0346", "comment": "Malware payload (Mirai)", "value": "8ddd1ed2215bd960f023ae75751dda6b072ed8c6dbeda265664a7ca5a67ca458", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007433, "uuid": "49240bb7-e35c-4fcd-b605-166759f13b0e", "comment": "Malware payload (Mirai)", "value": "c6a9800f75198df5c2a3ea2478dc782782720229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007433, "uuid": "6442c57d-5a74-4a95-9e38-58a5f922b615", "comment": "Malware payload (Mirai)", "value": "70258a5e643c1219ae4b18f93d1c6fa5df46f7c8181d3a73d4b40354045b2b03b5a0367f111f810c20aa38b382cb7c12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007433, "uuid": "d51b89ff-e0c2-495d-bb96-e733b8e48036", "value": "T1CCF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007433, "uuid": "f0bc7328-971a-465c-873c-377cc287f6f9", "value": "1536:CdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpNEn5p5M/LW:87vDtrnPTR71gmX7Dy7fMpNxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007433, "uuid": "b089a52b-0250-4587-a34d-463f99c5f70f", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007433, "uuid": "66d13eaa-c05c-4f61-8717-43cf120c2dad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007433, "uuid": "a24fd602-28d3-4ac8-940e-ccac34d59376", "value": "8ddd1ed2215bd960f023ae75751dda6b072ed8c6dbeda265664a7ca5a67ca458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6f12c4-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970133, "uuid": "b62948b6-e2ec-40b3-ae5a-e84d424765e8", "comment": "Malware payload (Mirai)", "value": "6279eabb8a09461a2f01d89020b862fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970133, "uuid": "41abf3b5-4d70-4ff2-8eb7-dfadfd339f96", "comment": "Malware payload (Mirai)", "value": "8f7adf7d6f1e3e635e47032e10686cd28745aa3d04bd822f6d5a4ffc5687f09e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970133, "uuid": "03cdf010-8952-415e-9abb-c8ebc7993f1d", "comment": "Malware payload (Mirai)", "value": "c9ea49c7b3401d8576cbc9640c6ddac9634ceb72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970133, "uuid": "96a14325-55f5-45c1-91f3-9ef6caaab403", "comment": "Malware payload (Mirai)", "value": "0f32a7662646a233b6be13e38a97b439ff75f3a1843a1e51d6d720614b08d1f821d09f56135e404759d74b22d1789a31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970133, "uuid": "2a8499c4-a380-4fe8-8070-58ca819ba788", "value": "T11F1130DC8341E881CC8DE83A7692C20DB081CFCD24AF17A5AE81157C94F05CEB230A0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970133, "uuid": "6725fdb7-54c1-48fa-921b-46fffdf9443b", "value": "24:+X6dJOaXxtJOaXKJOaXtJOaXuRDJOaXtJOaXzoJOaX2oJOaX/JOaXodJOaXKjJOf:+XvaXcaXVaXaaXuqaXaaX/aXwaXEaXoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970133, "uuid": "ab2e5ec0-a3aa-43ad-893d-682bdd5e4d22", "value": 1008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970133, "uuid": "79eb9459-b6ce-4f25-8664-f4f6850a0a47", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970133, "uuid": "afabf47c-ecfe-411b-893a-6a6ccb9e1a8d", "value": "weed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b2cf84-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974497, "uuid": "1cfdc291-8770-4d09-bd36-106a58d3b7d8", "comment": "Malware payload (Mirai)", "value": "ff236f3735eb203e8f2ae4888b317a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974497, "uuid": "876763c5-f623-4cf8-ab91-8fe7adb25da6", "comment": "Malware payload (Mirai)", "value": "8ff657b282e50c6df1b2a7e0cd7f71ffff6f0a9db73bed2a46f50f2cc011a3bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974497, "uuid": "e5cf907c-a556-43ac-81b8-397dac913cf1", "comment": "Malware payload (Mirai)", "value": "18fc4b9728a0fb417684d206c913052b75aba70c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974497, "uuid": "61697191-8943-46c4-8994-a9703e7bea7e", "comment": "Malware payload (Mirai)", "value": "a46f7cdb090e7b8d121515ba05d861e4acf99f0de987068b80717fd50803a7546cb9220dcd48129a9bb147614512104a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974497, "uuid": "7c41a8b2-bfa4-46bd-9c14-85a691487242", "value": "T14C43195578929B12D9D49277FA6E02CC332663ECE1EF33179D221F10769691F0EAB381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974497, "uuid": "459ce79d-7e4a-4be9-ac5e-2f18115fb61c", "value": "768:dy0zqplZebdDoROwQI+TOWl650m5OEblBMKuArj9FPhskOPN5WXC5BhA1rPNOL+w:tz8ydMcm59jThsk+/HJA3gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974497, "uuid": "f2d0ef14-3379-401c-8a95-93f5e15e91a1", "value": 56044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974497, "uuid": "eae7884e-5bbf-4973-8b5b-fa9744b47d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974497, "uuid": "0f09b452-8f48-47bf-b013-ec549d09b23c", "value": "00344d7683ea901891c72d83e75965770c67ea7208e176962ecf0d2e12be95b2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c727b7c-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "eb5d2cdb-62d8-436d-83de-9572970232d5", "comment": "Malware payload (Mirai)", "value": "451703c8b4d729e255d8f3db9c8b2af6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "e92b7457-f465-4a22-a157-d89bb2cc35f1", "comment": "Malware payload (Mirai)", "value": "9001cd9ae5fa54a9a1a7c4e649f3178ab3f7c9330f0d98b0117e12717700b20a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "c9b43570-d09e-4767-a79d-789b4d1f6c58", "comment": "Malware payload (Mirai)", "value": "89edbc13af38ff16fce30276181853788c1efa85", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "91b44071-1006-491f-9d51-253d9f0f0c41", "comment": "Malware payload (Mirai)", "value": "cd7e680f3bdcfd15b5ba3e1975887c5c4b2f13694ab951ee61a3a1333ee7d31b170fb3127a28ee516edc99ce75d393ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "da951edd-da7f-4744-9b9c-5a6f9760dacc", "value": "T178931986BCC1C612C5E1A1B2FB1F91CD371643A8E3E67107DD19AF29674B8A70E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "025672e8-e0db-4d33-b3f2-f2150e8af1b0", "value": "1536:X+0hMsdERtCvjvq9BLABeuTGrVtLKWkFTui7QxKbtvPV:X+0rmtqjSbxuTAVtcui0K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969539, "uuid": "4c706332-5329-46f4-b67d-33134a1a29ad", "value": 96036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969539, "uuid": "8aa770e5-dcee-4927-ae48-1002e07d7d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "f1fdeff7-9a6b-4128-8470-5a167513914a", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1468029-5a39-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1779934033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934033, "uuid": "a9967c5f-a7f4-4406-9d8d-11ce865ae4a3", "comment": "Malware payload (MeshAgent)", "value": "16164f0e68e54d3342a29f0d908b999a", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934033, "uuid": "39654237-7e15-4c1d-b7ad-d1fb5ac54f26", "comment": "Malware payload (MeshAgent)", "value": "9098906159e0e4c845eb918886fadc2723f2a321281b8003e471f09140321f91", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934033, "uuid": "f79bf082-0ac8-42dd-a7be-8f8910ff1d70", "comment": "Malware payload (MeshAgent)", "value": "2e0f5a82fd281448174b093f2c5766a91e11855f", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934033, "uuid": "d48c7908-becf-402a-95b7-fc14f12695de", "comment": "Malware payload (MeshAgent)", "value": "3f2170ddb82ca026e166a70befa1a259bd641ba7fe0a17307e4e72f6c3dd23e7dfe2842a6ae257ffcfeafdbab49d8c64", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934033, "uuid": "a0373374-39ce-4751-9564-1dfc3c9caaf7", "value": "T150565A07FC6568E9C0AED1348A729156BB717C492B2163D32B90F6392F73BD1ADB9340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934033, "uuid": "24734a94-599c-4baf-9b32-b92d137c3649", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934033, "uuid": "5b538493-ebff-4666-b673-9776586535b2", "value": "49152:vt3pQc2xX7R3Um0BgY0VapHr7snc0d2G2qbjqK5Zeeu/yVaBG1DKQK1K6zTIDfvd:vt5BeAmtEaeeuwAzYEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934033, "uuid": "cdae0f72-c294-4620-93b9-026cc744dd34", "value": 6099968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934033, "uuid": "387fe71b-fe0f-4e24-b758-c1e540bd0538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934033, "uuid": "3c19f290-2541-400f-aedc-909fb359139a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0483b2f5-5a63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779951674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951674, "uuid": "a728cbff-d954-4677-b3fe-4d5bec1fa370", "comment": "Malware payload (Mirai)", "value": "69e26b5a4e0d992f3daff2898ab06248", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951674, "uuid": "5e2efef7-1e2c-4bb6-8ed1-b56a7b1172bd", "comment": "Malware payload (Mirai)", "value": "90b365f2422189a956a80bf430576c8903feb24b6231dab5e7dbfea78504bf18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951674, "uuid": "d62e6c61-1776-498d-bb24-cad7da79c089", "comment": "Malware payload (Mirai)", "value": "11d78514bb78da10328a1813801441630fee279e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951674, "uuid": "ed1eb154-1c32-4a9d-81ea-45cf17afc1f4", "comment": "Malware payload (Mirai)", "value": "d9fe2ead9b87104d8362d626866ffa152089310adf9bd28330c8257ee310f20d783d473fcfc9f388fbec7b5ce947521f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951674, "uuid": "5819f664-67a9-45bb-aab6-5b1530e4d341", "value": "T18DF30A0E7E215F7CF7E8C33447B39F25A65823A627E1D585D1ACD6101E6028E282FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951674, "uuid": "04aad0dc-e647-4ed1-8b0e-7584e4c6f2b1", "value": "3072:36SiXNTRTUqlsQ27wx+TNxbhJd3gVwZ6OR+D4BmzV:KjAqiQ20xcrhJd3gVw4OTczV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951674, "uuid": "e52c97c0-e137-45da-ade1-4c54899dbb35", "value": 165860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951674, "uuid": "e6232841-9563-49c4-9ed3-b0919fe275dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951674, "uuid": "6a4e3acc-ec1c-4097-a0b9-973a0eb859bd", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b59edc7-5a60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779950505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950505, "uuid": "05635c48-6e01-40dd-bfb3-5876159bd779", "comment": "Malware payload", "value": "6cb819d79377c3424f1f58736cef6fb5", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950505, "uuid": "5fea7801-aa11-49bc-9ce3-bf1093c08bcc", "comment": "Malware payload", "value": "90c996144d2e37b032134cea3918078b6dbc2986ebc1dbdec5487011e247da0a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950505, "uuid": "3dd25aec-746d-468b-a8dc-a306248e7745", "comment": "Malware payload", "value": "9bd7a5bdb42f979dbf0d86e34c980661563ef79d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950505, "uuid": "5063ab19-cab2-43ea-ac10-4892a869494f", "comment": "Malware payload", "value": "2679ee93802c956d936df5030f5c5b97c033635eaed960ca4859a888e2a0f540a2f7894ebaeabb76e6c98f22b08e5199", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950505, "uuid": "32235479-a944-4cc9-8f1e-c26cce098616", "value": "T1B8F4BF6B941090B2E1AF4DF51E9042C9BFB1604FC1B4FF6E09F8D2306EA196D5C65E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950505, "uuid": "525f341b-9d9d-4910-a6b5-93729bb32288", "value": "3ba26262c0cdb8c0f12fa10dae364d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950505, "uuid": "5aca253a-f96d-423e-b67f-da0b41ba8fce", "value": "12288:p5SlDfoAnja0oAfPUZ90Bce/CEPPIJBeUqLVgz2dg9rTROwHrE0uy:pgxTzQ9a/CcPIjeBLeiy9hOKuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779950505, "uuid": "7e9843ec-bd05-4e55-b387-28a6de6c0cbc", "value": 744589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779950505, "uuid": "44a2dc5e-d281-4263-98f3-22eea8b631d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950505, "uuid": "a64d44ae-138c-4aa5-b301-71a7ece038fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e4e84f-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779970217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970217, "uuid": "00d0495a-f26c-423e-b9ce-c3229666e830", "comment": "Malware payload (NanoCore)", "value": "1f5629ba6f20e4c7b4a55e736797f956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970217, "uuid": "513b05c3-3922-4714-b920-538f94d52133", "comment": "Malware payload (NanoCore)", "value": "930b692df3835501f7c276763fbf80928fe64d808e8f1f52d8fe091a5e58ca56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970217, "uuid": "e68d7363-373d-4dd7-a5f5-1444c6e85392", "comment": "Malware payload (NanoCore)", "value": "cbb1b206fc1fc782dad068d9b3dcd9678535cdd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970217, "uuid": "5f7eaadf-ee52-41cd-af0f-10b6b6e9a81f", "comment": "Malware payload (NanoCore)", "value": "84dadc4f59593d29e12b7c0a8391666549304654b8dd9caa396431a0e2171c991c12a8f43c86abb4f613206c9089b746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970217, "uuid": "e7b1ee72-1416-49ff-bc51-6035d85b71e7", "value": "T1DD14BF2677B94A2FE2DE8679701246539378C2E398C3F3DE28D855B68F167E1060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970217, "uuid": "445153ad-1f2e-4fb8-80fc-6231959bd0d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970217, "uuid": "96210d0c-be63-48da-8c14-6031803ebdbc", "value": "6144:MLV6Bta6dtJmakIM5HBGmPDZ1ZgJB6QUWw:MLV6Btpmk6BGmPDZ1gB65Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970217, "uuid": "3c2d2a67-4d85-4af5-a451-596694dc7006", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970217, "uuid": "e9e66d8b-ac55-4696-9da8-9cd7f04eff87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970217, "uuid": "d7fe3b1f-0895-430f-826e-62a3420a1a4d", "value": "jvegter.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8adb93c-5a6c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779955950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955950, "uuid": "87064690-afad-4f17-8a0a-6370aade24a7", "comment": "Malware payload", "value": "069d9a6d2515cca4f039b0c23201ecb1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955950, "uuid": "1241d4e1-7151-4180-93f8-c2b014dea82e", "comment": "Malware payload", "value": "935e3d35e56fc2b5198b08a3c6da0333584f18a80a3e5673b9f36f1d83ba6c7b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955950, "uuid": "8c038e51-31dc-4796-997a-bacae391177d", "comment": "Malware payload", "value": "a979c8ecb6862f069ae9641f7811db13568f89f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779955950, "uuid": "a453ad49-c066-4c2b-ada1-3e548611d9d6", "comment": "Malware payload", "value": "ffa786b718f2c39af168c9baa99e2eee5afcbee71991046586a6aed06ac927e7b431290b155f298243ca1ded0c035d13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955950, "uuid": "b8351d9b-91ac-4e33-9a5d-2adb32883702", "value": "T1D2136D6526953C25AE99883B5D7F2F0CBDA983E2300491DDBFCA3CF18C15A9CE718718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955950, "uuid": "30657be8-a2b5-4d47-8671-ab5d89bef6e8", "value": "768:Nr9NyXsZztCa9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:1HusZycy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779955950, "uuid": "0930508a-a062-44d1-bd1b-550faf501e14", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779955950, "uuid": "d77adb4f-f0de-40bc-a17c-8513c9a68714", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779955950, "uuid": "a6655289-bafb-4a70-a61a-fea6ba0f2bfe", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ae26d6-5a34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931520, "uuid": "4f02cf14-b7fd-4608-9b83-ed31bf7c4231", "comment": "Malware payload (Mirai)", "value": "4fd9b459447b8505fe8a86dadc2b41b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931520, "uuid": "b7e685e4-6827-4769-ac39-b9bf98ba7daa", "comment": "Malware payload (Mirai)", "value": "93ba7b7d1a11150ef2dd7dc55475e7393a751ac32c46da6cdd10d99ddcae1af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931520, "uuid": "1aed62f3-fafd-4822-b961-4578253443c9", "comment": "Malware payload (Mirai)", "value": "3d6e71b5fbe279c2faa1fbd3a841a56fc85ed5e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931520, "uuid": "4005c1cb-353a-4e35-9a2b-62fd58513a27", "comment": "Malware payload (Mirai)", "value": "809055068e6ac345e741e407032435b4691856cb2a1b0750df255a5c6d305febf666bcb75ad99a5ffed5b7366b94c7b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931520, "uuid": "8ed3a634-0211-47d0-9313-1567f6427097", "value": "T182043BC7F800D9BEF80BE77604170915B630B7E210925B37B297796BEC3A1991927EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931520, "uuid": "909fa5b0-8e7c-49c0-9b14-51e4342a8dc9", "value": "3072:5jYc8L0488kwin+fTZYKT9snh7MVijbiwLyIfs8y8yEA5Kuh/FEk1:tYc8L0pn+fTeKR0h7/LnyEHhk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931520, "uuid": "128f2c7c-0b0e-497c-a4b1-4c4c376571a6", "value": 175776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931520, "uuid": "618ba440-55db-41cf-a1f4-b2f0a3222cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931520, "uuid": "208949df-7824-42d7-993b-e2ff1a6de0e7", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39fa639-5ab7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779988126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779988126, "uuid": "9fb720a4-1572-4eec-807e-3f3d405066c8", "comment": "Malware payload", "value": "81cfda6949376e4b176ee91e93396aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779988126, "uuid": "0d0138af-e326-4564-8590-2977b22bbf85", "comment": "Malware payload", "value": "94cf86f6aab01670ea57aa08b8c531d8dbdda8cbcebbe684b08c64b5738cc819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779988126, "uuid": "659db17b-de89-4656-bcf1-2f605d2581c7", "comment": "Malware payload", "value": "70092b5f544ffba057e161416e7afe47593ba76f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779988126, "uuid": "a077f519-4512-4aab-b6db-3c073aa7d684", "comment": "Malware payload", "value": "fde3662e7088ba7400606880bfc6c1a055aeffc7b86c2e738b1da66a1e4253752c4e7433529ffb00c65fb5e6427484a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779988126, "uuid": "108ecfeb-7e66-4c8e-88ff-456cd5b22513", "value": "T1D4C59D5A7CD049F6D4AA633389B76292BB71BC440F7223C72E9072382F766E45C79748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779988126, "uuid": "00b774e7-80dd-4346-b869-b8d7ee62df0a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779988126, "uuid": "d9a93c2a-f240-4754-b802-b3d974d1e0a3", "value": "49152:qytirCHqNwhhu8kJShVk8deaWBIsh7jBBQSgkIvX0z:qnVW/u87hs1/PL8vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779988126, "uuid": "51467da7-2bb8-4131-8d10-c834708a23e8", "value": 2558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779988126, "uuid": "47f6d002-dad9-4e39-8cd8-db1290abd093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779988126, "uuid": "c98c9c50-e881-432e-886a-9822b5315818", "value": "Spectra_Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cd68c2-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "4400323d-48f9-4c5e-9c08-cdbfb2caa34b", "comment": "Malware payload (Mirai)", "value": "4670574b27017e23e6d493e53242f93c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "0409905a-deb3-44b1-9c3f-b0a87a3d5724", "comment": "Malware payload (Mirai)", "value": "94d2c4ec6e53951e4ae6c7e0c6090f40575479004b776afccc62af2702ee57e1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "e613764c-2924-4d56-b642-3d85db3e371f", "comment": "Malware payload (Mirai)", "value": "3f43b822d8846bd07b293d3062f5f73593e2322e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970626, "uuid": "ddabb526-bbc4-405e-9ec1-166ab266d89f", "comment": "Malware payload (Mirai)", "value": "fdac73972dca88538c00a4eeaf2722432af86dd09e716414e78199d355bc7ee42ca600e68021b6fc541d9d86348310cb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970626, "uuid": "0d3a0ff0-6346-4502-9946-e4d212939065", "value": "T16A83AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970626, "uuid": "1483333f-c1e9-4258-ad64-df7b6c97f8f3", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC72:UeAsdukuhoNJVwbmuUqjLjwWi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970626, "uuid": "607f3743-5ac1-4e5a-97e4-172b638d1f1f", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970626, "uuid": "c1027eab-f88a-4bd9-bf99-29a04150aef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970626, "uuid": "e27e1392-cda0-4c44-8b55-54270420e42e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169889d9-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001097, "uuid": "3c26da24-9cbf-40ee-90a4-e475cbfcd92d", "comment": "Malware payload (Mirai)", "value": "11b34f0d34408a0e7575f974bfd97263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001097, "uuid": "2a7236fe-8212-49ee-bed1-a53b6c3e798d", "comment": "Malware payload (Mirai)", "value": "95f8631c837e2150fec4be8df4e20647cc4aec92720b7cbb934839bbc1da96a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001097, "uuid": "6bf7ba0d-7527-446a-b10f-4013028338ef", "comment": "Malware payload (Mirai)", "value": "42d4b311f130f42fa349a891dea81b27e7b51485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001097, "uuid": "a842d7de-a342-4de9-9217-3146281e9951", "comment": "Malware payload (Mirai)", "value": "127e4488442e8591be642838a5b16f43156d57a043f784f68b93eded9e2ce3a54ee1951af30f2759e3b60d22d65623d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001097, "uuid": "672b489e-ee5b-48a6-9e37-0bcd3195491b", "value": "T180B35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001097, "uuid": "83fa02ce-6f13-4be4-999a-db757368e36b", "value": "1536:WTW/VCxsHZusS2Li62C8vqKTR5/PPVGAto2WszrW+TNe76:WytCxsSx62NFT7VG92WcrbwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001097, "uuid": "230dc4eb-55f4-41f7-8d40-b11132bf7754", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001097, "uuid": "59ea8bc5-812b-48c2-9063-101069839734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001097, "uuid": "d0532af3-ed7f-4d51-a147-77db60e4c7c5", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e44ccc3-5a9b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779975769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975769, "uuid": "e563676d-eb1f-4d08-8b6a-434f7ac9fc70", "comment": "Malware payload (AgentTesla)", "value": "555160207bc84d57a177c5c8d5b90a0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975769, "uuid": "ce0ba9b1-dd2a-4b89-b98b-d0bcf1061acf", "comment": "Malware payload (AgentTesla)", "value": "966baf32504c07e467c8bdddd35a43b4908a8a7b1eb54cb14edc056608604d47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975769, "uuid": "c5982e00-5986-4b8f-b0b9-aed5e527db17", "comment": "Malware payload (AgentTesla)", "value": "9842801eeefd4cb647ef54c1c95295ab656482fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779975769, "uuid": "8c938f53-b3b9-4d35-b2d6-9e267cfd921b", "comment": "Malware payload (AgentTesla)", "value": "93f1a5ebb96d009c523d883826b83a4831c376ddafe7815cb8725300eee26e4206550fec4d663815aacda94f6515dcd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975769, "uuid": "cec7b498-8790-4f9a-9efa-d77fd0ecb7ce", "value": "T1233501416D132F14C53D1BBCC1A30058A7F0DC5BA2AAD79BBFED01F96A53B98C91A9C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975769, "uuid": "95c42924-1961-4204-8c89-27342004da97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975769, "uuid": "f0e3638a-13c3-463c-9b3f-428e6c43cbb8", "value": "24576:Xfi6dWjb6e1AaPedLAR0Uq8FOzPJHEQCvoGFjYco:K6dWjbNPe/Uq0IJHOvvFjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779975769, "uuid": "2168addd-e23b-4efc-ba10-ff624707fa08", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779975769, "uuid": "5a430491-c7fb-41d6-a0ee-a456fb02403e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779975769, "uuid": "8d499fc0-5ea9-4275-833c-eee754e5fbc6", "value": "nueva orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7da81c-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970935, "uuid": "ec7078b7-5020-4805-982a-3c22659bcb43", "comment": "Malware payload (Mirai)", "value": "938179565232bd523e740cbb1e804961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970935, "uuid": "fdf4bee1-a489-4f1c-ace0-eacf6b252dae", "comment": "Malware payload (Mirai)", "value": "96b57cd09616e5e673a25028e1ab107f1ddf3146200f572a4dfc058b8d345408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970935, "uuid": "89013544-1261-4c0b-a8a5-f1d6c6202226", "comment": "Malware payload (Mirai)", "value": "ba506577b54d8fa18d494950fa1db0d6b65b6f35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970935, "uuid": "26c9a66b-39d1-4129-b8b9-c0f714c4c281", "comment": "Malware payload (Mirai)", "value": "01cc37ef5c43fe05ad35c1e985fb1324003d4351601535e330b9ffb78feaee587ecd641171761440fd7127a16531bd40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970935, "uuid": "f2bec532-9d75-44ae-b9d2-6024967e301c", "value": "T144836CC1E683D8F1ED194134207BF3376AB2E9B901A8FDE3F75496329426AA0714774E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970935, "uuid": "503e74e1-885c-44be-a4ba-622c5c6861a1", "value": "1536:nfZsAtktl/Fw/q0uG5LqSig9BTpvW1U4DD+STTpfXiMYXblr/:fa+k/FwS0uG9qSZvTI15D+SHBy1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970935, "uuid": "8ca02e6e-f8bd-44d9-a493-78e2f62aefe0", "value": 82096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970935, "uuid": "aad084c0-1eba-481f-809d-acdec2f00a10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970935, "uuid": "d8e26482-787d-4c73-8989-3ff82ad569a6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7411b206-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966464, "uuid": "5c2c3fb3-1bf4-4448-b3c2-639c5e3fc6e1", "comment": "Malware payload", "value": "33104b694574f77e6f3e4530e7f979a1", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966464, "uuid": "6212f94a-0b7a-4718-a5aa-c6b45abbb3df", "comment": "Malware payload", "value": "96fc5fb90fff691be63cbfc2d4da31fb4234fd1f9210a4106a4c129c12e9eca7", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966464, "uuid": "b374dcc0-bbf6-4220-bab1-727f3a0594b9", "comment": "Malware payload", "value": "10a07e7663bec0d3cc3b4624ecbba96728db9b4a", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966464, "uuid": "8621f7cc-0900-4634-983c-ee6b853d7579", "comment": "Malware payload", "value": "14d5913e2fed077495ad6fd81d3c8238e27d35831508112052c9444ad157c12c8dd5af6fedf8abac5c8932b098447395", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966464, "uuid": "0adc9ab7-35ac-4718-a429-a412603f020c", "value": "T198073326D7D8DAE9E60BB3BD403CD35B0A6EABC83402F98E5D9411D86C4B1D9D34B817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966464, "uuid": "dc74ad7e-2aab-4e12-8558-922bfa2fc5cf", "value": "393216:jTErl8BWVA0t8W3qJQlCJk2TMxYzF+lpT9oF+qu4DL:jTEJNVvhn/YzF+fA/ucL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966464, "uuid": "2a9a046c-1cb7-4b6f-9495-dc4762632c2d", "value": 16959600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966464, "uuid": "62c11c10-12b7-4954-911f-0515d498e7e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966464, "uuid": "7f604a65-a265-439d-ad55-5a82b1b66392", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707c4807-5aeb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010267, "uuid": "924396b5-bcfd-48ae-b1b1-0b78870b91ef", "comment": "Malware payload", "value": "a2c589a76d12ad999255b8c95ec4a491", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-6110", "colour": "#521F70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010267, "uuid": "089d05a6-9bfc-4060-aca1-599950809d86", "comment": "Malware payload", "value": "971104ca7612bc5d0b7b14ed8066e93b7790f008632785dac88f5f4348e79569", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-6110", "colour": "#521F70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010267, "uuid": "9170fd02-0236-463a-96d1-f29ae2c94672", "comment": "Malware payload", "value": "9ecf74c3b3f94a9e6eb4ff95a4c6ec2d565b5bb0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-6110", "colour": "#521F70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010267, "uuid": "08e85648-2413-4379-93f2-2df109d2cd6c", "comment": "Malware payload", "value": "4b05fbd2b005bb4c1f70886a21d02a0ab6591a8f82dd0d0045893899aa3d4b84f66484880355a9fb05ff5315ae70559d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-6110", "colour": "#521F70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010267, "uuid": "0ef65cc6-3e48-41c2-9a30-e36d2df65e42", "value": "T1A21633DB2F5A541BF3803FE0A78D09EA5709C94631E37E11021CA2D8A5F4AF9AC1977D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010267, "uuid": "a2c64c98-c11e-44de-b0ff-a820358fc783", "value": "98304:tVCvx6zCNPWjD0Az/kiZmZrcSwDfbJPrJN21wazVQ:pCNPYFQiZaZyTJzL2GcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010267, "uuid": "e8f43f6d-9227-4369-a934-45e4fb07e757", "value": 4407155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010267, "uuid": "520d571d-f939-45bb-86cc-38ea6fa56480", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010267, "uuid": "88c204b2-e2a5-4bae-bf8f-18ad31871635", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa170d-5ac9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779995653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "624d10f6-2e48-47e9-8aa7-bacf59d3a61f", "comment": "Malware payload", "value": "22b7232408fce1eb9c05581e1e0fe76e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "d6f6357a-923c-4122-8d4e-bce951783f6e", "comment": "Malware payload", "value": "972bcd0dba5ff57cf38e9812ea385b0d9a00781e00038c52799f49dd7d4ca24c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "dddf42cd-db58-425d-b31d-b3fc7798c4fb", "comment": "Malware payload", "value": "3135bf3fd81c59b6dd290bc88cae59a48a39699b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995653, "uuid": "554e6707-cdef-4440-a4e8-f2efb9f23b1e", "comment": "Malware payload", "value": "9f486f2a8dfe39bfe5c41fcb6dcc0e4728742966ef34fc453cea35883933fed1ff0a7960ec0a050c9deda2241f9b0253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995653, "uuid": "005112b8-e16c-47c0-bfb5-4fb755e5a0d8", "value": "T18D145BA8BA0F6C41F2C2D3F9DE8C87E13E1735E3C7768971791212EDDAA39D94990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995653, "uuid": "1add2ee7-c4ff-40c2-83ce-fea8b13bf82a", "value": "3072:GXzWHifdsl1asE82N+n53xp7pfgYDlJgBMBznoq:GXzWCfdsXasD2Nk3D7pomgBUnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995653, "uuid": "3dccf53b-b24a-4d03-914b-67d3d881d1f3", "value": 190448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995653, "uuid": "daa32b6b-60c2-410c-81d3-6302b52137be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995653, "uuid": "eb0a6cf9-81b4-4586-9254-384e8a7ab855", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9f8ddb-5a64-11f1-a769-42010a9c0008", "comment": "Malware payload (FRP)", "timestamp": 1779952196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952196, "uuid": "9d0d06f3-829e-4655-97d1-1c19fe53444a", "comment": "Malware payload (FRP)", "value": "ce06d071e7e3b47fac26cc2b97059be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952196, "uuid": "1988c531-9b85-4f29-a9dc-4e305fdcc634", "comment": "Malware payload (FRP)", "value": "97a8e5b2bc51f3b3f7cd2117cf0da8fc49bee2e597ecc04637dcfdccfbf7e8e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952196, "uuid": "8e1495c3-0b7f-4826-abca-b3a9daf0e5df", "comment": "Malware payload (FRP)", "value": "1df40a4a31b30b62ec33dc6fecc2c4408302adc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952196, "uuid": "8809ce2a-9b53-4c44-a4bf-ba505fae64bd", "comment": "Malware payload (FRP)", "value": "e9085c2a5f04654e7d5445d68d4d4f7ea5389acf77d7d4972a88f7dc93e965e0b056582111e639925a3a0ae6fd384f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952196, "uuid": "e8207702-a6b0-4340-9612-c97c227babf0", "value": "T128F66BC7EC9101E4C0AEE37485729663BA707C895B3123D72B50FE682F36BE0AA75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952196, "uuid": "a148528b-fd0c-4adc-94a7-40df087de2c3", "value": "b196866f0bf37f1f128fa153413b744f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952196, "uuid": "d2a07bc9-3e1f-4a0a-9367-45d251eb0ff4", "value": "98304:f1a4NpkI4Bmk7dYun5lqKkqweWPpU9u/2JeNLhZWTm88nAz+ES:f1zpamkRYunj3+UI+iAz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952196, "uuid": "4b7af87c-ec20-4f94-9add-6799267b0125", "value": 16189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952196, "uuid": "bde21528-6fde-476c-9249-7446eb3a918b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952196, "uuid": "38b892ae-a93f-411e-a987-bd79adf7c932", "value": "97a8e5b2bc51f3b3f7cd2117cf0da8fc49bee2e597ecc04637dcfdccfbf7e8e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0608fcae-5ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779992909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779992909, "uuid": "3165126c-fd6b-4cec-8fcc-476f3775ea39", "comment": "Malware payload", "value": "896d6c7565835be157fc3235e9e9ecf4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779992909, "uuid": "303a4fd5-4c85-4eb2-a0e5-e52b90a8ce4d", "comment": "Malware payload", "value": "97ebd98d982c5cd240180005962d3cc4622d0503e8086935400312702a16cf9f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779992909, "uuid": "0f7d083b-fe24-4c22-92b5-157baae8101c", "comment": "Malware payload", "value": "a9fdf037dc7fa0c57407b745be5352a889e000b9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779992909, "uuid": "6b4e05a6-6416-4d95-968a-df7910a89f28", "comment": "Malware payload", "value": "8fa724223b0b8c94bd9a8bda1c75f9879dafa58ce399a10493b6f15d2b6085fa51d24429b467f57632cc7a6a196d7fa1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779992909, "uuid": "6cd08a54-4a23-4e69-a9a6-672783dc8102", "value": "T1DE65F1459B5DB6AC788C53986372E22D07B38310367F7E4D86AC398527DB897A237D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779992909, "uuid": "e5bf5465-f6b3-4636-bfce-b69ba66ecd9d", "value": "24576:JQs9bGbsqvjz3YenpmNjOjQL3HnzVYMfrGcuSe8FB7lTTCY/yALmF59gDqr8g:JGVvfuEQDHzqbcde8F3lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779992909, "uuid": "5c6578db-a258-4078-ad19-9d46f5389f6a", "value": 1517658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779992909, "uuid": "9d7bd138-df25-475d-bbb3-9787d6af2aed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779992909, "uuid": "2d6fa80c-c98b-4dc1-8b95-dd8995ce0cfc", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72ae8da-5a8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779968751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968751, "uuid": "f0d66256-4c25-490e-896f-41a062699087", "comment": "Malware payload", "value": "66aa00bba0bb0c64b7d47c77ce498b8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968751, "uuid": "85764503-43b6-42f8-a16a-f7e67f431352", "comment": "Malware payload", "value": "9903b9e5e2576bfe0d45ee7ce90da80a1468d3e9f01ae900f209dfbed800c511", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968751, "uuid": "f4d94d69-0d8e-4568-b2d8-420c8c6e8285", "comment": "Malware payload", "value": "27682f1e303ac12697036e8dc5bec1182cf0aa94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968751, "uuid": "7d2bd8e2-9c57-4a88-8d3b-a2b3b65e327b", "comment": "Malware payload", "value": "69e417289150900190f6898909f5bd759291bef85fbd0885a55c7ce3382eb874481aee45e192289690c03d5406beb6b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779968751, "uuid": "cfee0fab-fc31-4250-b027-761593d8978b", "value": "T1545181EB01809B32E75CC55EB7F0B139650AA09376DFAA08ED80181C8ED5D4C72C5F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779968751, "uuid": "f593116f-3ec5-4f71-a114-4f9cbd4b19c4", "value": "48:qSpQOQ2JMIZyZbiB8FnFuZU0U0cvyyIxEnEbwLbpNJCZs9zOzhM3IGQ:gB2JM0KbiBMFuZAEbwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779968751, "uuid": "ae34adf4-7f8e-43c4-aa10-ce07f634a563", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779968751, "uuid": "a3f8b1bd-230f-4152-b9d3-25577280510f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779968751, "uuid": "40998f4a-e13d-4c2f-9557-8c51def485af", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138d6709-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001092, "uuid": "d90e0a9b-e3ca-4619-bd50-d56289557c77", "comment": "Malware payload (Mirai)", "value": "54f8e00ca1255dd575225360e9f4b78f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001092, "uuid": "ba275a16-18ab-4dc0-bf4f-638236e04c18", "comment": "Malware payload (Mirai)", "value": "9a90943802d26bc767fa91dfcf41eac6337db32c5816145803e53d3f3ad3d8f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001092, "uuid": "d12c4725-9a42-4ff7-b97c-0d31e53357f5", "comment": "Malware payload (Mirai)", "value": "0bb7a55098c582958ca448c76a15577378c0dab8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001092, "uuid": "0682bd14-cb1c-4f12-9d65-f177efb823a5", "comment": "Malware payload (Mirai)", "value": "836178bae3a08e9c5445a9b4d6334a776847e91a92f6ec08482b49581676492960b12a89734a0826896791b53c595a93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001092, "uuid": "a69911ca-ac40-46bf-84ca-eae6bbed1bdb", "value": "T1F4E30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001092, "uuid": "1ee0419f-c826-4a34-8a32-e937be2f17e5", "value": "3072:DHea4CHoUjnwJIXMb6Azz1az/AWdYV8P4KLd:zePCHoQ6IXufzhakr8P4KLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001092, "uuid": "d24ffc80-2e15-4706-ad9d-9baeb890c5d2", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001092, "uuid": "94b9fb49-fcaf-41e3-be5a-430df2f43bbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001092, "uuid": "28573126-01e6-447f-8566-e5beccadf632", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9b6131-5ae8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780009214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009214, "uuid": "0f2c0750-d586-41f2-891f-71f184057880", "comment": "Malware payload", "value": "f35950410ab1d8894062040aff0447e7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009214, "uuid": "65bdbee8-982f-4bfe-b7aa-dbd3b0605598", "comment": "Malware payload", "value": "9abae00ab9db904886ddf5feb3696be266331f22d3894a95872319a6d318b4e8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009214, "uuid": "9bfa3e2c-482b-49c6-9797-bee700e97e63", "comment": "Malware payload", "value": "e5ea9e0adafe71b4bdd8fee80e716870858d9776", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009214, "uuid": "537016f2-70db-4c9d-9d78-a4c4bb31aae8", "comment": "Malware payload", "value": "3d4add319aabbbfcb508d4b5bcbcaa72496af6f3b8520a74f90706a05ce03d3e481bfa96805023eb8390e6881e5a05c9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009214, "uuid": "4c01b736-46af-480b-8253-87f880ea33be", "value": "T182A31541F7E94119BEB72F442AB906B8497BBFA2153DC9DDCA500D4E0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009214, "uuid": "5fde95dc-d711-46f0-b718-7f310598a925", "value": "768:yH91cFcc9CqAlvF2Urhl2xewGV9seTJvcDF5c/My/r05W0p+ABgOrx/6WrnvI0SW:stYtBru2duSu95loN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780009214, "uuid": "83baf7fa-b590-422f-8602-5a2c48988343", "value": 105976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780009214, "uuid": "55aa2ee1-6aa6-4c22-be16-78c562d080e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009214, "uuid": "4ef274d2-7d59-4c40-a4ff-084050ff7c3a", "value": "rmemorando_fd0fc11d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1ca4e0-5a2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779928634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779928634, "uuid": "b2835fb1-7483-49e6-9148-51628009852f", "comment": "Malware payload", "value": "5b33ac9c57ef09c18e695a6cce3640aa", "object_relation": "md5", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779928634, "uuid": "4d163dad-7f6b-4f15-a517-54ab4cc3717c", "comment": "Malware payload", "value": "9d3d5ac032a3d26671c21b3b8832c46785f30523b3631ff2d59d5eaf3494d661", "object_relation": "sha256", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779928634, "uuid": "f6c549d1-26b3-4376-87b4-1239469051e6", "comment": "Malware payload", "value": "aa54dcb729106c6fb91d236a44dffd173ccd80bb", "object_relation": "sha1", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779928634, "uuid": "a2cfee55-e424-418d-8076-4b497a39010b", "comment": "Malware payload", "value": "eb7b23adff04ecb32cba2e2a981ed5d6df8032c8c7364c563ba74114d2f427c21ba30664c50c79853299edac9f120537", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779928634, "uuid": "9ca9295c-5b09-476b-ad9a-de50cb8e6d14", "value": "T12F259E5AA3B800B9D077D2B4CA574A07DBB2F806223496CF53D15E9A2F27B71673E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779928634, "uuid": "e82c8463-261e-4129-ac9d-2786b42eb586", "value": "0a846fb067382dc468a013d7d46fcb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779928634, "uuid": "f0d7117d-e401-4746-816e-f65ecbf7f665", "value": "12288:E09iwMl3LExajXLWXGweOFc/5clMDeWqGFoFbDCGsa8+PMIqO/0YIL:MNl4S6XG0M5O9GyFVsa8tIn/bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779928634, "uuid": "2d89cbf6-34d7-4fad-92d0-7cc2d12da7b5", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779928634, "uuid": "8b869914-ead6-466c-8bdf-a053da322b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779928634, "uuid": "5ded8ce9-5810-4d40-bf48-4b4dd5927668", "value": "9d3d5ac032a3d26671c21b3b8832c46785f30523b3631ff2d59d5eaf3494d661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84baaea5-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946306, "uuid": "5faffcab-991f-44ea-b6cf-2b8fc7084d8f", "comment": "Malware payload (Mirai)", "value": "a935e60ad9874ca5aeeff753f5037d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946306, "uuid": "d8ef349f-c5b7-4a83-a16b-39f781f1aa86", "comment": "Malware payload (Mirai)", "value": "9dff268fd708b9304f931fa96f62cdfb73710a171fe07f053576a6a7c9a925c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946306, "uuid": "21cdff53-62d6-4d81-b8eb-ae1b7d7d4bd8", "comment": "Malware payload (Mirai)", "value": "f7dfa446a9092a4bb64ebfa2ccddb0f22be97a74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946306, "uuid": "a43f85c5-b5e8-4f8d-81cf-5622ada413ef", "comment": "Malware payload (Mirai)", "value": "aa9d2caad68c643439a690f76982fca7490999071935f6a82a032d51ffb98f753e1c67c7290dfbd0a6eb2640dabd7e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946306, "uuid": "87845f40-204e-4f24-8b44-24d0035eed5d", "value": "T1664319C4A4C3F8F6E801147C207AAFB2ADB7E17EB4759D9AD7D81523E901A02D50639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946306, "uuid": "de01e082-a3ac-4672-9071-9d58ddd4e392", "value": "1536:yP/2+OX+hs4pIq/sxSWk/zvwt33U3zo7:O/2+++BWxSWk/TQ33mE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946306, "uuid": "0d9c3a59-9ffb-4a84-828d-dba5f938106f", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946306, "uuid": "746093af-3b80-465e-84eb-1acd8005118b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946306, "uuid": "76466a5a-ea16-4d9e-abab-663a7b810220", "value": "uranium.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b54ebc-5a36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932722, "uuid": "a99e16a5-7899-47f6-a8a0-c09f42b474d6", "comment": "Malware payload (Mirai)", "value": "2390ef83e5290c56b493a31ae1f23f2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932722, "uuid": "4a0ead59-085d-4d7f-9e32-5ca2e0c4010c", "comment": "Malware payload (Mirai)", "value": "9ef69c0331e9246ce7b015080ec41335b3f64ed39920388f02ffc870af0bc0b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932722, "uuid": "d8de1bf9-4e9e-4a29-972c-8a78bfd23882", "comment": "Malware payload (Mirai)", "value": "8fe7c61b4c4d5da9f872a1beb8c32b3fe3fdc966", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932722, "uuid": "49102c34-8153-43e1-8810-b3365954e59a", "comment": "Malware payload (Mirai)", "value": "1167ba48d3a905bc9a5848f9a1a18aa0030ca866de4a1aecbcf1da0afb5878788f2ded80c636ba80a97842e037b9f218", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932722, "uuid": "c680f2cf-7719-4bdd-b942-122d6a4dba55", "value": "T18ED38D22A9351D27C0D498B711F35376F1F6038E34B88A1EBD710E8DAF55AA03657BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932722, "uuid": "fbca578b-961f-4e26-9d7f-037f2cab9352", "value": "1536:9EHiL4wTfWLQaRiP9fJP1OfQ4dSi32q9ucTO9XiFDbttDlYm5kTo2aitD6qr6E9f:aI4+td9xk8oQoxb3ZYO6pU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932722, "uuid": "3e2c1e32-17a3-4808-88d9-4ba57d019f0d", "value": 133176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932722, "uuid": "c39c1da0-034a-4e58-acbb-09e3fd56779a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932722, "uuid": "da6ccfec-71cc-4b1e-b697-08eb819e4a0d", "value": "023782pler.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40977e63-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "ac4ef0a7-41e3-457a-a296-4acc9ea634ff", "comment": "Malware payload", "value": "d590d3959702858e64af49e0919ed940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "135d0f59-0cf8-4a9b-a1e3-01b1e223e510", "comment": "Malware payload", "value": "a002dd535c4922cbcc35a1b2476ca5d0f591559555bdf33523f8a1b5a1dccd8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "d66fbdee-798a-4fbd-8b8d-f20f71b1765a", "comment": "Malware payload", "value": "0041d90a4e82f94a00fa10d670030a7f7e571705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969814, "uuid": "39892879-082f-47e7-bea3-847ee5c8a248", "comment": "Malware payload", "value": "01bf761b94b972cd4c7faecc9e0817488c146da1b78b3138b1b92f4005c1341139cee31de1e8e4c0cae57ea8b4f9b8cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "93f76002-a6ff-4a63-b17c-7dbe0a3715be", "value": "T1FAB5D05667B500F9E167C278CA528707EBB2F45527309ADF07548EA62F23AF25B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "2fd63f0b-a9a1-44ed-919b-2493b040dfa7", "value": "ccddf740495379a87b950796cd164c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "43ec1116-8c7f-44d2-bf8f-d91e3e80aa7d", "value": "49152:edkKPaRAob7DSKEYxFj+oPZyUJo+14dVWqNZrU3z/oHKWFB6kAu:aLit7Dnj+eyVZrU3z/oHKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969814, "uuid": "bf2bf371-a6ae-4899-b909-50d91eb1c7c0", "value": 2291712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969814, "uuid": "124ab770-6b87-47b9-bbff-010c132f5663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969814, "uuid": "edc492f0-3517-4f3d-ad82-7eddfe8c1333", "value": "a002dd535c4922cbcc35a1b2476ca5d0f591559555bdf33523f8a1b5a1dccd8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab94e1d-5aef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012056, "uuid": "d8380261-eaa6-4883-a2b0-41eb3e278b1c", "comment": "Malware payload", "value": "7b73fbef7f602d6bbbca25ca7c073b34", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012056, "uuid": "e6146863-aa2e-4c37-bfaf-93249257c97e", "comment": "Malware payload", "value": "a02296ceeb8f1419fe18a4376ce3b563e5de0fe8d85e7bf1b8461784d3c17992", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012056, "uuid": "02d81770-c021-405c-b892-2f6da5806cc7", "comment": "Malware payload", "value": "1389dde9a90b42d5c12ad59154eda62ed77fe109", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012056, "uuid": "5ad024d1-e4a9-4b5b-aa17-492ba7d7e87f", "comment": "Malware payload", "value": "01dd8c72371889722a57f3d6d2b9739f764ce69a337f0135741448908dfd6577971773cfdd4288bc8bad7c554930ace8", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012056, "uuid": "95310a67-0f46-49b6-8d8f-1ed50f1f090f", "value": "T168757D42BCDB24B3E5011AFF2F6692BE2334990D9B3D9F83D90C67797E724A00921765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012056, "uuid": "2445ced7-c621-476d-aea1-ce7188cd218a", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012056, "uuid": "a178de07-f217-4048-b120-4dcac8a64bd6", "value": "49152:aZ3JTQxZ6fIWrUdDcFIPiWr1HxW5d728DqYK1t:aZ3tQCZ+hga8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012056, "uuid": "bc379040-4ee4-4b63-8089-37439f88b1d4", "value": 1703112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012056, "uuid": "8f7a5738-7f44-4f66-9421-7e30dfb52d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012056, "uuid": "49da4748-0bd8-4afa-b9b6-6ae21e0749fb", "value": "CuService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dede837-5a5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779947878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779947878, "uuid": "d2f71db7-bfd2-4fc2-ac24-68a22a297e34", "comment": "Malware payload (Phorpiex)", "value": "6df681d832d1c3ec0654d940949a093f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779947878, "uuid": "235586a3-4c8d-4bf0-a2c5-aa909c74562c", "comment": "Malware payload (Phorpiex)", "value": "a1e6596aebf29245f949787234fa4258a2978cdf86275224af0700899f4b6704", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779947878, "uuid": "6632e86d-326b-4858-ab00-6960d77680ba", "comment": "Malware payload (Phorpiex)", "value": "7274ad1259fbde8f7db5d6000ee8ab25e43525f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779947878, "uuid": "7b65d597-ce72-45bb-876d-f48e8f14786d", "comment": "Malware payload (Phorpiex)", "value": "477a9ba09fe36e1aaed82bbe607cebd213eff18e2c90a4e453a05805dcbbe6bfd92ee0e9177246a82b024b7f11bdfe40", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779947878, "uuid": "27bdc2c5-4ee5-4c27-8b2e-18822cedd783", "value": "T1CCB39E1034C1C432E566117A88EAC7B58A6DFC310F75A6DBBFC406BD4F266D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779947878, "uuid": "a6d9b845-c4b6-4068-8d25-5ae550867524", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779947878, "uuid": "fca1fff8-8fd4-4cc7-8c81-d1a810271535", "value": "1536:j5UDS80TzdtyxeX38YmLfSFLQfeciC0iU4aIxl5/A26E87:FUDS1T7fEfSFL+eF7Ixl5/Auy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779947878, "uuid": "502e6eae-c8c5-4c65-8b1d-855d2c8f6a56", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779947878, "uuid": "08895f16-0a6a-4251-a61f-4807a20f07c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779947878, "uuid": "3d6b7c48-ddb1-4ed0-ac4b-83168ca6e5af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577e4d62-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000347, "uuid": "694985b6-d013-4127-a49b-d69801de17d8", "comment": "Malware payload", "value": "4e9a86864c23692b66cf2ad833ebaaa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000347, "uuid": "be9e53d8-fb4d-46ea-992e-1334dfe6bd96", "comment": "Malware payload", "value": "a2dc89a15bb42810c1f9b403ca98815975d56ee01957f27595e3239f2290b422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000347, "uuid": "b0c61021-5313-46c5-b7d4-ebe2791cbc1b", "comment": "Malware payload", "value": "26b464b07bab774b3996872fdafa7b1f6a2e0452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000347, "uuid": "ef858a3c-75d5-4c76-b325-353b1e81a7d7", "comment": "Malware payload", "value": "54c323a4f4944683c03a024e2817a0095cf86491606184e2bdf39f593f3fb52ad152e3b94b1aa11f957c63a4b405131e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000347, "uuid": "ffb5adcf-a2d3-44e8-84d9-5b561caf2fbe", "value": "T115666B45BC2DB462D6C976342F6252953339BC488F81C7272618BB7DA9F2358CF237A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000347, "uuid": "819466e4-4780-42b5-9f9a-333576775d1a", "value": "49152:zbRF4x+i87vm1FrViWxFxC1+cnwUNGq8eW2S0zAEI35E6L:zbT4xc7vmH0WxFA+cYDFEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000347, "uuid": "f0dd647c-b6c4-41c1-8c94-897ce0048e5b", "value": 7078072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000347, "uuid": "b691b650-981c-4501-a7ce-c3d92b336696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000347, "uuid": "af2d3300-868f-4f01-bdd5-4de34b230c73", "value": "vulcan_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3d012d-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969919, "uuid": "ac26a8c1-e741-48bc-a836-2f5a5dd0c944", "comment": "Malware payload", "value": "988a8c823aa1d9d2624d8237ac1f73ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969919, "uuid": "68a63d1e-4d58-4107-888d-774c8a33cc0e", "comment": "Malware payload", "value": "a2f8d572747b402a749797532bd9406cf0134d4708012b1db3dfd8957c99e9a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969919, "uuid": "14352bbe-4c4c-45f2-8eb9-da5fd8d2af96", "comment": "Malware payload", "value": "155b3cfe04466d781cf93dbf5dc666973c0ea5ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969919, "uuid": "f5ff31de-1588-400c-b601-febf72f535a3", "comment": "Malware payload", "value": "fc1581bf0af710374810abbbf42210439a23d1b4fe3930830c5561d1f8f1c664cdee3390f69c3d1cb29e006ecc812127", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969919, "uuid": "d27b7824-1987-4c4e-9ca8-d6f1cf122a1a", "value": "T198316EC015D53A7ECCD4941B6A43607D207E78C91F2B2EC4DDEA78C8E798692F660D0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969919, "uuid": "c6119aad-cc78-410f-be1d-7aadc137a764", "value": "24:imNEBvi1+maBFBvK9htmTNTtqBvTm7TQmiJ1BvWPZ7B/m8LQEByTvDp8QW3tqBVC:imNoviQmaB7v8htmJcvIsmgLvAZF/J5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969919, "uuid": "feef9f63-26c7-4746-80d4-eb286866b9e0", "value": 1487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969919, "uuid": "0c8303aa-7dd7-4951-837c-1d69f744d21e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969919, "uuid": "8bb8d608-c527-4c9b-8d63-6675e786a87b", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e551ef38-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961930, "uuid": "37d2e161-8a5b-402b-9df3-8909d50fceb8", "comment": "Malware payload (RemcosRAT)", "value": "066a726ab13492302495a0921f14e0e4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961930, "uuid": "9d0e42f7-8574-4617-9f81-86d415fd3a68", "comment": "Malware payload (RemcosRAT)", "value": "a39114844ca4b2554b1f8f48f349e9facdfb5835c9888f9770b7768e369362f5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961930, "uuid": "7f031ce4-5d0d-4dc5-a72d-2cc307092266", "comment": "Malware payload (RemcosRAT)", "value": "a94f6dc5d5b7784ec9dd1ae7612932008c244935", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961930, "uuid": "2e9a8930-6e34-4cea-9d40-ed348af74106", "comment": "Malware payload (RemcosRAT)", "value": "ccf265ba6f128d9571ff976124859d190753767ad832b2017bf821c383f2868e01e8f331507bff92b270524595cffbb0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961930, "uuid": "c2ac0f6f-bff6-483a-838d-a25ea154fb29", "value": "T123D2B43AC988AFF40B2E62D2298F3D17891907137674260DB8CDD54D2B7A360DBF55E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961930, "uuid": "4f3f2038-c4a8-4da4-9edd-feac0dc449e9", "value": "768:Kj8C9mvcnWRjKgGOapPhRTzJQK1fpOMOX:y8C9m0nWBKgGOOpRTzJ79pOMOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961930, "uuid": "a60307ac-d39a-4942-84fe-e388c4486328", "value": 29939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961930, "uuid": "e13d4f94-1d2a-4614-a4cf-2071fb3c7d7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961930, "uuid": "d564f42b-6ac5-4f6b-b802-e765d7398e40", "value": "DOC_05272026-34566.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9a477e-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "d57f6192-6d94-49db-8669-770db634e2ee", "comment": "Malware payload (Mirai)", "value": "a96b5cc97f3145fa61f876f4c792c4bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "3f56110c-0e88-4036-ba7d-6ac149830c55", "comment": "Malware payload (Mirai)", "value": "a3edeebd207a082181142a08069baaa1493c7dac9e6b78212dcfa1dbd874cadd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "9a148211-0063-4d00-aed8-7cf71ebc3c1c", "comment": "Malware payload (Mirai)", "value": "cf109a47996328216a83bd53d7517d67beb5d2c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969032, "uuid": "0f0ca1dd-a4c6-401d-9d5d-5c45e99cd514", "comment": "Malware payload (Mirai)", "value": "e9e8f449e92e604ec2bc57749a317d8a9a9447ae369bfea45fd391eee88c7c234aec38ebcfa1e86c2647f65c4e3ba806", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "25a7844e-5d2d-437e-9cc4-e08dd2700d44", "value": "T10621FC09F255394FD9AB1178142F062A34307A4AF4138413F3769E3F7EBB6D8121B18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "1ce0f25f-2f9e-460c-ba82-1db3d1c4b26e", "value": "24:3gAa8DzSWPpbP78Pwy74+CiCTHYrhH6JlD8ECAfGFiocluo8HDrNT1G0:TpP3hb/mkTkhaJF8DAfROo8HDrNhG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969032, "uuid": "822566f9-0e55-431b-aa75-b5a565db4a83", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969032, "uuid": "008daeee-6514-435f-a264-92d60f76b27a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969032, "uuid": "becabfe8-d840-4277-ab17-ab066932bd96", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa07814-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "2428bdf1-14ec-437e-8ee8-1a46ed1a8316", "comment": "Malware payload (Mirai)", "value": "14894cfc7a4821cdecfd82407cb88212", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "e2f455d7-c525-41ca-a827-62f146dbfa60", "comment": "Malware payload (Mirai)", "value": "a4b6a754406e0833759c6e46e5505a2c7635bb25a1932f938adc8f76cf6c08ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "df654b76-54c9-4e3a-b022-e6fb191f1796", "comment": "Malware payload (Mirai)", "value": "17c1ba4d9921156b33a166cc57ac858f2d2add8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973938, "uuid": "fd4e611a-1044-4db9-803c-1ed862fd55bc", "comment": "Malware payload (Mirai)", "value": "4397c0507086cf5333dae6ed41b4791c892abe53dba4939ec8fb68e7f1d7e7e4f8cb27f600d52d4b891aa3e5feb3931f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973938, "uuid": "4a8ebdfd-3012-4beb-9ea3-aad30c8ef79e", "value": "T149F3885E2E228FAEF26CC73047F74A24976D23D627E1D684D2ACC1141F6029E545FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973938, "uuid": "c9524ace-359f-4b92-acc8-f1f1e57586f5", "value": "3072:t4cEI7hCnD8LNUw1nID2tJt3riZpgHYSl:t4cEawn6ID+L3Qpg4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973938, "uuid": "c914eafc-48bf-4f1f-87a1-18d7a11ada79", "value": 169120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973938, "uuid": "fe6c7cb8-6e1d-4fe1-a314-b8f948f845f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973938, "uuid": "27254265-676f-4700-ad90-d4a549f86b01", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ee5de8-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966546, "uuid": "f49b05dc-7019-4fe7-8ee1-44d77319cd3f", "comment": "Malware payload", "value": "7d3c2a4d6b753fdab1b1205198a5b556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966546, "uuid": "ab6b09af-acfe-41c5-838d-f3a19b04f01a", "comment": "Malware payload", "value": "a5b7872af41ce8b4de83cfa402c76265ae6a5aabb0428a129602797d022c1f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966546, "uuid": "47f7ee03-626c-4c91-85f1-86ca1a08c535", "comment": "Malware payload", "value": "28da5b8ecc61db4e9b1a8093294a8e90ad1d53c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966546, "uuid": "1a01f4ef-b60d-4a26-8398-02d6b90f1dd1", "comment": "Malware payload", "value": "2f3405e17513174e0e2d9162dc2cc4e8629a8060ebf08ed2a5f7ba2cf48d29b25fe7a29ad2f0d2d0d7e2afc3df2df947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966546, "uuid": "7a3f872a-c4b6-4b65-825f-87c0c0fe97e4", "value": "T1E0B5D05667B500F9E167C278CA528707EBB2F45527309ADF07548EA62F23AF25B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966546, "uuid": "32e1b1ca-1d73-4635-addb-fa4988c91e3e", "value": "ccddf740495379a87b950796cd164c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966546, "uuid": "47c8c4f5-b9a3-48ec-935d-210520424592", "value": "49152:OdJKPaRAob7DSKEYxFjHmOTyUJo+lIdVW6mZrU3z/oHaG1BKkgb:qEit7DnjHLyeZrU3z/oHaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966546, "uuid": "7fa94764-c499-4292-988d-ec8f40c37789", "value": 2292736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966546, "uuid": "d950d395-661a-4252-b47f-238d94bdbbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966546, "uuid": "71d97129-ba93-4a03-85d5-9260e6d57054", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3470cbd5-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779969364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969364, "uuid": "15f7ff85-5070-437d-b504-b3d3d80caeaf", "comment": "Malware payload (MassLogger)", "value": "40852c298ccaa1cdcbc2b48c0f4e3e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969364, "uuid": "e413b48e-122c-461f-8e8a-c8e98e41e4fc", "comment": "Malware payload (MassLogger)", "value": "a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969364, "uuid": "244e0659-b71b-49bd-8684-980a324c0644", "comment": "Malware payload (MassLogger)", "value": "1b61a4874fc933ba3d786a1f9d06a0ed3ada3a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969364, "uuid": "0f08ea9c-ae23-4d61-83e0-58d3e7ea836a", "comment": "Malware payload (MassLogger)", "value": "81149eba3d6fcd605cb8ea9059ffb61e077f0e6aee8adedbffa0c1eb41bbfc246f839bdcb3852b4071188e4f5b8cb983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969364, "uuid": "b43ee34c-999b-404a-9f5c-7edcdc72cedf", "value": "T10555BF5273F84216E1FF5B76A8B2481487B3F4669A36DB4F098461ED1EB3780DE10B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969364, "uuid": "a4a7bf16-3673-477a-9d65-b5120ee5132f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969364, "uuid": "f3e969e9-e98e-4c9b-a7b2-ea6088d7890d", "value": "24576:KfedLZCfxbIRxJzck+uGW/yFoBkkAxg2jJv4VDZzAT:KfeLZVRTYjqqanRaJvaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969364, "uuid": "bfd6ba44-f002-49dc-9034-a4882a5b24d2", "value": 1383424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969364, "uuid": "cbf9a391-4b32-42de-8a91-40599275ae50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969364, "uuid": "3d573b66-ffc1-4e0a-abb2-114c3451c8c4", "value": "a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b82edf-5a86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779967054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967054, "uuid": "9ba34a85-9f7f-41ea-9d3b-a24fcdc93fec", "comment": "Malware payload", "value": "d4897c33f9644834b73ca3b953d676d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967054, "uuid": "15a9b5bb-dad3-4b9a-a770-b9fb1775a9bc", "comment": "Malware payload", "value": "a5bce9d81bfd68292176004facdd872c5a4c628088b4a9464dc8af7a7db4ed33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967054, "uuid": "e4c5da2a-6fac-45fa-8519-f38eee74440f", "comment": "Malware payload", "value": "3b98e64d6fc55996aa4b9ca928c0615048cd1231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967054, "uuid": "cb83af11-bf20-4eea-ad78-5d3dd8a1f36b", "comment": "Malware payload", "value": "ec4937d54f4ca498a9169d6855207de0e29df5f464bd558d140fed1eb996ff67b3ae73ab4590d83af5dd8bb5ba6b0c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967054, "uuid": "56e0d428-07cd-430c-a347-dd5a5fa9dfbe", "value": "T19253092BA35281BCC846C27482756B12F232F8950A70ECEF775957605B74AE0B73E5F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967054, "uuid": "4df72830-e327-4636-9746-54f714c22b1b", "value": "25355b40504d6b110252a23454637968", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967054, "uuid": "01e4d86f-cd76-4047-81e9-d2fb7b59b878", "value": "1536:7FE+4MUcjCKT+TDwopB76Y2lYht9YRXOHHgozV2So:B4TwT+/wopB76YfhfoOHHgozVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779967054, "uuid": "c4a5e5a0-fdf8-4f90-971b-105463f27f7a", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779967054, "uuid": "8e1a5d97-d3d7-4562-87ad-bf2dcb94eda8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967054, "uuid": "91c5d318-d779-4209-9c60-e624fb6bfe06", "value": "c2r64_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d480cdd-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000303, "uuid": "925aa395-36b6-4c69-b75f-ecb325bc25fe", "comment": "Malware payload", "value": "ffe46dbca947c5a453fabec8467889b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000303, "uuid": "cb0bc437-739e-41e0-985a-3b6d7173dcd0", "comment": "Malware payload", "value": "a5eb52aa030b1a3155c90f6aad77b464f2c88aa0cb16135edb8f2f57720a6f3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000303, "uuid": "a709c4dd-c67c-4848-b32a-a54e2343744e", "comment": "Malware payload", "value": "fef96044b05635b28293a4b5e21d26fe4d57ba75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000303, "uuid": "2f0af883-1056-4795-b58e-5f9cd9d700db", "comment": "Malware payload", "value": "aa03c4b77129ab55fed488a71748cc30283065d067a89c3bc60bb7bc676cfda94ac1d5f961afafb5ee2bc6bea68b11cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000303, "uuid": "2f7a8084-476d-4b1b-81f8-4c2549ef451c", "value": "T14295335A1D40050D6CBA0C79BEA455CA3BE9D5CF628AFFC768A60C38D1C46A8CCFF558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000303, "uuid": "77392f63-6cff-4a00-b406-a35bc2c9bee5", "value": "49152:yhCmUI8kL4CLILufqZqBJ/gAA3OLnQAzUcRs:MCm5884aHqZRTOcTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000303, "uuid": "fdab7e68-6621-48fd-b0e3-3fb84db8ec16", "value": 1993448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000303, "uuid": "1142fb34-2f09-41f7-8a6f-8e2dec0c8886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000303, "uuid": "2e4f15b7-c65f-40ff-b295-d952d7c27092", "value": "vulcan_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c501047f-5a2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779929664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929664, "uuid": "89c6fe34-5dab-49c5-afa7-8d3027979008", "comment": "Malware payload (Mirai)", "value": "b3e019fe9b72c6b409075f88e1f6a5cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929664, "uuid": "48d74173-10fe-400d-b335-e31405a6cd82", "comment": "Malware payload (Mirai)", "value": "a6094fcdcba63543b21e527115a826b7ed2f9995f5cd80e6cd5cf64d1bbe1667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929664, "uuid": "3cf4ad88-c9eb-47fd-a7b7-f70979aea252", "comment": "Malware payload (Mirai)", "value": "448c106037c336278d093bcde4fb6c6c4d8121a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929664, "uuid": "79f260c7-75cf-4d8f-bc56-efcd043a2a28", "comment": "Malware payload (Mirai)", "value": "9205e1534a067c83c6c0e67caa81d4ddf279f0d083687c175294924edaf57f187eccfdfbcdffcb7df5762d638869f71c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929664, "uuid": "f5439e51-0127-40fe-addc-8e45c66f96f9", "value": "T1BEC63D87B8924942C9E43A37F8BE80D433670FB99B8756565D04FD3C3ABE5DA1A38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929664, "uuid": "63bfae8e-8d14-44d9-8870-dd98db58368b", "value": "98304:hhpApkHdlF+r4sN0QQe+dVHz+SGNgNUt1SgCyhU4ED:TpSkC4sNMe+dVHz+SGeSt1SgCPxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779929664, "uuid": "be25c791-d82f-4731-be4c-10543d21a3ce", "value": 12255394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779929664, "uuid": "e5a1bbf4-d10d-48fc-8e92-c98fb821bf31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929664, "uuid": "fb6411ff-f28f-44d0-9ce7-740fe274ad18", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e5ff67-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974339, "uuid": "4d615d3e-bda1-4e6d-a373-1a5ec87f5734", "comment": "Malware payload (Mirai)", "value": "96241c4ece8e38fe86bc43971f723232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974339, "uuid": "bde79eef-1ee0-41d9-b9e4-42fb7d3f02c4", "comment": "Malware payload (Mirai)", "value": "a667f620ab46caf0f53a0ea7328da9c45b4d575e16b730513ba397639c372319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974339, "uuid": "c9be9332-5a3f-4074-92fe-7211c675187a", "comment": "Malware payload (Mirai)", "value": "fea74b4b8291026fc7b3dea4537cbd66a8d35f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974339, "uuid": "b553c5ec-afa7-4fa2-ac92-1cb4728d2fd6", "comment": "Malware payload (Mirai)", "value": "320b8c61def182e0b47ef58ea1aed5bae9520a34c2ccfe4531e1210517280519243ec865ddfd18aa4a1695ed3459d4cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974339, "uuid": "9ff3c063-6c4d-410f-9d2e-04a488d89b3b", "value": "T1E653F946BC818F05C9D41679FB6E028D3313177CE3EEB7138E14AF28678A92B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974339, "uuid": "c961af20-33ed-4810-b43c-a06b856029d7", "value": "1536:EAnFhcrimaOkjNzeB9a10MpCP4dujryRgHGNkDa50TKJov+ue4kCHwWcqI8EiO9O:crqlFa9VMpCP4dujryRgHGNkDa50TKJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974339, "uuid": "4560a712-cab3-4f3f-a387-9449438c3b1c", "value": 62812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974339, "uuid": "afabab55-1a57-47dd-b1a8-4afc954a5cd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974339, "uuid": "233cae06-3043-4da6-aa9c-12f57a308e91", "value": "0024b6df9502d9ac81b1d9c2547f69721385733ffd6030b9728d584ec53cf57f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da43ee08-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "772ea444-bd57-4131-b64b-550557e3a769", "comment": "Malware payload (Mirai)", "value": "98d37d58fce46a75db3fbca9f3b49be9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "78e5db13-db4e-49ff-9748-d655806be898", "comment": "Malware payload (Mirai)", "value": "a81250987adc632f491a585e5ecda2665ff4b96fd57b240cc656605da84fb1d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "44f720a3-8817-4051-9b52-13353f985eb1", "comment": "Malware payload (Mirai)", "value": "b2b11f2bcbdcaa8be8a0b0b17e58b2459ec402c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "b4f7da00-5e98-40a1-99a4-b7198f0febe8", "comment": "Malware payload (Mirai)", "value": "fba95a7e7e53d415ae3b7e5c4560a1832941631c54c3680d6882e0a19f246ad4d8710fbebc7615b8b576f6fcb930fb0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "4559fe1f-2d69-4075-8100-c35ca4bd479c", "value": "T13F535D8DF783E0F0E94B0570116BF77E96309F064024DE6EDB94BDB2AE32A42655761C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "2337935b-fd9d-44cd-a9aa-e38917362327", "value": "1536:kUPXRLAxyzLRNPbXVp9Uo31QT78W4+6PFhLrFF1rCnr:koBLAsHJuc26PFhLrFF1rCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973937, "uuid": "bb7ff9fc-a31b-4028-b762-6d0e87ec3239", "value": 62764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973937, "uuid": "eab377e3-1328-423d-8886-38e9960cc4c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "41b58b9a-d2aa-4001-8777-c2d7b8f3adc2", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ce9b8c-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779961933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961933, "uuid": "def1eca6-7f88-4e54-bf06-3ac161f060e3", "comment": "Malware payload", "value": "5bfc724e35d812bd3a9c965ba0c93326", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961933, "uuid": "2318869b-cb0e-4810-a53c-fd3f74d8eadd", "comment": "Malware payload", "value": "a8e73c9093136a7ff8d26b27a865b6351f26275ef2980c548d8c79db66f9807d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961933, "uuid": "ea305b6a-d9cc-4953-bcbc-d48dbb1305ef", "comment": "Malware payload", "value": "304c30f1db0a682fa80f666001fd15c5eec1c4b5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961933, "uuid": "18681c43-f4b2-4674-880b-fd5e11132baf", "comment": "Malware payload", "value": "23f715bf21d02293ffc15ee8c5f577ee51a94f83f7d27f0f3809d459f91110f8bfa6b9441b00de66006fc2cc9915042d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961933, "uuid": "2f3bb42b-862e-4539-9147-8897d49295bb", "value": "T130F313DC6570FE422E447CA789B5AD0A1BD4DE45121EB2954DBD0CBA9C0963F2CCFC26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961933, "uuid": "92a402af-cf55-4d18-a336-701a9835027c", "value": "3072:J0roS9UkV4ZTchf+jMSqYCEvZ5Zj3yLBrFAt6SPZYG9xxBvWIhgv5D5Squ3Bn:bSmy5+/CEJWLBxA4oZYgxxfhAZY3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961933, "uuid": "6a49b166-0485-4ea8-a6b7-a630b6ef5b65", "value": 170804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961933, "uuid": "3b0c39b5-3ce4-416a-b822-29d8bf7b3659", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961933, "uuid": "bc0c44d8-4bcc-489c-8443-22120dceda16", "value": "Pre-Alert#X44722XXBooking#XRICG38895300.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c191b9cc-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966594, "uuid": "19d90850-da63-4288-9390-0cc39bfe81e4", "comment": "Malware payload", "value": "5c71a0b08f097f2e866f64de64abab12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966594, "uuid": "a41e1ec3-bc66-4ff4-bcbe-0ba319a9daf6", "comment": "Malware payload", "value": "a8f55797a7cf663d1cb7169c857cd3b5b131f911ee5194e3af84db6f3fa1cdbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966594, "uuid": "e2adff12-ff39-4900-8248-368ecca9cb6a", "comment": "Malware payload", "value": "59c30d2c015175776c8abe2d5c2118c922219f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966594, "uuid": "f9d0e676-07b0-4a60-81fb-faa46405ebd4", "comment": "Malware payload", "value": "a7cabf51a21c29da7292b1f27fca298c264a35e293322efcf9879b16d6cf4d492940771841e91110dba15c35dc734d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966594, "uuid": "dbf69f7e-4d85-440b-984c-11a15f1f0724", "value": "T17B04126F35473C1DD54EEC3EE943C425C4A22AF756A14B058E3BC538ABE32A964CC593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966594, "uuid": "ad22721f-8ff1-49db-a395-aee6fee3b82e", "value": "3072:ufdF8+QYy7F6yGG+ybJdlxbm95rdhBnnZMuxrcVSxVptyNcrG9cBDjmg6vI8Js0S:U80iJdW95xhcadxINclkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966594, "uuid": "169571ba-fe6e-40c7-adbe-8b7d1d5b67d3", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966594, "uuid": "47919e2b-54f1-4786-a30f-b030078e6dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966594, "uuid": "f67accfb-bb8f-4026-87dc-359007dc7529", "value": "UMPDC(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95a68ff-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931416, "uuid": "dbf66662-fc7d-49e3-b863-b850b239b351", "comment": "Malware payload (Mirai)", "value": "296f123380b4dbe8757c687d44b6a06d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931416, "uuid": "e6c027bc-2a4d-4797-9ab5-a83ee6552315", "comment": "Malware payload (Mirai)", "value": "a922142aa027be5372d084da0155f86dcc3ed6a8ba3afe3a803eed17e0ee2977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931416, "uuid": "a725760d-141d-4797-b2e5-757c4cdf0bea", "comment": "Malware payload (Mirai)", "value": "d9778e083d050b87052679a87454ced580318468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931416, "uuid": "72c1d679-8e97-4718-b0c4-2b5248cc945b", "comment": "Malware payload (Mirai)", "value": "79e7f7b99da195a4d4de217410a4692587ea366736a4ca2c13a6025fb7ed2991125bfd3c684af559ecd4d80f3423f0db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931416, "uuid": "629ca9d2-3a4e-4895-be62-98c7b3dd7239", "value": "T179245D46EA408E13C4D227BAB69F524933339764D3EB73069D186FB43B8679E0E77205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931416, "uuid": "058938bb-9ffe-4130-89fd-9e3c576897ea", "value": "6144:kPGRT/+AxaqsZIRa1tVrt5sg6tuwfM/9cT/:kPGp/+AxaqsZIRa1tJzgr0/Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931416, "uuid": "5e9384b1-4ffa-490b-b0fe-7f500cf16f5e", "value": 221803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931416, "uuid": "d548a6e1-789f-46fe-913a-bf101d21bcd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931416, "uuid": "51152506-8469-45a8-abef-75499c25e4b0", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a14629-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969039, "uuid": "4042678b-650f-4cc8-ab12-5149edebb72b", "comment": "Malware payload (Mirai)", "value": "fc65dcfeb9e16a156fdd01b159ed537e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969039, "uuid": "84fdabc5-4d1a-4ab8-89e2-49186302fc6c", "comment": "Malware payload (Mirai)", "value": "a98f45e186b9fc99fb18b072f470a9f373ca8cf023576f1533b6f5d2512ec543", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969039, "uuid": "0733a1ed-fef7-4410-8eaa-9fc9bcc3ba5d", "comment": "Malware payload (Mirai)", "value": "e71f633c32de53e4f7d3a45598451b8a466464e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969039, "uuid": "d4182337-46d7-4365-96a5-7f3d3343fba9", "comment": "Malware payload (Mirai)", "value": "6cc5a4f3b3fea7570283a749c9642c08dcd298071c5ac10f3d8577df2ef9f98584d7cfe3b08c61a71c87d2df286c4d62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969039, "uuid": "4e4eff16-763b-46c1-902a-460cb3c3fc0c", "value": "T1BA41F2191F902F33DD66CC36454A2B523ACC842B616A23926374DD64BD3E605E7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969039, "uuid": "fdbf8a2a-1be1-4fde-b981-75777ea95df8", "value": "48:UQ2wnuDS3N6df9H+SMTLWPkeTvx+FCXp:UQRnuukf9eSoLW7TZR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969039, "uuid": "61bd5034-be5f-4727-9456-aca21eff34b1", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969039, "uuid": "b1238de7-4c4c-40ba-a9ef-556b53a33d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969039, "uuid": "0bb0b56d-8ad1-418f-a080-e4221c04283f", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bd97b8-5a94-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779972849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972849, "uuid": "e1c71529-bf06-4735-b81d-052254573b08", "comment": "Malware payload (ValleyRAT)", "value": "5c6ead65e4c75b930dc834801753826c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972849, "uuid": "a0154ab6-5416-45b4-ad14-cb9794bb16bf", "comment": "Malware payload (ValleyRAT)", "value": "aa029dcb4bdff2ac1e34c4829c774146dcf494f890fb2aefa08f4998321d9e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972849, "uuid": "8c7f2595-8664-4159-a44b-6d4325cd106b", "comment": "Malware payload (ValleyRAT)", "value": "e13adc59c188b778862e1af1f54dfc0f9115dd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972849, "uuid": "58c60442-037f-4b8a-b658-c236eb585a74", "comment": "Malware payload (ValleyRAT)", "value": "0285f97ea34ec1966f45720293b2b3841080a79227a2e111d9bb07383748db83706e97b4d1e04498c07e0214acafc2ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972849, "uuid": "06e74822-be0e-4616-8630-780607b2c359", "value": "T15D23B63F62A980A4E25B80F97B4AB17B68AFF07D50D435170362CE392B17D7A1ED419C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972849, "uuid": "b1de6d2d-3436-4c71-86fa-4a3ff747974e", "value": "a66ac84db6116999f6cded522d9f3b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972849, "uuid": "3bf253b4-dc6d-42cb-8dda-f45ba6b23653", "value": "768:vPWZ6PRcrS+DR/4a1eTity7oe70Tdr0EDYr3Rlm/pZ+AZ:vgHuyRAgH07o/ZDYDbm/pZ+AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972849, "uuid": "310e8c83-89fd-4693-bb14-a09ad081b998", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972849, "uuid": "8b415099-1138-4360-aa3f-efaaff473ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972849, "uuid": "e8e55d80-7ac3-4ed5-9abf-fd503a332201", "value": "2026.\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a607c2-5aa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779980986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980986, "uuid": "2501e655-560e-4170-b08b-cc1499d5c7c0", "comment": "Malware payload (ConnectWise)", "value": "8859c93067029a6515b293523db7d79b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980986, "uuid": "b187ae0d-4679-415a-a29b-d4eb7d80fed2", "comment": "Malware payload (ConnectWise)", "value": "aa116a6279aebc383ed7a9321d580f998436e34f06d07f2cb8ac2d7fd876ba60", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980986, "uuid": "d94c82af-ceec-4919-83a5-58c6e4374a22", "comment": "Malware payload (ConnectWise)", "value": "e3565ac3b44d7223389e8182df4747b1f21db061", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980986, "uuid": "76f394c7-2c28-44e0-8acd-38e617e3af05", "comment": "Malware payload (ConnectWise)", "value": "a8408b700b1044fe596e9f1e223898651f2154d74c99300c10193442aba747ee85959b5d67e1eee8eac5e1c8370ae2fe", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980986, "uuid": "5aef3bda-879c-41ec-9314-008e30836826", "value": "T14246E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980986, "uuid": "e5a136d5-fee8-4b04-90d2-078e0175e313", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980986, "uuid": "eb0672e7-51fc-4e67-8765-54c4e033d818", "value": "49152:eEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMU:LEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779980986, "uuid": "941bec19-54ff-4178-970c-98eea98ca9d8", "value": 5640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779980986, "uuid": "53b2e63c-013c-47b6-9892-e0acb70fd7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980986, "uuid": "07627507-d39f-4086-93d7-3021039b887b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290a9a3b-5ae5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780007570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007570, "uuid": "c437367c-eb72-4e08-92c7-34cef29486fb", "comment": "Malware payload (Mirai)", "value": "1af4ff54c22b6363a34fbb1e3b385de1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007570, "uuid": "eed62868-58db-4371-9b1a-45c302f0562f", "comment": "Malware payload (Mirai)", "value": "aa59830bdfa973937b98e475a16e039496d2b067dc3b3e7df851b3b58cc56f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007570, "uuid": "cd1aa1aa-2ad5-4f21-81f8-bfcd09efbc55", "comment": "Malware payload (Mirai)", "value": "d216df054d156cd0f5b6cbcd3b75fe5653e790e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007570, "uuid": "959768c1-cdc7-40c8-862f-b67ba8959aef", "comment": "Malware payload (Mirai)", "value": "8ace22772ae63611d7457748f922206fbf708f923490bb09c4b52fed687e842cbccb139be5c5e0751549bee79ea234b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007570, "uuid": "e508bf9f-76aa-4668-97e7-ac1175b59e94", "value": "T18DB30945F8405B17CAC666BBFF4E438D7B2A1758D3EE720399256F30379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007570, "uuid": "538c3c53-071a-427a-ba3a-6174ab00f294", "value": "1536:P8KBP98SMw4VgooT047vy6OuMDFVPpNCF73el0qRwywwQ3wQ8fyYchpP1Jsi:0+P994poA4jYF9vCJ9Cif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007570, "uuid": "5b059b8f-889a-4b90-8669-59156c5f1318", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007570, "uuid": "1195c674-6e24-4062-be77-6d527015928f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007570, "uuid": "3b9256d2-572a-40ff-b2b8-c232a7e65605", "value": "aa59830bdfa973937b98e475a16e039496d2b067dc3b3e7df851b3b58cc56f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bc7deb-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973504, "uuid": "dda692bf-6a6d-458b-9c3b-4ae953ac377f", "comment": "Malware payload", "value": "59ee283b9d0e2a86895fa04ebe496a1c", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973504, "uuid": "4fa485ba-c9a1-480f-bc4a-ebb97111f3e6", "comment": "Malware payload", "value": "aa913765e7243b4c67b9d9953ceae4914696dbc59a2cfe49157a6ed2b64b05c3", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973504, "uuid": "4d11d110-5412-4d38-907f-7061c1201301", "comment": "Malware payload", "value": "3b8edee688aef48baf02bd927c26d20fa441563e", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973504, "uuid": "86666afd-886c-416a-bc8a-f09dd264c96c", "comment": "Malware payload", "value": "598dee3b3c372579307cb901f7ba464013c9c43ae858b83922979da5bc3f23629608a66aa4983d56f07307afd1f2649f", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973504, "uuid": "808b0be7-7729-4c33-8add-ef2358425e7b", "value": "T1DFE56C17D66F974D180E3B61106A5D9AFE89CAFCEF726BC4E0CF90B510EA1110B852B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973504, "uuid": "4b3ac4b2-909f-400f-ad02-cbaf963cddd8", "value": "49152:J6/pQ8/pF5Bj0zOUwe8wsI/vR0kH7oTC/0/7sR+0atv7CGLkHsf:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973504, "uuid": "fec98cc2-dc1e-49ed-bd6f-bb4ac0c398a9", "value": 3083607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973504, "uuid": "dcc69ce5-b0c0-4fc8-8c8e-0c6af013c976", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973504, "uuid": "218a0399-5d2e-493d-a96c-0f5e8fb4e0b1", "value": "Required Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8312b53-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961935, "uuid": "502df417-aece-4de3-a7b6-1e18b3e23e2c", "comment": "Malware payload (RemcosRAT)", "value": "bd7c541c65a3319e524eb83c6539c75c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961935, "uuid": "9891fd21-92e2-4230-bb05-46ef6741f6cb", "comment": "Malware payload (RemcosRAT)", "value": "aaa6f56e72d42a67efed13926146255b2a94b6fe5a6b9fce2a9b884f73983e6c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961935, "uuid": "23a93ef4-392a-4bf7-ba26-49139bf3b43d", "comment": "Malware payload (RemcosRAT)", "value": "e716bda9504ce121bb61cfb9afd90f827c14cb03", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961935, "uuid": "3e8c082a-00a6-4d67-a951-360807a9dfd9", "comment": "Malware payload (RemcosRAT)", "value": "21154766027083bd745b2ff520729824e70d741d4c7544ebac87387b7aaea6cee64f9abf7f66e3cba91986e7c869c708", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961935, "uuid": "31c7435c-ac52-4d72-9a77-0ddbd2fc1652", "value": "T13B42B03AD1EDD02E4B3927D423CF141E40F3D9B02D4886B78E95955BB5B18E25E70774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961935, "uuid": "e07b92fd-0e39-45e5-b0d4-e84acd9e0517", "value": "192:L3alk/KMdvzU5vSUQTyE+L/BEYMLwzzaC8PwH2N2X3iUFxfN0F4SFfiW:zalk/KMx+vSJyDTBVnGwH2N2niU/Ni4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961935, "uuid": "dc96cf7b-de6e-4484-b6c7-a1dba408e5bd", "value": 13067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961935, "uuid": "a8df51e7-e37b-40e0-9111-487cdbc7a2a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961935, "uuid": "5d7688d3-5212-43f4-be3b-bdf21edb48b7", "value": "DOC_05272026-34566.001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271e6bdc-5a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779952591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952591, "uuid": "abe1b0e5-65b7-468b-a0f0-0440e5b02f47", "comment": "Malware payload (Mirai)", "value": "4b6c27c3bf561c022ed1dda6573f8f46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952591, "uuid": "231083e6-7e31-42a5-9edb-d1c5a9383dee", "comment": "Malware payload (Mirai)", "value": "aaba78b20e258137fc90bdfd957582c0881d27f74a1ae39f584773748643b94a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952591, "uuid": "4e186812-b852-407b-8e1d-044fd60a5b0c", "comment": "Malware payload (Mirai)", "value": "b7e2929692125e1a9e0d73e96ff9d4f1def39716", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952591, "uuid": "1ba99583-3c95-4f95-8381-b8514d934054", "comment": "Malware payload (Mirai)", "value": "e3cc619e5b0b959ada6785a41e29eb5ca30176f2f8b5084616c4f88b78604e52ad41007543346438dab1d2d9320fb40a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952591, "uuid": "f054e901-e9b5-4e5d-addd-c33e880d68a9", "value": "T170C33AC1F98B80F6D90B4C306067F73FCA3288699077CAA9EF949E35CA375815617399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952591, "uuid": "74ee99b5-28b2-41a5-af5c-0ad941a0159b", "value": "3072:e/nlYDdb3EOk4zURhtiwCwTM79mkfUS21bMqXft:UYDdb3EOk4zKLiwCES2O8ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952591, "uuid": "47b3ebe2-2c70-4d13-8a49-0045ed2db76b", "value": 128340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952591, "uuid": "b280e805-9818-4332-9aa3-f7d239a5f7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952591, "uuid": "0df9aa65-064b-479c-a5ea-8ef7e82dada4", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6f3b2a-5a5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779948389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948389, "uuid": "6d5864af-06dd-4a38-9124-47c83daf68df", "comment": "Malware payload", "value": "e95ddf7bb8c379143fbaf87455d8b27d", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948389, "uuid": "9008214a-8183-479e-b1e4-04648c8f48bf", "comment": "Malware payload", "value": "aabff6a55f89ce4f95acbf16a4e3a7ca9c67e6f3b1f2f739f496572de96c47e6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948389, "uuid": "35749de9-9ad1-466d-b669-15c856ee3ddd", "comment": "Malware payload", "value": "3b9e6d73d268b61bf95657eae141c832b9cf80d8", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779948389, "uuid": "47e234e7-7354-46bb-89cd-849d697cde60", "comment": "Malware payload", "value": "2de6ffed3cd4e8ebe5ad68ae3fccf199d474ff14a26408c6582b5a3a7bb1c2c04a0f0ab0ecc0c4f3e185c46a42665e9d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779948389, "uuid": "a965dbf0-eaaf-4c28-bff1-d68595a38c9c", "value": "T186A63348A59AED02D4D92FF52840E2385778AC89F815C61BDBC6BE7FFC391785B01329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779948389, "uuid": "582e2a30-dec2-4270-aa95-33849e9c3a1e", "value": "196608:8QhiGfhICyBQ+cX4Q8qHoAeSAS+iwDkeR3XklC5F0nb8PxrOagWPo:8QhJyBIXDkSAniwAY3XklC5u8Pxao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779948389, "uuid": "4a485e08-f46d-4eb4-9e63-b7e6472fe59c", "value": 10222592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779948389, "uuid": "c5963229-5597-459b-82ff-3cae621c9d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779948389, "uuid": "78931152-5b16-4e5d-9de6-9d9baeaf01e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878dc06a-5a3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934714, "uuid": "3f648138-1e57-4575-95d2-df7b3b4e51e6", "comment": "Malware payload (Mirai)", "value": "3214b1400281d2ab0fcbeac022825deb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934714, "uuid": "ce84607c-75f1-4be0-a729-a4ae1b79a126", "comment": "Malware payload (Mirai)", "value": "ab2b8216180464d16def83d742252a055c626758bdd4c54343d6ed68aea4294b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934714, "uuid": "9c8fef0a-47a8-4e69-8cdf-802b557f7f50", "comment": "Malware payload (Mirai)", "value": "9f595a3015b4cc9091f0fcc516328dfc72e13c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934714, "uuid": "a64957df-bf4a-4c14-99c3-178fc36c7cb5", "comment": "Malware payload (Mirai)", "value": "9741802f1cf016bafe56028b37774a0ee09053a08e767a4f84b4838d0b34fa3b9f140506ff567176e0bc10a84a038063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934714, "uuid": "51be0fc5-bbb4-49eb-8372-b97ce82332f1", "value": "T100E6E805AD852BF6C82D4A3480EDCAA612B05D105FF14A7A11A4FEADBC772797B47CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934714, "uuid": "cdecba2c-2f48-49b8-b6d7-60dccd4bdd34", "value": "49152:YzA7lEAa6gALWmSK+YO9GmozdvAL07RUzpNq5V++91nz+SGF0lQ5RehiCUuWEmkM:2SShIU4Ud8++91nz+SGFOdUfaEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934714, "uuid": "a81bae98-376a-43bb-90f1-c229661cbaf6", "value": 13893825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934714, "uuid": "10ca2ff0-b37b-4b8d-9965-795b701a7838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934714, "uuid": "eb0c09ed-f73f-4d80-9e8e-54b840ac0ca7", "value": "wife.mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de22923b-5aea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010022, "uuid": "0c7e71d6-2982-4829-8252-e4b3c09a7cb5", "comment": "Malware payload", "value": "54329fab5b54902e17f5f53b5b720ed7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010022, "uuid": "f75a885e-60c8-42d7-973b-60234e0e80dc", "comment": "Malware payload", "value": "ab4187e5c7be2dbbad6fa6a3855124062a623c8897e334746a3937d372db6941", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010022, "uuid": "da5f0336-a49f-49af-b6e3-fca591db341e", "comment": "Malware payload", "value": "2c8462bb1ee5f2f3ef48f7010db638e24c4765cb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010022, "uuid": "da46c2df-572d-4156-9c98-e7c661d7b33a", "comment": "Malware payload", "value": "557cedc45d21d5c61c9813b7821d37fd535501951cf264aa3cff94d61959f20cc718ca0f47c5175ba0d886d9b4bccb65", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010022, "uuid": "e26ea612-0e07-411f-8446-c2bf89057fd0", "value": "T14AB5E740B7EB07A9F9F30EF096B7B76B0936BC1AD814CAACA550154D5C31FA09464B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010022, "uuid": "cf597481-476f-4583-8149-3aa0ba16f538", "value": "1a642b14be9fe0cd220cc41027df7334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010022, "uuid": "142fcb75-b939-4f2e-9539-87064a509e44", "value": "49152:/5cYeOV7UwGpnr2RbRTBG+4rDt/bCVRlm:/HeOZUw+nr8bRTBbYDt/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010022, "uuid": "aec8101b-5dbe-4c81-a7ed-9e76860bb1e5", "value": 2456576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010022, "uuid": "603d459e-2104-4b53-82fb-4d12c9468432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010022, "uuid": "9390d3f3-d073-43ef-bddd-cb4d504b0504", "value": "SDL2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a2f55c-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946303, "uuid": "119b7fd0-8b56-4a44-9476-615b2bbc5f62", "comment": "Malware payload (Mirai)", "value": "567380c48defeebb8325152de6dd69be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946303, "uuid": "16b51b69-d690-4463-ba6a-f0f8a418182e", "comment": "Malware payload (Mirai)", "value": "ab7f3c943743308632332cf8747bc62f315b57acbdb8844c9bd42fc6b977ca13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946303, "uuid": "b595a951-dabc-4088-878d-71d23228a4c7", "comment": "Malware payload (Mirai)", "value": "fa3c677c0ac31a5f6ee0bfa38306ccc0fb990d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946303, "uuid": "f77cb9b6-32f2-40c2-a289-0d8d3c06362a", "comment": "Malware payload (Mirai)", "value": "c7433a530b38626c9d3133eb9d947dc92eb44016fcc367b2561c4ba60e9a9dbe1c18be9f2a36666f9d6eaf065502e7a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946303, "uuid": "6300b55f-7695-44cb-a6b2-12a1b02355d8", "value": "T105D33B86FB409A13C0D61B77FA9F424933229B54E3DB73068D185FF43F86A9A4E63509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946303, "uuid": "f85fc5db-b7a7-4ac9-a31c-0faa4498c065", "value": "3072:53Auz6OTbehLh+BElUCpI3SQeTz+T0IXuGYM/9gY457m:53AuzrTCh6CpI3SPTRIXu5M/9gY457m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946303, "uuid": "42b3c536-4982-4466-9c3d-259790bbb600", "value": 138499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946303, "uuid": "efb594c7-242a-4a0f-aa13-e2c1d81fe176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946303, "uuid": "e9d403bc-a37b-4b82-a646-8a6bc54aa91e", "value": "uranium.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47ca8d9-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970519, "uuid": "51d01acd-4a6d-494b-a4a0-09b0f2a88da0", "comment": "Malware payload (Mirai)", "value": "8f0d655f8acbce11820b47530c5fa001", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970519, "uuid": "b10a4421-39f5-4527-9af7-ccdbb9a0800e", "comment": "Malware payload (Mirai)", "value": "ac5f7e19055d7ffbca7f0a1179746a27b7569f2fd9a6595d00261a2acec2d4fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970519, "uuid": "30ee689d-1ad0-4020-8176-8650f106a01c", "comment": "Malware payload (Mirai)", "value": "a775a78548b40d7788b65f5cd5cdb37203203dfe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970519, "uuid": "93f47a2f-853d-4ed8-8dcf-421c4e5a54d4", "comment": "Malware payload (Mirai)", "value": "05c1e3e018120e94f415533374442499c3e0c2c863f862de7c2aec8f67685c328d1225df6f77743a50b37330336d195e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970519, "uuid": "23b6ea43-27df-4df1-b2e9-0ca385d5b82b", "value": "T190731272227ADEA2E5B2C43253877D99BE234466037452BDBCB9A36FB486E11580C44F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970519, "uuid": "58e92fac-adfd-45fb-b058-c594fa09ad66", "value": "1536:H8zRnwvX0/jMQwZuOPFPijvDMwhQi1rYGhQZ9zWmBqork:czRnwP0bMQ2RijvDZZ1rYGhG13gSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970519, "uuid": "9a70aba5-9b49-4e42-9d13-ecb55068b548", "value": 74780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970519, "uuid": "0d35546b-033c-4825-8da4-19c8d64a680b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970519, "uuid": "8debf464-7765-413f-91c0-ec5e1f118de7", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ef0ec9-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969768, "uuid": "6d48c443-dadf-421d-8622-01e73ba5cc51", "comment": "Malware payload", "value": "e132256bd9bbd07a0fedda7cce300334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969768, "uuid": "065f60f0-f4fa-421e-9b50-d384f46f3bfe", "comment": "Malware payload", "value": "ad4b4ddd207364131fdd6790180aab3983b957e00aad57eb9acfd32a8642ecfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969768, "uuid": "7ea72507-d7dc-4ff9-a5b5-08c918dae395", "comment": "Malware payload", "value": "7994791c26e0cbc7eb4ce623ce0520b4a36a48fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969768, "uuid": "d72f82e6-5f47-4c03-a1b2-ae359d9c7fc7", "comment": "Malware payload", "value": "1e7450646d4343696fd31a8ea9f43f7e15f5e71e360974330a39dc17758048a31b3b2e59a83ec7b4b1076e47466aff2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969768, "uuid": "ad21ce6d-1711-4152-8cc2-04de63bbbe8a", "value": "T145D312573A0A190ED50D483EF154E019EA877CB8EF912B46AC91EA35D8E76BB4DD00F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969768, "uuid": "7bb7d530-83b2-4701-896a-c28aa7bfd610", "value": "3072:sPdy8LIV7x8Wkz6cCeVyuNhVM56pgQi11cU+6xWVpoWQQ:SIV7XNesGhVMQpgQi4nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969768, "uuid": "396dfe2b-7d12-46ca-89a1-87c8e46c5241", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969768, "uuid": "2c3f35e9-5133-421e-ad36-25137898ac99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969768, "uuid": "71190157-91dd-4223-98ee-23de1e9c128f", "value": "ad4b4ddd207364131fdd6790180aab3983b957e00aad57eb9acfd32a8642ecfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0cb7a3-5a9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779976192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976192, "uuid": "c8fc8fc7-5c16-4c71-98a4-6741b84b1d76", "comment": "Malware payload", "value": "f2d60ce520756407e7f9f9935af5703a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976192, "uuid": "ee888c4e-fc28-46d4-8a19-afb1375ba291", "comment": "Malware payload", "value": "ad80f2a05a6bd4b5a0d34c328c4a6280414f779db82ab3917fb59da1e529b08e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976192, "uuid": "bf9db0f7-9223-45da-8081-ee58e2162db6", "comment": "Malware payload", "value": "f0000c490098c51076e0c123e5ee466ee03e14e0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976192, "uuid": "d73e0e4e-d974-44d4-9517-5953bba7f2aa", "comment": "Malware payload", "value": "08ac6e0d443f0ca50e1fcfff6ff01df8794d3aafce9adb72acb2970df880494a403cb99e4a789a427ce8f1a557e2642a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976192, "uuid": "8742eb80-255e-4f29-9881-a29fa8db1804", "value": "T1C60702B91A5FAB0ED1D537000E98B87087E9E7C186557E2CC0C4242DEF6993BCA39D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976192, "uuid": "590e34b0-478b-4d2b-adff-c3a334423fbe", "value": "6144:eZ5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z5Z53:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779976192, "uuid": "17eb7e5c-36a3-457f-8300-8a4cd0829edd", "value": 16854904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779976192, "uuid": "c41eb003-1f46-4532-9f27-5e6388be44ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976192, "uuid": "12e76be4-2141-4d6b-aa13-01317eb86f84", "value": "Bestellnummer 1564319 vom 28.05.2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6411eda6-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973739, "uuid": "7bc68424-5080-4d5b-a37b-732e44ebd4d9", "comment": "Malware payload", "value": "e9f7c11f4d87013304ddf4ac9573b2bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973739, "uuid": "a4d29e9d-e075-496b-af8c-a28c16e863b8", "comment": "Malware payload", "value": "ada8c6352285beb3d8bfbd45116af9433da8746f3fd34eca586dbf5dc107bd95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973739, "uuid": "7ebdb5cf-811d-4625-8b4f-29d0ec046b96", "comment": "Malware payload", "value": "dbbb2aca5278f1743ffa8a8cf4be5ce01e3fd4ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973739, "uuid": "829d7eee-f388-44ed-a861-0a6209d73a2f", "comment": "Malware payload", "value": "dcb4e87cad82183ce3ba445868cb8b05ab71b45c4a92ddcad3714ca32a63208506a887a01c59a293ced46658e225ba73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973739, "uuid": "d5b6e78a-e2d1-475a-9a9b-4d91f78a0d01", "value": "T17EB43C03BF403EEFCC1FCD3705699B46299DA95312A53B762638EE057E1A5068AD3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973739, "uuid": "dec83399-4257-4b2e-9bc9-3a5f64026784", "value": "12288:KSJnm7PPLaUFEWyrRNONloRaS7EONOiEvqIQhBVllZtVVll1JN1F/zmArDyORIDo:KaW67EO2vq9hBVllZtVVll1JN1FLDcPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973739, "uuid": "298d2096-d31f-4ec0-98a3-dc6dce031576", "value": 532860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973739, "uuid": "26822257-4aa8-4f8f-8450-a8e24ad8132c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973739, "uuid": "84eb5fdb-1b9e-4131-9b94-e5c1d6eac2c2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e499d95-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969515, "uuid": "cd42f184-79d5-4109-9829-39a9fc6df3ee", "comment": "Malware payload (Mirai)", "value": "d03bb87c35a2e34cb3b210caccbeb38f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969515, "uuid": "b30fb141-abb7-4975-9219-7e32cb927e3c", "comment": "Malware payload (Mirai)", "value": "ae65ef3fee5838025431e0aa8d00b1a9b1f5ac0253f79b45c4ef678bbc4d3400", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969515, "uuid": "ebab2123-d1bd-4de8-b92e-2263f78a2ab1", "comment": "Malware payload (Mirai)", "value": "b9447a52ee73ecac838418baa43c49e3baa7ec2e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969515, "uuid": "a14b2592-6f30-48b6-9a28-fc22309dbc6b", "comment": "Malware payload (Mirai)", "value": "55c9c27d79f346f9dd82b1b5e84d701bcaef2279ac01f22af5edb3b8ac3a1ea569efc2205f34b504ce4d72239b51084e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969515, "uuid": "1576b413-758b-4924-970e-3ecbf3cb800e", "value": "T1C0934A41736A8407F3A74DB11C3F6BF193DFD5A121A0A185A94EAB0F8231E326586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969515, "uuid": "ec730e51-8d6a-4a61-a97f-bcf4965a217a", "value": "1536:dUYZGveKtta9DikrLYIHiv2/deqNc9uzVN2TYwzpePqHIK9zN9pFZzoE+:mYTKnaFdeSAMen/9B5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969515, "uuid": "139c29a1-e30a-4b84-88aa-67abd0d407e1", "value": 93216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969515, "uuid": "5d6a0159-9933-48b8-9282-c29c1999c162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969515, "uuid": "efe500c8-1b57-435e-ae00-97442dbbe1b5", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1634b6-5a2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779927421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927421, "uuid": "6a5e1825-a001-4939-9be9-dd49677c2372", "comment": "Malware payload", "value": "401218a29d188cb36f564ddeac69abb3", "object_relation": "md5", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927421, "uuid": "1ab52159-0850-4200-bf2b-f4e42d35f8b3", "comment": "Malware payload", "value": "aed99fb5d11cc20a5889cd8b7ee060986265dffc4690e4ed450975562b6e673e", "object_relation": "sha256", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927421, "uuid": "02cade4e-1f94-4e11-a5f0-600f411e57ed", "comment": "Malware payload", "value": "c1e6f7ae20940d51c3eb892e9a450990c66d1253", "object_relation": "sha1", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779927421, "uuid": "6b54073a-ce72-4a23-934b-1cb00857e2a9", "comment": "Malware payload", "value": "3a0cdbc8aa82622ef2e9c3a29674a6487eaac3803971e77f04fb2d82b39d000e355979d95dfbb64a4819a0110f0e5cf4", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-59-195", "colour": "#2638A0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927421, "uuid": "9ef7ce43-6b89-4d86-a0ae-770fd022d7b5", "value": "T11F91730B2A7BC4B5D572C992B663CE0EFF165B47C52A711AB9E8193430006EF52B13C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927421, "uuid": "6f6047ee-9364-459f-9bce-60f0e56bb9df", "value": "96:tIIJ1hFgyDY44ComA/6XeSx7f5K3zcKRlmG:GI3U14Egxj5K3BlmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779927421, "uuid": "913fd5f2-e20a-403e-bbd0-744d8747fc68", "value": 4258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779927421, "uuid": "14c566ac-cee4-4bcd-a4ca-32b9d8a28f8c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779927421, "uuid": "a72b26fc-6264-4b50-8645-81263e5617bc", "value": "aed99fb5d11cc20a5889cd8b7ee060986265dffc4690e4ed450975562b6e673e.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e20331-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970143, "uuid": "5538eaf1-b582-4f39-bb0a-07772f70541f", "comment": "Malware payload (Mirai)", "value": "ea11d1f5be8b3496e44985d63bd807cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970143, "uuid": "10c4acb1-2dcc-4aab-9deb-c7b72d506114", "comment": "Malware payload (Mirai)", "value": "af97c2fd7fe0e8764a7e1d94b9d8e84fe73f8afbda0f1d7f1a5d7ceea5cb3e62", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970143, "uuid": "565a1d67-d80d-40a2-a608-57dae81881ae", "comment": "Malware payload (Mirai)", "value": "acc96bc2596d6888f7ca91651dd3cd1afa40f59f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970143, "uuid": "fa4f90e0-8cbc-4a2d-a598-5ef40d679834", "comment": "Malware payload (Mirai)", "value": "fcc62d58203e122c08adecc6b1a8d5de97cbfd58f79939448289d76c86d61b77e3ff17e11e553cea48d4462869ca6217", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970143, "uuid": "d4bda84f-b33d-4b78-ae0a-61544efdb9d3", "value": "T1FAF0FBA90057BF03C06CEE297936B47BB030D38A048F5B88BEC454FE948C551B134E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970143, "uuid": "0ffec688-1c93-4534-91dc-98db608bcebc", "value": "12:afq3xnVfWXuYnVfuBnVfDaLBm2nVfwNITRYnVfZTWnN:eqbWeCu7DaLBmEwNIlCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970143, "uuid": "52862095-57b3-4d69-861f-4b86aec17136", "value": 642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970143, "uuid": "8463b968-3edc-4a86-85ef-c3b91ecc7573", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970143, "uuid": "4e2e495b-cff1-4797-bfc8-3972c7ab02a9", "value": "zxc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec819375-5a90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779971391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971391, "uuid": "6334f6d3-8920-4720-910d-cf390eb2bd84", "comment": "Malware payload", "value": "b3e06fe8e81054b089d9dce275b2f645", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971391, "uuid": "112a8fa8-29cc-4a2c-8813-c78dec37df0a", "comment": "Malware payload", "value": "afc82dc9be3d3bcf759c0270f16ae517b20e612a88abcab4da18479b9b216991", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971391, "uuid": "ed46e971-a9e9-495f-aa21-4eb801f5de4d", "comment": "Malware payload", "value": "fb15a44ceac52b76ce5007fb7c48849927df12b2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779971391, "uuid": "b854dc87-f782-4500-9b9e-604bddaa42ef", "comment": "Malware payload", "value": "bf33da1e700587a35b34eecba5f58bd52ba831989708ad6d5aff00d0b712db1ea1c0b4b27159e8dcfafd3517f225ab54", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971391, "uuid": "d4489a52-38af-4f85-a8a6-edc2add0a32d", "value": "T1A691E95AEA23B4852C67506E3CBADF27E828B92D90047041B3C5674953893ECD32FAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971391, "uuid": "4bc31f63-a669-4798-bffc-9de725d0e2de", "value": "96:0wafOSOOTpR2KJRTqHRRFZ0ly3ppcx0vn1qWZBrLiD8S8d2UIIPv:0DfOSlR9JRmDFZMyZp5/1q25d2UIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779971391, "uuid": "ca831f16-a9e3-48d5-bdc4-a0c61740e9b9", "value": 4226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779971391, "uuid": "fdf375bc-e3f4-4b1b-934a-ac360fb4a7aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779971391, "uuid": "eb0bd8c8-f13a-4ec4-9d2e-6b518dddff96", "value": "Urgente Richiesta d'offerta B473_IREM_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348b2bff-5a86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966787, "uuid": "73867588-8c8b-4185-8ad6-1b8f52702851", "comment": "Malware payload", "value": "7d21e34d0476e02320cd579a681188c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966787, "uuid": "f931038a-a492-43b4-af82-8e62cc28d2b1", "comment": "Malware payload", "value": "b00ffa3319c0c7768dd16df98249ca1a7c259a7d35c37fff4d1fa3bb19e38447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966787, "uuid": "4032317d-3dae-422f-af46-8551ec9eaa2c", "comment": "Malware payload", "value": "1a50b611027cd694e50c1163196d7eca2a57f4a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966787, "uuid": "42e2e0ba-fb03-4a14-8d7b-ddbe6fcec59c", "comment": "Malware payload", "value": "3a0b7fd2436faab79f11665c8d3216aded270b5bc77bd73b12e5b1563f0ce8db27028b54c10f8c4f24920ec813c35789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966787, "uuid": "edd17f49-80a2-423c-b314-8e270f36660c", "value": "T11F573302EEFAB20DFE62797D94DB5051310AD105F29085994266133E81BEEFB3E819DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966787, "uuid": "fcc2016f-a724-440a-a4d6-4393887f4613", "value": "786432:NHg4PD+hSY9LG05xJi8k3R2nscsyMQvAIyTutG5VV4:Vg4PahZ7PcPuWyHvAP+G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966787, "uuid": "1828f339-68b8-4ccc-96e4-79af45ee0c6e", "value": 27316224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966787, "uuid": "e2b5d100-0de7-4c1a-81f1-97055bcbd91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966787, "uuid": "00e4085c-87e3-46ee-a84a-0df5e37d8175", "value": "Loaderk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c358ac-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969073, "uuid": "82dda0fa-4e00-4144-a178-017367ad99a9", "comment": "Malware payload (Mirai)", "value": "a7178c0acc01f7668c84fc1aad44ce6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969073, "uuid": "52158190-e33e-46cf-a5de-bf3a96c0abf2", "comment": "Malware payload (Mirai)", "value": "b05118f5f5ce2b8f04cb5268695ce152a33d86b9df5feec50238b8ebfeaad944", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969073, "uuid": "22b005ab-8b70-42e9-bc0c-c25477c6c713", "comment": "Malware payload (Mirai)", "value": "8def46207b552839707c7e4212a57dc1c0483915", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969073, "uuid": "96ff0f52-d3ce-4ee3-9732-df9b4e0d6868", "comment": "Malware payload (Mirai)", "value": "58a2bbd7a8fad2dcff049393d1a863018dfb17c31fad731d61219dab617f4dffd3cfa04b94ee081f5d6fd62ee4f53584", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969073, "uuid": "44f089ef-0b5a-4620-ad00-23eaa05a64d5", "value": "T1F0932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969073, "uuid": "0783d194-14ca-4fa4-94b7-cd89bb9f6954", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2/:AGUJtkyYEETn0T32TDBf0nsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969073, "uuid": "c8d70306-040b-453f-b0d0-d7f5fbf41e3b", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969073, "uuid": "d60009b2-02bd-48c6-91dd-248b7cbc4e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969073, "uuid": "3f4f0685-058d-4597-b238-873ce148907b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0507a546-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779974009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974009, "uuid": "56e9cdc4-3f79-48f8-8e0c-a2783f8c2047", "comment": "Malware payload", "value": "5c3d805b6bdd264c20c0487f744979df", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor.Win64.Hzcn", "colour": "#D9E874", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974009, "uuid": "a5cd601f-20c3-4329-a9f0-9bcc63f71c73", "comment": "Malware payload", "value": "b08c5dc2dd1d8883c511da40bceb79de82bfa470f4831276ce3ae7d5f4b4a23c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor.Win64.Hzcn", "colour": "#D9E874", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974009, "uuid": "5a3f43ba-aec9-46d6-a280-e718f0acb6e2", "comment": "Malware payload", "value": "71cb3086a3f55422da0442aa401d3f569bf3f190", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor.Win64.Hzcn", "colour": "#D9E874", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974009, "uuid": "996b3f1d-764f-4db5-84e4-e083e08d1206", "comment": "Malware payload", "value": "734a08a72e22a9e369579ce9abdd2a9bdeaced59998539600062790ece9307b1b254290623d60af2b05deb9f24b1db79", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor.Win64.Hzcn", "colour": "#D9E874", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hzcn", "colour": "#8604DB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974009, "uuid": "73248ee4-133c-4c2b-be77-3256eb7c244c", "value": "T1AC967C4FEA5407EAC9BCD0F05219B572E9A878094760F9AF6DD12D367E67E281F1C308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974009, "uuid": "bd415c50-cf60-4a67-a79d-687ae314757d", "value": "1a4d93427c16838ed2eecbf5c40e450a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974009, "uuid": "a3c1f53b-c714-440f-bf6d-1a94f22d6909", "value": "98304:AF59oEeiqPaKl5y26N++EVVqn+5lXgzf:hEefPaJ26+yk1gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974009, "uuid": "f25e2551-14ca-4ff7-b675-8f94d0407bc1", "value": 8923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974009, "uuid": "c3c07187-a631-40d4-9c27-5da581a9753a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974009, "uuid": "72fb1809-21f7-413c-abfa-3e2527f05222", "value": "20260520\u9700\u6c42\u6c47\u603b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f217a636-5ac3-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779993305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993305, "uuid": "5ae61d96-2784-4c74-8f44-61e4cd8b2ea9", "comment": "Malware payload (NanoCore)", "value": "23cca9cecd664dd58daa4f6cdb9cf57e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993305, "uuid": "14951f78-a8be-4650-bdf8-c2bf34c3e5a8", "comment": "Malware payload (NanoCore)", "value": "b0daeb6a0db9c277f3cf9778d9bde3b6c85ccd96b2a95dfec7299bd611b42e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993305, "uuid": "13e0b004-6e1e-49c9-9dee-f89af24beeee", "comment": "Malware payload (NanoCore)", "value": "98e170c496510e7099ad44578759a5f1f0ab4108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779993305, "uuid": "5adfda21-f844-47ba-beee-362495e19e5f", "comment": "Malware payload (NanoCore)", "value": "5553aab7603902f676ef88eb463e4d10548acaae7b9c21a0248c422028b7ec581f617b328f37f4f18be231d24bf02ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993305, "uuid": "2bd94d96-d1b8-4b19-a586-5a61b52225b6", "value": "T10E14CF2677A88A3FE2DE8979611201129739C2E3D9C3F3DE28D455B79F263E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993305, "uuid": "cc854e3b-4303-4c87-b187-f7c493bb7085", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993305, "uuid": "e55f239f-204d-4fe8-be2e-c1b405ed458c", "value": "6144:MLV6Bta6dtJmakIM5j8GL+1WUQ52F+/8Ej4ej:MLV6BtpmkvGLUcQsEEj4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779993305, "uuid": "e63d75ce-aba9-4fbd-91a0-cdcee4788164", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779993305, "uuid": "75eb69eb-1aad-428c-8189-28dce246b850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779993305, "uuid": "53be71a2-5130-45c7-92ce-623dc8081a9a", "value": "schoenberg-ensemble.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e237717-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000304, "uuid": "2589b6fa-f27a-48f5-9b99-f223b4a6ef63", "comment": "Malware payload", "value": "7ca43b25f4cb23bf58108e7d75686aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000304, "uuid": "d241db76-a941-4118-a6c5-e3162d3040f3", "comment": "Malware payload", "value": "b16dd428639952e1561aed861952ac25e583d2ea79b49c1c6328c9fc72f506f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000304, "uuid": "592fcb29-655d-4349-8b9c-717b3755789c", "comment": "Malware payload", "value": "cc493f08f53371cd9f33b17836d9707522857bcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000304, "uuid": "a303d1bd-baf3-4b29-ac7b-e10ce66feedd", "comment": "Malware payload", "value": "c61a85402e870765a120d78a0148a0bdf90128e600bbe2bbebc2c95fa9a45542f2b9793b1b1597f7d6e308fa4986377d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000304, "uuid": "b811d55e-b310-49d0-86b9-cc5eb1a7290b", "value": "T16EB533EEF165FA32FEC6CBBAC86993396C0926D516154C530C48FA0D50A6A70707FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000304, "uuid": "df499453-4e30-472c-aa8b-2ced350032ca", "value": "49152:2/PgbRqc8UHuh2qEWvcZ+863H2asewIHhAhcxOqXHMYSLiD9I2I:2XuJuhpXEVaxw6gcxOz/LI9I2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000304, "uuid": "e5d2fa63-89b3-46f5-bbd5-1c713a91fa55", "value": 2356744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000304, "uuid": "63720615-5575-4173-8374-0bc9aaffbaac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000304, "uuid": "ca8dc47e-0d5e-4ac2-aeb3-c6cf8b43709b", "value": "vulcan_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3b8464-5ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780002021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002021, "uuid": "15b836bb-6478-4c5e-802b-b4d780558f2a", "comment": "Malware payload", "value": "b0e1c0af20356a8e313f41d1419e5458", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002021, "uuid": "ff38302a-48ae-4782-bb03-c2b221b04078", "comment": "Malware payload", "value": "b1ecf9795780e7d34ab5909bb8133011d3661150eb4cf5b1df09ec158fad7bce", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002021, "uuid": "66a3e20b-73f1-4dd9-95ef-39f625f724f4", "comment": "Malware payload", "value": "93bc4f2e6a6d90d4e06767966103900308962d2d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780002021, "uuid": "432e6c09-0988-4faf-9454-f57568d47b5e", "comment": "Malware payload", "value": "4208efe511dcc13f7a2e055dccca8ec4a1e283a788b4e905a5d4f4672f9397f19285843cfb08c7e84f3fc3596243502c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002021, "uuid": "46445e17-62c3-4956-a2dc-54d56db97a99", "value": "T15EA31641F7F94119BAB72F442AB946B9493BBFA2153DC9DDCA100D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002021, "uuid": "a0031a59-7c91-4952-80d5-0094ee652622", "value": "768:AcEYXDVZ+LtdV9vg34HFy5MrsmDoIlqnLckieO1Qwc3TpKbx0T7gSYRuMc3+ZgKG:pCsVVyzvcK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780002021, "uuid": "58691ab1-1c7f-47a7-90bc-1367ca1c6084", "value": 105538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780002021, "uuid": "5347bc90-c3a1-4f7a-aabf-10d4bfd3dcf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780002021, "uuid": "e6974f43-95f5-4e9c-b4d9-a72205a6c9f0", "value": "rrascunho_8b173ef1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc227d4-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001085, "uuid": "250d4776-2fbd-46b5-842a-5d68d6d63f44", "comment": "Malware payload (Mirai)", "value": "bfae1a47b0586f20b1c604dff94d9241", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001085, "uuid": "195c9a7b-8116-4bd7-873a-0b2df08849f6", "comment": "Malware payload (Mirai)", "value": "b29e6a75a6075fefdf6d78850cc0c5675feaaef0f08c2f0b1ca68cf7782320ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001085, "uuid": "656fc752-9af0-4bc8-8070-3d3f17a06232", "comment": "Malware payload (Mirai)", "value": "0393618830cd671ea2fea1c001bd7eb1649fd772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001085, "uuid": "cd2b820c-5f63-461d-a727-516324ac25e9", "comment": "Malware payload (Mirai)", "value": "f9d46996ed8c47a2dc93ed48630af1004f262316af1ea087ff85f4065fe593d9458556ef82f466c1446fa46d4d23d817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001085, "uuid": "9856da2c-f4a3-459b-9557-2444480fb8e1", "value": "T1DBC31B45FC505B23C6C612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001085, "uuid": "8bc27370-7224-4252-9410-866b4ef0f66c", "value": "1536:p3Ka0rG5yC/cMChygtXOBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQ8:5KaprMh7ROXWFh4UXwcFAa5xovW5kKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001085, "uuid": "209b6356-6ef5-452a-83ee-64085f46d31f", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001085, "uuid": "bccd3a87-757b-44d2-b47e-77db619f3455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001085, "uuid": "5056f8c0-2a16-41c9-ac75-f575c17da5c5", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6debff-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779970529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970529, "uuid": "a1672266-2c30-429a-a85c-93b2be8b5677", "comment": "Malware payload", "value": "f6cac6f7e131475e9feb4e25fb9accdd", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970529, "uuid": "3e840cb1-72cc-4339-9d2f-613b88761229", "comment": "Malware payload", "value": "b2c929932cccf97a6f6cb569052a55422e0de1025b62d8714b4f92f0cf7c51bf", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970529, "uuid": "a19949b8-8fc5-4f78-bf78-987cb783a9d2", "comment": "Malware payload", "value": "2886479769c8921e2b268d09b1fcac7cad7be8ad", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970529, "uuid": "2e09afb8-96bf-4a21-8614-8108ffd1b50e", "comment": "Malware payload", "value": "03f729fe4cdf566431522aef70f7283cde9ff941c83c77e5cd4a36eb4d1d882e64265cad13668549339e008064b6cbb9", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970529, "uuid": "a8574a44-2f3a-4a88-ad32-0d355beb9436", "value": "T1B05301F7A0D87DCCC14A5334450B0A473EC167B8A09A652A76C4F6A84BF2780CFD9BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970529, "uuid": "9a588a64-c447-457d-919c-380d2fbb5c73", "value": "1536:C1/S5aOdeB51F+yuXkoPgvFbFX6hTZ0f8ASABTqmLkg4azHE:CM5az1Fy0oPgdZX6hTo8ReT1LGazHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970529, "uuid": "ac4c0281-23b8-4de9-af1b-f08dc7ba3299", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970529, "uuid": "c593eca2-2281-4c53-9127-b48239401356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970529, "uuid": "0f5deab0-d888-4dbc-8fba-0a84e342ff11", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeab60e8-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970536, "uuid": "99646edc-c16b-444b-82e5-987f3414ef18", "comment": "Malware payload (Mirai)", "value": "84e307d14ff3f83695b889d357bce82b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970536, "uuid": "8f735152-3ab9-48dc-8719-633a00fa3620", "comment": "Malware payload (Mirai)", "value": "b3029f0a6211b9f3a6bbaed1f600c0394f99552d5831966794cf9951f02b4c75", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970536, "uuid": "c8a814cb-6ec0-4aae-b6ff-ef068cf85062", "comment": "Malware payload (Mirai)", "value": "0a63c9ff74c0ae53e5d1492a8c18bea5eb206153", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970536, "uuid": "cb48d323-e0e1-4ee7-af61-0dec3c892233", "comment": "Malware payload (Mirai)", "value": "d92234d6e653c319ddb89fff156bf78a570bc4ade8db4e9321dc40e23df4af8ccc17f9238e79b1c0955d9e7a93b06466", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970536, "uuid": "768ab5bd-2d30-4d72-8712-e5bd54d60e99", "value": "T16151919B0280DB32D65CC54EB7F0F534B50AA08367DF9E48ED801A2C8EC9D4C7685F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970536, "uuid": "50a9390b-eb18-4596-b3cd-83890627f57c", "value": "48:q/OjOj2JMIAyAbiB8snsuZU/U/cvyyX2dndbwLquk+32NaeOehM3IZL:Ja2JMJPbiBxsuZBdbwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970536, "uuid": "ff5a5a83-8d50-48d4-b9cd-c61f8a07642a", "value": 2881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970536, "uuid": "2ed472ff-1498-4a76-b204-42d85a12d9a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970536, "uuid": "c2201001-afa1-4ee0-9191-f52436875ca0", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc75655-5a94-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779972812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972812, "uuid": "2135a0ce-ac73-4deb-b88a-c56993378868", "comment": "Malware payload (ValleyRAT)", "value": "bd3cc2fda2402a1fd6bcfe3eaa390070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972812, "uuid": "c0e4f654-d146-4e8b-b371-bf79e2559ac4", "comment": "Malware payload (ValleyRAT)", "value": "b37efcbc178c9f8d2c4059e55311279a435ff5cd9b00840ec17ef0f7110b106c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972812, "uuid": "6b654541-ffc2-4364-a0de-211a624bad2e", "comment": "Malware payload (ValleyRAT)", "value": "0039c8b4be978344b498b12666eadd7983951001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972812, "uuid": "b99b6410-4362-4b15-a70a-742487576755", "comment": "Malware payload (ValleyRAT)", "value": "cbdcabc5f5faad1ecb980c8afda862df64e74590d3ce83dab3e9bb5dafbba5fef620a45b961f78ece593772aaaf5063d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972812, "uuid": "1b0f7ca6-6608-4ed6-b1b1-6ad8ad9d83f3", "value": "T11443D73B53E98054F2AB92B56E7A616618BFF47C50B4B10E0321CD2D2F22E791ED436D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972812, "uuid": "02f462f3-8d7d-4d0a-812d-ae864340fb53", "value": "a66ac84db6116999f6cded522d9f3b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972812, "uuid": "47b5afe3-e177-4ae0-aa62-d9aa628abddb", "value": "1536:ggHuyRAgH07o6Rd/MeDYDbm/pZ+7cI6Fi:DR7U7ogcUZ+7cIii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972812, "uuid": "ad284dd7-edf3-4be0-9819-c42ce8c9ab24", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972812, "uuid": "bcbec947-950e-4de6-8b65-2fd94f04a24a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972812, "uuid": "d5722c2a-7c84-4f27-a3c2-f888ba4ca75c", "value": "2026.06.28\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4fb81a-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779961938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961938, "uuid": "2b47c2fb-bdd2-4919-8ea6-bfe6a3d1b37b", "comment": "Malware payload (AgentTesla)", "value": "e368a0865b02f07e7f0eb290d5717752", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961938, "uuid": "844f8d73-dbee-405e-ab7b-73b7bb776834", "comment": "Malware payload (AgentTesla)", "value": "b38f36f835827081eaf08000bfaea943c3b86770df2ee7d225c54e6ac4c121f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961938, "uuid": "74472982-0257-468e-a80b-e36c4e821c33", "comment": "Malware payload (AgentTesla)", "value": "e8f5e8319027c92bca1ea339609628097f3ca3f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961938, "uuid": "ff58281a-e308-413c-9507-96633010cac0", "comment": "Malware payload (AgentTesla)", "value": "423034667cec544f3b1899bb055cdff21b047bd5137d63ea3de439e926ee81fe74288584757adff81203001a3c7e9294", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961938, "uuid": "eb1930d2-9c3d-4f10-88ad-2af77a40f284", "value": "T17CE57C0094B0F248C8C2DB268517B3F4759F290BBE784961A21EDAB15F47FD7D092A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961938, "uuid": "eae3c03e-6b82-48ee-93a3-367ef6e6222b", "value": "49152:Sq0JnzrVz77CEbwfSGFKjgGFO9f+ctaRLyRCN:SqUzrVv7CEbwfSGFKjrFO9f+cALyRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961938, "uuid": "55cdc73f-afcd-4d3f-ac3e-d48c6525a403", "value": 3210539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961938, "uuid": "a7714a70-b9e0-4e1a-aa85-0eb435764943", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961938, "uuid": "1bca317e-5bc8-4fc7-a4f7-cdd21c844e73", "value": "ADS1K5-1_Mechanical_Manufcaturing_Drawings_Rev2-180526.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976f670e-5aed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780011191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011191, "uuid": "d6349657-00ce-41f5-a6d6-ca7a9ec9a117", "comment": "Malware payload", "value": "b601ca8a198c8971c069052d588aac4f", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011191, "uuid": "e08edfea-714e-4074-a690-82e320484690", "comment": "Malware payload", "value": "b39688635bb5b2a90bb9101b372080b61d6ba78f2cd78ee275a983a84e2a047d", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011191, "uuid": "ff496876-b2ea-4afe-aba1-3f1855031115", "comment": "Malware payload", "value": "4c58327fb51bf9afc6ea9e910e92b81fef86e40c", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011191, "uuid": "4bb77166-a8a4-42bb-a092-2c76f7dbfb66", "comment": "Malware payload", "value": "6c90657cc36a855151490792f6692e72be45698619228662e02737ca535681c797fb7b86d39c07211e8649893d9e30aa", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011191, "uuid": "bd4cd13a-b7c6-4464-99ee-b0e4373d1c7d", "value": "T12F167C4A7CE149EAC0AA633288B722867B71BC550F3263D72E50B7783FB26E45D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011191, "uuid": "ef96ba78-745b-4a82-9d57-c766bee6f010", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011191, "uuid": "56f806f8-deb9-4b23-9a75-704ef8516bd4", "value": "24576:lj4SUw4RXMmAezRybIYrrwoQKo4ajMxfO0CXak1fnBele5yK2tFmA2b:ljzUXRHAezkEDJMkVOXkAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780011191, "uuid": "114fc6ad-083e-4aa4-8113-d55253b064da", "value": 4382848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780011191, "uuid": "5600dcd9-14f0-4ddc-a9a0-71cb6496c082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011191, "uuid": "95763a50-856f-4718-941a-aa24c7009ebb", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deabe74-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969031, "uuid": "b8b01df8-fee8-497d-aab6-f37031dc125b", "comment": "Malware payload (Mirai)", "value": "a9cc710df7a79acff4b551b68ceb45db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969031, "uuid": "e8099c84-cddc-4570-9650-5444dae2c2dc", "comment": "Malware payload (Mirai)", "value": "b41b3750c9d29e59c3a0b3249d1826773ece1a8dff488153a312a8fe7391e0a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969031, "uuid": "3a6505bb-ecbb-4be7-b5e0-3fef55c8e494", "comment": "Malware payload (Mirai)", "value": "fbc3362187cb58c9327ebc31767ad7c7c927d2a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969031, "uuid": "7457bdd0-68b6-4e79-bceb-f91640d9a561", "comment": "Malware payload (Mirai)", "value": "53542676eb7a2304aecf119482f2b375c1b9b78a0fb123e27adcfb05009e5f230900dfe653f4182e95bcc5874c74f0a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969031, "uuid": "836d5c68-b83f-4c5e-988a-1ffde6f6b11f", "value": "T15621358AB0847D54DF28D73C4DB15A437F05D965C50FF3CE4E0D56B9192F28C66940D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969031, "uuid": "384a421e-a783-4e1b-9189-61cb601bb1ef", "value": "24:w5olnAwdGtSnUpzzbBWpzmI89oKBB5gDrmOvC/likC7m17IG3rNfi:w5olnPdxnUpzzbBWpzmI89oNDrmOvC/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969031, "uuid": "9b26287f-3d3b-46f0-b34e-7b3f14b40096", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969031, "uuid": "37ab674b-7b70-4b1a-a254-3ea0ed5517f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969031, "uuid": "ebabf0c1-0433-4070-82d6-2ed57ffc5500", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aee8d93-5a31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779930371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930371, "uuid": "45f3ea6d-9fd7-4f07-9c61-12d7b586bc15", "comment": "Malware payload (Mirai)", "value": "b9c296bec2401a2ea7ba386301289b18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930371, "uuid": "724bb9c3-9d3c-4fc4-88c5-203e33b6bcd4", "comment": "Malware payload (Mirai)", "value": "b42ebdb7847c218c1ae7d7d82f4c882d45070a97b5735efe7c7837c1630f60cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930371, "uuid": "71be9b2a-ea30-4c79-a4f9-e30e3efa403d", "comment": "Malware payload (Mirai)", "value": "378ba2268bc826b5c12aa9e683be17f7f8ef5d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930371, "uuid": "9bd4c25d-1393-45ad-9574-3e5ec5a9b159", "comment": "Malware payload (Mirai)", "value": "69bf110225e961233b2c9c5ad9cface9fff8f24a2abfd5c0b12f1237fffbe088681f6f29d01a75a5eba643b6a0ac426b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930371, "uuid": "028f1437-b573-4140-b412-30a289a162ab", "value": "T18BD37C33D8296F58D225C5B4B0748F742F43D1A582436FBA69B6C2B04487D8DF619BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930371, "uuid": "26c1e91f-bcb5-4ef3-839c-957709f36bc6", "value": "3072:Pz+CAGcAmOe2kCuV93w5YW+1Km76hh1Xa:Pz+C/W2kCq9SB+8m2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930371, "uuid": "72c4da52-c32e-47f4-a999-04241b828e73", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930371, "uuid": "180cee04-9678-4043-a056-8c25ed10b38f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930371, "uuid": "c0d143e3-ff89-4718-9586-3c1a221c19bf", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb50908-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779961941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961941, "uuid": "30d477ec-aeb6-4169-9404-24d92f70facf", "comment": "Malware payload", "value": "2f572e644ed134aa6597c10f2adce9b4", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961941, "uuid": "0306e05f-a659-4a53-8e59-e945bcbb87ec", "comment": "Malware payload", "value": "b447c0ac73f159d2fa5f955cd9fb67e19bc9dc9753ae54a09287cb26f4e9be67", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961941, "uuid": "325f80ba-c0ed-455f-b102-78a528cb4710", "comment": "Malware payload", "value": "a41460c234a0f07aacd45090726fc1a4b16a7000", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961941, "uuid": "f6b43140-2f60-4485-b51e-62de3b2d7707", "comment": "Malware payload", "value": "c56d963332e289a4151c399f8192ce1fb44466b80bf7cc8854a172dc7d3579e54e36c33943191f0c2fe47bae20490310", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961941, "uuid": "b9f55ea7-f5a2-48b3-acf7-f9e435e7c013", "value": "T12A1373DE76CAFAB5434134A71FA7A396F23D8CC5B4488188FBE4E49EB454718D039638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961941, "uuid": "89567e0c-a672-4703-9168-66c1bd1ab0a0", "value": "768:RPjeoL4BxIAl2HWEvMAx8BIHi45zgAe8T3l2YXcmQA2AWdcVqu8YwZyZ5Q:RPVWxDEHDv1eI18AeK30YsmQA27dcVqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961941, "uuid": "2ecb0009-9385-4fc4-861d-8e5412a4a7c8", "value": 45290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961941, "uuid": "42111393-da20-47a9-b60f-9a8d85cd1aff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961941, "uuid": "d4100215-cf56-4dcf-b534-04a5fb4a3461", "value": "EMA_3910Swift_MAU920AHI87DH74781A_KOU8N7492273_A6468B8DN98_D8BAYIIAI76TAIU682.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8779f421-5aec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010735, "uuid": "4118144b-9035-4eb1-b1ae-c89a74c89310", "comment": "Malware payload", "value": "2a7a6e5c0e058381173f9e9fb1628349", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010735, "uuid": "59e0c4de-1825-4577-962b-b86af826a199", "comment": "Malware payload", "value": "b507a520aa71494c3ef280ea994dfc7f028e14ef08c9d844d2deb8ebd4e007a0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010735, "uuid": "3ea77c14-0077-463a-a76a-991fcd5e6dbe", "comment": "Malware payload", "value": "70ef983b057d1597ae9e182248810fb410fcb4da", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010735, "uuid": "9c111f11-56ba-480b-b96d-fda79b13bf00", "comment": "Malware payload", "value": "8ea0b2d41d0f16dd27b9a57043579507e57c39a61c77d48149ab9e56fb82c1ef2aea8dc43e6f1e561856072201eb07f2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010735, "uuid": "ed6ae68e-ab40-4761-b5a9-037446194f05", "value": "T16717336168BD3920F4DD8FFD254539DE82A72DA77A2A15C6BC63A630FD833A17CD0940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010735, "uuid": "a7bccda8-9698-4438-b60b-aad4f5462cbc", "value": "393216:VWUs68Y1PVj482ftfRjK21junNKVk7Huj+QO+JDtesYifgd53H:VWE8Y1PV482lZj/1j8NKVkLuj+QO+9tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010735, "uuid": "5c6bd293-aa61-478c-b0c3-56d3566d781f", "value": 20102991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010735, "uuid": "70a0c39e-7738-4014-ba95-e3274fae8519", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010735, "uuid": "98e036e7-fc4d-4370-bec7-dfc28e621a50", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fe6501-5a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779976942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976942, "uuid": "9b839d3d-f65f-403b-a3b6-7760a7ca5ca5", "comment": "Malware payload", "value": "3b327563bfc2278f087db15730456d9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976942, "uuid": "9c4a87d5-89c5-476c-af1a-3dfcadc8abb1", "comment": "Malware payload", "value": "b55fecd4dbb0317af676d56cde33847084bf76190dd275164b160160a0d72147", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976942, "uuid": "9968b463-afe2-4b0a-a8e4-96ff3096ad0e", "comment": "Malware payload", "value": "472bee95b1ef7907fb191c9dd499446c3d390235", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976942, "uuid": "39e4ee6f-3004-4abc-be37-bfd68eccfea5", "comment": "Malware payload", "value": "e6b745ad24aee29c42e943de1684a515becf0c21342eefbfbdf0974194e199b933400c78139651660e9892f7fcd95c31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976942, "uuid": "a1eb2ed2-287b-4871-b7be-12ea212bee25", "value": "T1BEE6375303851BBDF69D0EC9C94B215B20F2D4677D251298EBB36EEBBC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976942, "uuid": "8aebf673-a10c-4d4c-a4ca-25f45024a42b", "value": "1536:Gwc3p4nU1T/h7kB2nAlSxH9krADujeoXmL89jjMA7V7mr3w+fav2VkcsHKlrAIRD:Gwc3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779976942, "uuid": "a85f27c2-5ff6-4ddb-95ab-5918cc4cf348", "value": 15241782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779976942, "uuid": "afc097d1-00bc-4774-88db-60fb957c6272", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976942, "uuid": "885be6ef-254e-46ee-99d4-087c3ab83249", "value": "INV1321462.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af32543-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "240077c5-8007-42f7-90eb-3d4fdc8bcbe5", "comment": "Malware payload (Mirai)", "value": "437e47a9af94c7b80f8c963edc92cc5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "21193d30-2d75-4ecd-a52e-eef7c24ce87b", "comment": "Malware payload (Mirai)", "value": "b6aa895acff5b7d7ffa5c0295c3a677d4b1e36a4bc78c33ab360f67efb1691ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "20ad65ed-f48b-4222-8251-7361d5899c94", "comment": "Malware payload (Mirai)", "value": "5801c1b02a9e33d2de2fc51557314c1eef7a23da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969026, "uuid": "b15613c6-406f-4e9d-adc5-e071a25d9bd5", "comment": "Malware payload (Mirai)", "value": "849dd31e532d1ab8284a26d571113f47d4ce3827f170a41f6e7cb06cb498d5e5d16b7eed53ad4537d9af5a68ce289333", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969026, "uuid": "3fdcb9db-fe51-4182-866f-c76cd8532200", "value": "T1E121EF76A1D8FC33CA6202F65181AF8A27558AA5546AFF0BCEA15802EC396D1D133364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969026, "uuid": "be55f9d1-edb4-4d70-8c36-31bbb0374188", "value": "24:FlhPMAqGFHxgxCl6ZSiSZSLRQ0fG4wcrGuWpDruQPo8vbNfTo:fhPxqM5sSi0SLRQ0bwcrSpfHPo8vbNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969026, "uuid": "bd9c9192-9129-41bd-9d29-231f262198fd", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969026, "uuid": "f241bb70-2e07-43b3-9db8-9ecb83502e19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969026, "uuid": "0f8aa5fd-4a44-4432-a692-ed3628fe97a9", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f881a0-5a9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779977232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977232, "uuid": "09eb5245-1664-4c17-8362-b7fb379d7710", "comment": "Malware payload (Mirai)", "value": "bd85e29a3ca6173a0316adb08d59a753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977232, "uuid": "97b7f47d-4589-471e-943c-6e98a4cb015d", "comment": "Malware payload (Mirai)", "value": "b6d1c3eb67265034d1b96d9d52a87368ae1a606501f696f07e064c576a7e6abd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977232, "uuid": "f902f593-16c3-4189-afe8-e931a70cae8c", "comment": "Malware payload (Mirai)", "value": "aea738291e5190f5e54e089e30bcea60b2f1364a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779977232, "uuid": "2f448a9e-8d6e-421a-bf62-955e7a6b54ae", "comment": "Malware payload (Mirai)", "value": "aae40f551addc6a4f4c58f918295b582a1728258c6845372b248ed5a654a41a2e7219c4710b31f25e21d13646066656e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977232, "uuid": "2889aab0-5512-40af-898d-076886b4a690", "value": "T15AE63757EC66019CE4BD8531C9B682727B713C495B3163E31BA4B6286F72BD06BB93C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977232, "uuid": "03436df5-a835-4419-a168-8f0aa3c597bb", "value": "98304:sTMuPnUrHFcqANoDnfNQbCehR++91nz+SGLTaBhtZnVEt:s5vUJS6gR++91nz+SGL6/mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779977232, "uuid": "b0ee0d7b-92e3-4d78-b9d7-412760d6be6c", "value": 14250286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779977232, "uuid": "47fec231-7b3f-474d-b95b-6102bcd3ad52", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779977232, "uuid": "4b277e35-a4a0-41dc-a1ba-4b6ddb1eef04", "value": "wife-bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51489aa6-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779949656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949656, "uuid": "376a3481-c2a7-4700-821c-a21dba6ffd67", "comment": "Malware payload", "value": "4cc4be9d19f04161f8fabe8d17cf5dab", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949656, "uuid": "2c139ad9-a8bf-40b9-a200-6d7deacbfa8f", "comment": "Malware payload", "value": "b6fbf89972040c9ce1e4b0fa7756c42077e74949dc9079facfb2ac537aecced0", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949656, "uuid": "05ae20e8-68fc-47ee-9a59-b6cd21a90278", "comment": "Malware payload", "value": "07f7fd4ce6185f1df5a25796f97c79e57bb3018d", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949656, "uuid": "520f4901-a8bc-40c8-b609-43026f77298e", "comment": "Malware payload", "value": "d5278bc38f2501e44dc38b9736124995f1287d9976f8efcaf04d2462522f3a09c71f7fb3750477ded65bbcb4b36cc73f", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949656, "uuid": "429b4c7c-a76a-4c54-a4e3-64d69f086ce2", "value": "T18EC4F05DA97E58DA92630CA41FB14050529B280D57DC447F3A803EADEE09F2BBFCB139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949656, "uuid": "2de71f26-ea6f-4937-85ed-870ae361428b", "value": "12288:aktl/NXlQBkUK1DvgdEegWd8w1iOELN4zQC5Ip/F35+mc4tGJF:xx6k71D4qEL1i1L+p+o+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949656, "uuid": "9ecfe133-8121-49b2-918f-1f83728ce43c", "value": 574478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949656, "uuid": "88c03cfa-902a-4e91-8744-9f1a68118ac1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949656, "uuid": "f2b83d3f-5b1c-461a-952f-3cf5daf2edf3", "value": "RFQ#WA2617-3063_2026.04.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29151feb-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970634, "uuid": "d2eb3a2e-e111-4c1f-a6d3-dd61c9ee25ef", "comment": "Malware payload (Mirai)", "value": "898cda73cb7b4efa3fc36eb61512d4a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970634, "uuid": "8e10fce0-7a91-42d7-8e6c-c9a6c7ec4b11", "comment": "Malware payload (Mirai)", "value": "b7f38a22cd9c514052e83a8f07a0b12a1c2a38f63b833566dc95317241b1d259", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970634, "uuid": "3a727150-c38f-41aa-8c11-e45dd6d0a506", "comment": "Malware payload (Mirai)", "value": "e0cc9a1118332af0cfb7cdb04ffb909449065def", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970634, "uuid": "29ec5d89-9697-410c-84a0-6b8a693e3a94", "comment": "Malware payload (Mirai)", "value": "abce574ba3e90acb94b5de05921d55846dea7e30aa268cebbfc3b3956796797e65980740420010e051a8990f0bcc195a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970634, "uuid": "d6d3e16b-05a1-483f-bb73-75d7b538eb69", "value": "T1C9A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970634, "uuid": "f0ca78f2-e463-444d-8c29-2bab89fe298a", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0otj:bbbmPTO930bkbRl886tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970634, "uuid": "5c0385af-fbe9-4edb-aab7-66cc21799d24", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970634, "uuid": "58e523e8-e50d-4b85-a957-ef57e8a85ad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970634, "uuid": "577d8af0-3425-403f-ad29-ea00e4e4100d", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713d13be-5a30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779929952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929952, "uuid": "dbd54eef-25a2-466f-afc8-ed70a9359209", "comment": "Malware payload (Mirai)", "value": "ebfc2281c271192c5c1d4ff53b11689d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929952, "uuid": "519d40ad-94ee-44a6-b993-a032377fd0bc", "comment": "Malware payload (Mirai)", "value": "b822856e0d7fef05bc85c6776319ea57faf73d2781afab15ce78b9c7ca4182a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929952, "uuid": "a0ed1213-f160-40d6-886f-ee4b7567d994", "comment": "Malware payload (Mirai)", "value": "223e2b3cd3002a1a3f13fe9b0df43b696d2a5446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779929952, "uuid": "3b9dfa70-8496-4b1c-ba2c-de61569a3236", "comment": "Malware payload (Mirai)", "value": "6cb8ac9f48ec201b474204e5d02d3d82cedef26f269346f94b91734a5cbef85a07ae064e1c1f67cac2b88c2b8221aa04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929952, "uuid": "a8446c27-3b1e-4e48-b652-df92d0ff0807", "value": "T1A6C30649FD416F11D9D635FAFA0E024933531BBCE3FE7102AA255B2523CAA5B0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929952, "uuid": "4e7bbbb4-5772-4187-bb99-388653cf6201", "value": "3072:yRvro3j2FkcU+HHQSaEXg39YkqDlPseczeM82KXB:ymXcUwwSaEw39Ykq57cyM82KXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779929952, "uuid": "8c26ae12-9f0a-4c5d-a1ad-5a407a1229b3", "value": 124644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779929952, "uuid": "728029c5-d59d-4371-bc78-f3b28aed7380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779929952, "uuid": "8e48782a-5e51-4e4e-94fc-1f2df521b9bb", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af18962-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969939, "uuid": "b66125e9-a546-4a4f-b481-7865f46f8cda", "comment": "Malware payload (Mirai)", "value": "d44aa200bf0bd5d3faf2a4d79eb2d365", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969939, "uuid": "13700e58-264b-4e3e-bc83-2f289e04efbf", "comment": "Malware payload (Mirai)", "value": "b89aa837311d320d35ed0e9e3bebd2be4f0604037b82675495f59326987f7719", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969939, "uuid": "be60c872-98db-4c0d-9dde-d524101a5a87", "comment": "Malware payload (Mirai)", "value": "00fbedafaeddad35df359ec780d695c66345464f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969939, "uuid": "204b9d37-811d-4ed3-84df-4552b076f171", "comment": "Malware payload (Mirai)", "value": "c6e66c847cabb532f952a4578fe3cfc59a5674b354c4964c2e923dc8d33da56041f98475eb67a6ac0185d2d4bf237e3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969939, "uuid": "c6f8e0ce-94ce-4451-8c27-5f31b43e598b", "value": "T1589308CABC858B10D5D526B6FE0E218D33538B78E3FA7113DE185B2E578AC6B0A37511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969939, "uuid": "ac58fa90-fdb9-4d1f-9c37-c1c4ebde2979", "value": "1536:BTnT3ecRA3MycTnkqZYlezEnto5wAn0sietke4Uesb1XouQz2lKGiRqN4d:VecRA8yQkqZYlUEnto5wA0+ae4Uesb1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969939, "uuid": "0ed4864d-e132-4332-babf-6701c60ed062", "value": 89840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969939, "uuid": "172b488c-26c4-46df-8eb6-42cedda859a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969939, "uuid": "5a6fdd78-5976-406b-ab46-b5a12bf7f13f", "value": "z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ac82ed-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973609, "uuid": "1c39a34e-9496-4a52-8e12-89feb5b38edf", "comment": "Malware payload", "value": "dc3e75a4b5ece7feebec41e958396e9a", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "UNC5669", "colour": "#B6AB98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973609, "uuid": "99c570c0-eeac-4e3e-a21f-35f49670d64a", "comment": "Malware payload", "value": "b8d3a74c5088a357ef6b3e235685dcd750732d7dbdf4e4684a92a566f2be555b", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "UNC5669", "colour": "#B6AB98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973609, "uuid": "ecce00e5-465f-449f-9ec3-24602793c755", "comment": "Malware payload", "value": "f8a936063ba13fabbf2a4c00667d7704d957e802", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "UNC5669", "colour": "#B6AB98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973609, "uuid": "c669b507-c560-4a4d-92a7-b3cc0da31f3b", "comment": "Malware payload", "value": "da821cb8df6bdcb37c5bd226c3e73f4a83d3769db6f944ee470371c24a2edd727b9d7664ecbb17169745a08fa315d3a6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "UNC5669", "colour": "#B6AB98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973609, "uuid": "7a196f44-b0e3-4cbd-a75d-bdea2144ad3c", "value": "T15CA3F155BBDDB5A9FD07F4301290D78B6C8C93748406920B23E16D872D90CB98F9BADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973609, "uuid": "8b5358c2-a249-4d88-a384-08a115e3943b", "value": "1536:/Sc+87fiwTxF69GYAzx76GJHiuHe6pI7gm2pGi4ikIeE0WE05bOBuok/Gk+F0m32:rhfiwTxF60x77FV0i4aec5/G10F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973609, "uuid": "171d8dff-52d7-4f47-bf31-2aec77175e6a", "value": 98328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973609, "uuid": "f7dc22d8-3bb1-49f7-be30-8dc643f09c84", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973609, "uuid": "097df31a-56e2-4e5c-a296-ed383abe6816", "value": "b8d3a74c5088a357ef6b3e235685dcd750732d7dbdf4e4684a92a566f2be555b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9736799-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970419, "uuid": "191187f0-22b5-4041-9814-7854d4af85c5", "comment": "Malware payload (Mirai)", "value": "325665649a89dedb684b93ad6390738d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970419, "uuid": "5e8a4d9a-cf8c-4b36-96b9-108014b1ee4f", "comment": "Malware payload (Mirai)", "value": "b8e64678f0207c2b8e5858016d8807ef04009b3ef9bc2bf1e1b8898d70f9a8b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970419, "uuid": "d2394a73-1ed5-46f7-ad38-d80c2c6f8b88", "comment": "Malware payload (Mirai)", "value": "84f3315358ecf0ef972eadb5bb873a2172a9525f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970419, "uuid": "96040e92-e6be-4652-ab21-2a189241f7e3", "comment": "Malware payload (Mirai)", "value": "9c336da932b22ca4766319f06d81bf87a365b8952f4570bc52fda5405260e6c7cb05ee0971ba355affb2105abc09fdcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970419, "uuid": "73fc28f4-a014-49e1-be49-f52708d65172", "value": "T14F931986BCC1C612C5E1A1B2FB1F91CD371643A8E3E67107DD19AF29674B8A70E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970419, "uuid": "62a11028-01ea-4fa9-9461-1eafd45bc2b1", "value": "1536:X+0hMsdERtCvjvq9BLABeuTGrVtLKWkFUGK7QxKbtvPV:X+0rmtqjSbxuTAVtrGK0K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970419, "uuid": "fbb0eac1-47b2-4a9a-aa62-89bda833ca20", "value": 96036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970419, "uuid": "778c15ca-0124-4b06-b7a6-34c2f85a504f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970419, "uuid": "fa3750e0-68e5-4ecc-823f-7f0db547f15f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da89cfa4-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970931, "uuid": "64141e5f-a36b-4d44-b788-a76907137bd2", "comment": "Malware payload (Mirai)", "value": "9cca98abd9a9d05970386bed20b7c2fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970931, "uuid": "c96c42c2-6b32-43ea-8c0d-b7a651d7a02d", "comment": "Malware payload (Mirai)", "value": "b8e8f888cfb14562656f24612a5ba9bb88af5e3e6d89ab85c2186d5f250eb351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970931, "uuid": "bb027e25-e926-4d05-b5e3-9103680c9054", "comment": "Malware payload (Mirai)", "value": "b65e826eb34905f62d298f37c1c137960e822bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970931, "uuid": "cbf2f2ff-0740-491d-83cb-06662acfa9d8", "comment": "Malware payload (Mirai)", "value": "62965fa8726d997b057097c88d3b8851f92fe043010443d1b31106c8b64c97432f18bbb9f10f346c06328b20975ce965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970931, "uuid": "891651aa-3e38-41cc-8b45-a7538291bcc3", "value": "T17FA33A11FC75183BC5C0723B51E34631F5B643A9267C9A5E7EA31D5CEF18720322BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970931, "uuid": "f2696a50-e953-4081-97e7-bc131e478381", "value": "1536:dLwSC8VPfpLGrDQMn+sCebInXgZA+mzTRf47O0NW56ApMPbi:hwIrLGrSwNlF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970931, "uuid": "5f49218e-2b3d-4b4e-9b1d-3bcb38ff52ca", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970931, "uuid": "6b96d529-d757-43bc-9bd3-64556eac9484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970931, "uuid": "cd02f469-86a5-4650-add4-d78502d4a30c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4faf2c-5a9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779976810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976810, "uuid": "8b56f6a4-a04e-44c3-b41c-1f22d62f33eb", "comment": "Malware payload", "value": "fe5cdb5f25b762b1207ec7e2d01902a3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976810, "uuid": "593ab11a-31fe-44d2-a979-bb6e6ea670b3", "comment": "Malware payload", "value": "b93d499d8ab30cd8dd0ea25dcc47f4dc457f2a980d91d9a5622808ceec69e914", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976810, "uuid": "2a1865b9-ff5e-4a19-8432-f0ca12ac2c1c", "comment": "Malware payload", "value": "17c20fdaeca27b48b7438b7d5fe58eb62960e3f3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779976810, "uuid": "28772167-bc58-4acb-bbfd-aa072f7665e2", "comment": "Malware payload", "value": "2575a634208a842255a0f48995ee8b2d21b432d93e93977865be5278f2d38388a12e2033cda30a2cbd07d18185207f8b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976810, "uuid": "cd01b7f3-61b7-4011-af3a-bd227f8c22ab", "value": "T16CA30441F7F94119BEB72F442AB946B8497ABFA2153DC9DDCA100D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976810, "uuid": "4915f26c-3c00-4b3d-a456-d8c42bc96b89", "value": "768:n4btW1LryW5Mv0qr5mLR12ZvUaRzykSSbDircDrau+Ozj69OcZN1IoF6PXoId0eS:VzqVVjHl2t60gaHqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779976810, "uuid": "75511cae-efb6-4873-b35a-346159414c39", "value": 105758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779976810, "uuid": "f952d738-8252-4706-87f0-8834a7ac64ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779976810, "uuid": "04eb5cfe-746d-4a1f-9a3c-1c3d324d0df3", "value": "rimportante_318be068.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802021a6-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972498, "uuid": "9a5cd464-39e5-4e24-9eb4-fa7fde1863fb", "comment": "Malware payload (Mirai)", "value": "1663a0292f0af695f484ee9e801bcc66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972498, "uuid": "b50833c4-8ff8-4490-ae1c-761230f13181", "comment": "Malware payload (Mirai)", "value": "b9443be76c3cf2fcd18f556b831b9ea088408475b1bfdd66aa6e767d4a44fd67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972498, "uuid": "b67e2a05-f05e-42eb-ace1-9bf92ffa47c6", "comment": "Malware payload (Mirai)", "value": "e70b79fab5c848f7f321e01552514604c5cdcc10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972498, "uuid": "00d67ccf-42d7-491a-bc9f-06e470106f57", "comment": "Malware payload (Mirai)", "value": "a3aef7931a38c0d0e72345299289e24f980d0247138db7d3608925820f5dde2e7a5256880dadb5b5d2df69fa65286366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972498, "uuid": "c3fffd05-2376-4f19-b92b-218c204a9263", "value": "T18A932A86BCC1C712C5E1A1B6FB1FA1CD371643A8D3E67213DD18AB29674B8670E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972498, "uuid": "d0dc971b-5722-4176-a84a-fe7fd83a8a6d", "value": "1536:M3de4Z1B216D9ByruTdpTrvV5ptcg8G57BlmUb+aT:M3dzz2gRhRlrvPptPBEUbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972498, "uuid": "8f95cbd7-f8a8-4534-9884-0b0d76b6a6cf", "value": 93324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972498, "uuid": "7393c80b-b42e-4f27-9871-46818804f9f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972498, "uuid": "923af93e-8d7c-442a-b3cf-628624416f8a", "value": "SecuriteInfo.com.Linux.Mirai.9853.14124.6611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682cfe15-5ad2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779999516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999516, "uuid": "d9e9d0a1-0556-48c2-96a6-5195c2c38b98", "comment": "Malware payload", "value": "ddb2d878d67754249ca5f5bb0b423f1a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999516, "uuid": "87bb84c2-e63c-4a58-889b-bd2d54556cf6", "comment": "Malware payload", "value": "b9702ecf2928354dfc32e25468848408de40b82d237f83953fdc6d6d655050ef", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999516, "uuid": "c3dc9662-072f-483c-b12c-ac2808dc4c72", "comment": "Malware payload", "value": "4b25b9d5919a3077375e67245681af5ea1d96cef", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779999516, "uuid": "56aa2493-9ae6-42c6-aeaf-0c35558d42a3", "comment": "Malware payload", "value": "0662d802b0931d4159c413768a3f3b87d92f33a55494e06a6d2fb3e8409dec08d915a8ab03b49eefd28b1118c41b7d2c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779999516, "uuid": "1cfe7618-defa-42a9-912a-81169ba08dd8", "value": "T1165175138371123191E1130245CFB144625581BF8A4E1E2975AE9200BFA663CEBF33FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779999516, "uuid": "adf236b7-de2c-4ec3-9350-c7d5ac700ee1", "value": "48:6DiE1I6wzJ5M6A77BtWkqZLME5W6N3fEsbW6ofu2nxtk9EST1zNzWQq91mr9m1oB:6qTM5qMSWe3j6Ff/xe9TT1091mM1oAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779999516, "uuid": "092e4836-a69d-49fd-bec5-cf69564e531d", "value": 2588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779999516, "uuid": "dd267f17-9c4a-42a7-a1ae-75ffc030c64f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779999516, "uuid": "6ef9e5ed-cc7a-436d-8ca7-709bfe76c443", "value": "install.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a56c2d-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969557, "uuid": "5031ae97-e376-4f7a-b065-e43901347607", "comment": "Malware payload (Mirai)", "value": "5136ec36adc95fa3d923c31fdd8f95bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969557, "uuid": "b953b617-b1a3-4c85-aa1a-92ae4990b7de", "comment": "Malware payload (Mirai)", "value": "b9830ed875981ad76717c51d58a61e4770cf6e259a6dcf6b2a05e71418113303", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969557, "uuid": "9443d7ad-c808-435e-aff5-402b0842e67d", "comment": "Malware payload (Mirai)", "value": "d393f7f455ee127f6cfdb7e65d77a00c9cbde77b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969557, "uuid": "bddbf7c2-3529-4933-ac51-540c29589737", "comment": "Malware payload (Mirai)", "value": "63f5b09c47815b461b8aa64db8e32734df0442041dee352e819110a10874b9c23d351ce93a3dfc680d0f1beca614559c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969557, "uuid": "96c9907f-5d48-4b6e-834e-56082d557d03", "value": "T1F393080AAFB21FBBE4ABDE3305A50709399D550621B47B3A7574DC1CF60B28B46D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969557, "uuid": "9edd7ca9-5ea9-4ddf-be53-ae4ee5823129", "value": "1536:wsfutY0BNxAt9b4puKkRyD0cxG5Q61ojgdbb8/ri5fMoO95aqyhAexWvYkOoGQSC:wsUnkRyD0bIBcQeE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969557, "uuid": "5c5f17ef-21a4-41e2-95d6-09bc83d717a0", "value": 89124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969557, "uuid": "0b788fcd-36a6-433b-a082-3298d1e3115a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969557, "uuid": "8eac68e2-71b0-4038-9583-a61c3a8b3b2f", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dbf365-5ac7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779994808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994808, "uuid": "5bc815f8-017c-4d40-9832-388f17adf813", "comment": "Malware payload", "value": "625b61f5c1dd618a28733e43f9c1f60b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994808, "uuid": "3109991f-ce8f-4896-a9d0-0578c882efff", "comment": "Malware payload", "value": "b9d01982379de9dc83745fcaaa5d4e4f8e9fa352a9a1e71644fe7e0dd38ca655", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994808, "uuid": "149b1ec9-7830-4ef9-b512-f6922576fa2f", "comment": "Malware payload", "value": "320956eda0fe0295c5217c56557430260b73f519", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994808, "uuid": "311ce228-9de2-4081-8c5b-31a5d4f23468", "comment": "Malware payload", "value": "a8ce298d50310be4131f9c7184faec2ff60361d7dfa90e3f7e8b6b9f1c35e9df6c10549a1f25fdccd01b484088c859f9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994808, "uuid": "55eaf46d-7731-4d38-acf2-2fcbae03705e", "value": "T195A31741F7E94119BEB72F442AB946B8493BBFA2153DC9DDCA500D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994808, "uuid": "87bcb7b2-f2a6-4c49-b451-94872249c71d", "value": "768:HX91orcJj7R+o88s3fNEUIty1J8m0x6R+K/8RNfsDAAt2l3uade1+uNKpZodA0dw:w3VbTHblYwq/dJiyhuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779994808, "uuid": "caa91169-d1f1-431d-9c25-1c5d3141f6fc", "value": 105654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779994808, "uuid": "932ed0d1-30a1-4eb2-b759-26afc1eb04d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994808, "uuid": "2b4dfc8d-cd00-4241-bc54-8bffaef0f55d", "value": "rnota_aa88a5ac.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e6d058-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946310, "uuid": "5226ceae-8e4c-49d4-9ca3-608b452b9c06", "comment": "Malware payload (Mirai)", "value": "43210421153440802477f67feeb7026a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946310, "uuid": "814699fb-9159-4d35-850f-e5c73c9bbd07", "comment": "Malware payload (Mirai)", "value": "b9f470afc2ccb6760cbaa0c5c98089f889a3d56cd0f0b910d5f1fc672403df81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946310, "uuid": "e16866d2-b33a-4d27-8af2-6c62f3c9e460", "comment": "Malware payload (Mirai)", "value": "be448e5a2fd3e4e1126f0823db9e8aff77c1176d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946310, "uuid": "9fc9ec0c-7402-4c32-bce5-c05c6f2e497c", "comment": "Malware payload (Mirai)", "value": "7c39c29a6f95d2cc04ae2dfe93e1ec88ea01677ae916fd76340e4bb2e6f72f8df6b8e1587deccf9261b845cceb50eaa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946310, "uuid": "9f0c1584-ce90-41ce-ae3e-2d9bad84fd9b", "value": "T11F435B01BB584E07F9D61EF2393F1BE487AEED8022A4B585690FD7454235F33498AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946310, "uuid": "208f9d3e-c03d-444e-83a3-0bc4d26955f1", "value": "768:W6J6a5X+lR1+XDRJL7bPzRWmA4DZeF6PIentQOYz9buiW2yH5GdSzdTVHkcIJpE2:KlmDHUmAKZS6Pkzh5X+TOcIkzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946310, "uuid": "7ca6b668-312c-472f-b6e7-e958eab69fdb", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946310, "uuid": "8dff778b-bde5-460f-90b3-bd658dd87c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946310, "uuid": "04440156-b8c5-437c-a621-3f2495019045", "value": "uranium.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1ee6cf-5acc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779997076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997076, "uuid": "ba39d595-77df-44ee-94bb-6de72ea45612", "comment": "Malware payload", "value": "9d66c54bef2946f1a43730e15ddb3b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997076, "uuid": "ce7c1d4c-8ee5-4246-86c8-4aaedabf1924", "comment": "Malware payload", "value": "ba00e5dcf9b562371d1e8eefff53328c37ce4c894669a9220f0991218be369eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997076, "uuid": "b55f9d82-d5b5-42f4-88bc-3fe6cff20c6c", "comment": "Malware payload", "value": "eb62d3863dbdb6999bd3e19e7169630dba8013a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997076, "uuid": "d0ff2b2f-9904-4a13-9f85-490d99f3b34a", "comment": "Malware payload", "value": "fff64c6a710aa3f5220e8ab3a6b4c91b331e3e7a1e9cabd98e861f981726a5b5dd25cbf66e0b2542899cdb6b58b66e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997076, "uuid": "2d7d6d5a-832d-418c-9c0e-1f1d011d0202", "value": "T126D34D06B30D0943E2632EF43B3B27D1D3DFE98124E4EB44255FAA8A9272D325546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997076, "uuid": "f8a36ca1-d913-4f12-a269-5841e4adb49e", "value": "1536:w0LCJd+hkoz5x58MCTwmoplaruphC4cILMXgVQsuSXBivA/y6Z3jptqio8MIX824:w0LSMLxaPUAgGs1b/OldA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779997076, "uuid": "2b6636e6-cdfe-4829-b333-88ec1798decd", "value": 138908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779997076, "uuid": "b2ef21c6-c4fe-4d81-b5be-af45431222e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997076, "uuid": "0ca7fec4-5a36-4e4e-9c43-dd2e52ec3c71", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcb1654-5af0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012655, "uuid": "a6666dd6-b69b-4336-99d2-4394eaf90b78", "comment": "Malware payload", "value": "aa11d41603e3e843608b3bcd543c07c3", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012655, "uuid": "164ca9b9-2f16-490b-81cd-3894d7f7dad3", "comment": "Malware payload", "value": "ba1af85880677c82be1c4388452fad1874f2edf73e5cd1521553c3710cf63ffa", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012655, "uuid": "1a5f2279-a0bd-4fb4-8996-def3f362d0ce", "comment": "Malware payload", "value": "2a050912c63e032548dd3809c0a2ddc663f78dd0", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012655, "uuid": "ecd29eff-b89d-47fc-92b4-c57c2f2fb160", "comment": "Malware payload", "value": "970a5804269f8954207afd4cbfc1926b488bdf4c35e815b223c6f326464f15b54cddbf2c76a23b94713614ee40707f44", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012655, "uuid": "03eafd3a-3cfd-4a61-9f95-f1447d7238d7", "value": "T165167C0B7CE048EAC0AA633289F762917B71BC490F7263C72E5076782FB26E45D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012655, "uuid": "08da4813-5f79-4259-93ac-ee9602c745bb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012655, "uuid": "71eadc04-4f71-4eda-8b6d-665543de79f8", "value": "49152:Wf82l/UJpXFTHBTKlz86Gh8Ew2TlMglX4H8:WTAn0l4RNllIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012655, "uuid": "a0c27871-a3ec-4f6d-b7ab-e1f336333f2c", "value": 4386944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012655, "uuid": "55db6d48-9736-4d27-96f5-404fe9bf3dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012655, "uuid": "4ceddbe7-c46e-4835-a320-b0dafbaf311e", "value": "LJHKKUU7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286eba16-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973210, "uuid": "2cb6a095-c4c0-4ba7-b6fd-63a798d79020", "comment": "Malware payload", "value": "27a2e6aa4fb13044e4ebfb898d58d8c5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973210, "uuid": "94c58754-a46c-4f18-bb3d-37b5b5fd8aaf", "comment": "Malware payload", "value": "ba57338a2d9bedc770c3cebc2a68e135ebbe5b58e8fda6daba84d1660015e996", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973210, "uuid": "303973fc-755a-4b42-b88b-2b94ec218f6f", "comment": "Malware payload", "value": "c2242739d159dd66be8281dfafd674bc32fde6c7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973210, "uuid": "dd7d3dc3-3dd9-4feb-9187-f414b20f8e0a", "comment": "Malware payload", "value": "50c3c4210ebc5e53abf21f9a8d07016940203207e42013b67f717e218aebab54c04fc45b68b39982c5d9017ea3e23201", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973210, "uuid": "71284077-cb02-41d4-9210-97f764ba7127", "value": "T12DA31541F7F94119BAB72F442AB946B8493BBFA2153DC9DDCA110D8D1B33508A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973210, "uuid": "39d1d9fd-0714-4b3d-85ab-8e36a0b86b6b", "value": "768:1AMrRTzXKa43vXF4vQ9jx5Nfyb9kjQl/kaJodfoJZ31yyv10agFOtsphrXo9RSDc:pt1cfp9FZJ7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973210, "uuid": "310aee92-f7b3-40b2-9e75-dc3428822b10", "value": 105684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973210, "uuid": "27201f8f-996a-4237-8b50-81a61ef0ad22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973210, "uuid": "f41fe9f8-1663-4dd5-8b65-136c602ee1f9", "value": "rrascunho_0e3394ee.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15128f75-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001094, "uuid": "6e0b7d43-3118-475b-99bc-5a6434f50900", "comment": "Malware payload (Mirai)", "value": "17cf3d907db6a084dde1a054ddd356cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001094, "uuid": "bc05ba0e-9e1b-46b4-b6bc-e5ca5b2a8c75", "comment": "Malware payload (Mirai)", "value": "ba8869584ba8cb931623debe6f6755208e19546474a2d155f5cb664d0acf6604", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001094, "uuid": "32dd06bf-df87-4775-a5b4-dc42eca41c9c", "comment": "Malware payload (Mirai)", "value": "0c363a88d9d72c88cacb897abacfd0ecdee82610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001094, "uuid": "d5e5ba5b-e14f-49db-98fb-74fe3c67c045", "comment": "Malware payload (Mirai)", "value": "012e1ef1d0622852a533fb617a563604ee12ec9f0581f9593f9474e7b53c176e77f2f0d3a404fcbe98f8ceada2c5c0ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001094, "uuid": "7582fec9-294d-4808-bf47-89a804f296c2", "value": "T11AD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001094, "uuid": "1d270c90-836e-472c-a9d3-4337eaabefeb", "value": "1536:wKdzElm18uZJNb4A4Fa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TG4:wKp50XU8e947LPHh+zS6thBZ6xKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001094, "uuid": "ab12c580-2bfb-433d-b950-a5e618e3517b", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001094, "uuid": "36be3ceb-2987-4468-924d-d0f7eef0115f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001094, "uuid": "5e94bd4c-7f36-44ef-9ff0-48431a1375ae", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7343b9-5add-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780004382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004382, "uuid": "36af79b1-25b5-4a81-88f6-cb66ad9a4816", "comment": "Malware payload", "value": "78f8396b9daf27d08aeec10539eeab56", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004382, "uuid": "22c94acb-cd4e-4bcd-8424-6780339e1cb5", "comment": "Malware payload", "value": "bb1b4e46f1e4a7f17b1b04ee08c33400b2b6fd2327612a4d84da81e2656ba48b", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004382, "uuid": "140bca07-2d20-4be6-ab54-a28fa2105f98", "comment": "Malware payload", "value": "bd807ab5dfa0a716128c2167bfe12fcaa9bdb491", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780004382, "uuid": "33752678-fa62-4d71-b194-05554a708230", "comment": "Malware payload", "value": "3db2e93a13e0b2592731a674baf362328e1413fb1a69336fb0e85e866a512e4bf5214ce148d6ec9e3bdf65d94bc9809c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004382, "uuid": "78b3b33a-a239-4939-bef6-5b245d0f2111", "value": "T13233F863D09782B5E51FBCF8C1B5860FDEA4B604135D2ADF28F0DC672B2256867B1436", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004382, "uuid": "c06853ca-0ebc-4432-a8da-2a66a6c0350c", "value": "3c5120e1731c07a9c5b348e9d428650b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004382, "uuid": "254f0278-f407-49f8-a77f-00633804ff8c", "value": "768:RF59NheIs8hbwr5wI3XSpDW1xRlPDf36K9zsS:XbLbwwI3XSIDflzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780004382, "uuid": "9b06a68c-9c8c-431c-8a8f-a365f558ab0a", "value": 53968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780004382, "uuid": "5985e240-f2f7-4ba4-8742-63bcbc13e7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780004382, "uuid": "39ed8bdc-4250-49f4-a2fa-d94e8cb2735a", "value": "PcwPerfDA.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82ab6f8-5a34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931816, "uuid": "440c0cc6-60be-44b5-83ba-2544fc2294ec", "comment": "Malware payload (Mirai)", "value": "3286025cabedf363b525c2562a59dd10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931816, "uuid": "dc5820df-b47f-4f13-bc81-60bf36c42f7b", "comment": "Malware payload (Mirai)", "value": "bbc1c54d21d21d689905762d29a83b87ffa565dbda30e0dbfbf27235dbc9e652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931816, "uuid": "4717a75c-57db-48ac-b08c-e5fd085761c6", "comment": "Malware payload (Mirai)", "value": "3d754564964c586d9019a1056df2fc5c8df669a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931816, "uuid": "c45d6d2e-db65-4503-999b-186c13ec591e", "comment": "Malware payload (Mirai)", "value": "638b38b9a91c9ced39f50b573f3740053f4c9b63fbc5d2d4536791cdf0bc94225fb567324be227f27cab972cc50eaeb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931816, "uuid": "4ef6b809-b687-43ac-99c5-40979856308e", "value": "T154C36C42B7080A47D1575DF4293F37E583EBD5A120F0BA89B54EDA0A8172EB7254AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931816, "uuid": "ff299212-ca38-4c2d-a2a9-cabf02c23a3e", "value": "1536:c6MIM7eclJ9RQ5JaOQo4Pn3ZxLAN7n3rjw9Sg+m81RXVKws6vtd/nh:cxtKclJ9POQtqFrM9SZVvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931816, "uuid": "7320b856-a0da-41b6-9227-d5bd845c6fec", "value": 128648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931816, "uuid": "b9286289-4d56-441a-b383-388b71ea60ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931816, "uuid": "889bf270-1f5c-4f84-ba75-40acbb4680f2", "value": "023782pler.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c30136-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779968970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968970, "uuid": "97024e63-bdc2-461e-ab1d-3297a6575545", "comment": "Malware payload", "value": "e94762799081a746f41d8da0b2b7e273", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968970, "uuid": "40d143a0-cd69-441c-8211-cabaf39c7a00", "comment": "Malware payload", "value": "bc4f7f4eb4e9ed27ebd716d5601a5f92d638249ddfc554079856a59f79bd3558", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968970, "uuid": "ad9cfeb2-524f-4fd7-8ed5-31c0388fe744", "comment": "Malware payload", "value": "43b979283c291b66771cbeb4a8ba0965ea13c2ef", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779968970, "uuid": "e69e77f5-df08-4816-85e9-d3b4efdb5341", "comment": "Malware payload", "value": "d57a00d6449d0ff42aa950b882f6ac12eb35fc7279d29814f3c997812b67cd61238501b64ce34d85a7d734becfa7eb03", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779968970, "uuid": "62b4fbc0-1786-4047-a8b8-2cf9b03b5d78", "value": "T10B663358CCAE98FFDD696E7B45183734B9694C26D10DE3E53062C2E2907A7CE3E452C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779968970, "uuid": "fd70d69f-8665-4f5d-9f09-bb0151473350", "value": "196608:tC7HqnDKSyYFhHsrOcbcG76IIr+Lsc9ISQ:tCbqnDKaabLy+LsQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779968970, "uuid": "753b6c51-cf07-4d79-9550-0503ef576197", "value": 7117874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779968970, "uuid": "21cfbff5-b581-4ed8-ab15-3e09045e2a4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779968970, "uuid": "cf676f45-fc5d-490c-9625-286444164b9b", "value": "ArchiveTaxdocuments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e8b462-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779949585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949585, "uuid": "ede39881-7b11-4d4d-9b0a-b08236311b1e", "comment": "Malware payload (AgentTesla)", "value": "a9f9ec8edf3df1a326f54ec0f4c64722", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949585, "uuid": "be28eeef-049c-4529-9711-eff4020d8baa", "comment": "Malware payload (AgentTesla)", "value": "bcb909b14cbc4682da59cf508d80cb17117091d445d2426ee17f6c8b501600f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949585, "uuid": "f73499bb-e65e-4f3b-bf89-291cf3c4c600", "comment": "Malware payload (AgentTesla)", "value": "059d782ac69195b1dddf7c673a592f4bd8ff92a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949585, "uuid": "13a6c9ac-4115-4ac5-a39a-467f4f284285", "comment": "Malware payload (AgentTesla)", "value": "eb4cae5fa6db79ee504081da7c439718ddcfa0403e3603371b1a00a711b5685270e7dc5cc53c0f25e19e84d56cf80924", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949585, "uuid": "ea12d39f-0949-4f54-b861-3ba9e6772fbf", "value": "T1022501652602CF05CA0F67715FBF1B95D2278E180E7583C78B932DADBA37629E290D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949585, "uuid": "84fb67d7-67b2-4395-aed6-c842404b444d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949585, "uuid": "c1c63e8a-cbc6-415a-820c-e7fe9c8c962c", "value": "12288:Y0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wDsq98Ki5G05+bG3Ocx4+YIJ4:pFJz7c5a8uGrx49GR5L5+bG3OcXJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949585, "uuid": "5c82129a-1fe5-4ac8-b9d9-0ff6d6724cdb", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949585, "uuid": "be25f06b-c0a5-48dd-b737-8450b749d5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949585, "uuid": "a2c304c0-65f4-4b24-b90e-50948a61fade", "value": "revisedXShippingXdocumentXBLXPLXXandXcomercialXInvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed277072-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779961943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961943, "uuid": "21d2a28d-f43e-410b-89d2-9f37bb05591d", "comment": "Malware payload (AgentTesla)", "value": "edaac56ab1c32ed75c7b3ac828dc99ef", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961943, "uuid": "568971e9-7c8c-4c27-a4e2-58386f507e96", "comment": "Malware payload (AgentTesla)", "value": "bd21312f4b7fd5f7b589a98b472952a2111f02feb6b11386bdb90475b14c559d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961943, "uuid": "2ba12838-531e-4974-b317-9de425aa16a7", "comment": "Malware payload (AgentTesla)", "value": "7acd02254c4dc984dc01ae760e28476a8b6965f6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961943, "uuid": "59888e4a-8dc9-4657-b9ec-16a35b4787c1", "comment": "Malware payload (AgentTesla)", "value": "25845493c2c2bf95a0b63ae498c531dca974b0e8ae346c5e31564811b1303f17e4183939152e8927056e351fd568ad2f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961943, "uuid": "5b5e1dbc-fd80-4c5a-82dc-efc11a862a43", "value": "T18A04129AA51849ECB8CF199D4ECADEF6C42C361B34B45A4A352709816EDF3D1318FDE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961943, "uuid": "5335f051-a27a-4dde-b0e3-6e09205fad68", "value": "3072:JtV7VUEJrCXlOXH+tag+y8Y8ppcB7xeMihTWUdVkuWiaGz+caR3csgFTvO:JPCEJmVk+kgt38ppcNo7WUdVJ5z+TRuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961943, "uuid": "e11ca07d-62b8-435d-8389-00e492847955", "value": 180960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961943, "uuid": "e3946c2b-0d5e-4010-8c58-be08c7af4111", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961943, "uuid": "0fe327d3-936c-4b87-81c1-f2d2f51d5981", "value": "SCANDOC275.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940832e3-5ad0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779998730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998730, "uuid": "4fe6184e-f678-4a65-9349-5ebf99317021", "comment": "Malware payload (Mirai)", "value": "9f78e922206721f7520e501b55f34849", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998730, "uuid": "861b998a-67b8-4278-bf05-d422d377c9c0", "comment": "Malware payload (Mirai)", "value": "bd5c39656bc9dc05a28acb9fd2e2d32b1a06981a3debf470b1f9f2c457c385ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998730, "uuid": "0f71f977-4b73-4f16-aa84-bb0dbcd84046", "comment": "Malware payload (Mirai)", "value": "0603e91dae9036563c886b61dbf26d842f6914f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779998730, "uuid": "5ef2624d-26a4-464a-b8d9-debba8cf61e3", "comment": "Malware payload (Mirai)", "value": "813ff68f85d964e372de75edf456e2f0fb8cab8693fe6d0676564561f18bafa6865f21a0cc125f5d760bc541b889c2e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779998730, "uuid": "3abc6c35-0e64-477c-81d9-03363926010b", "value": "T14B04985A6E228F6EF278C73047B74A35976D23D627E1D684D2ACC1142F2039E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779998730, "uuid": "39cdb780-f398-4fce-9064-30b8a475dd8b", "value": "3072:gWEL7JOeinxPIBQCCy1o0vUKtWzaPyTuwOIc/ZotL:gWyJOlnZuQCCS8CkTEf/Z6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779998730, "uuid": "8e8a14b5-459d-4c86-84c9-f62c013dcde3", "value": 185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779998730, "uuid": "36599c31-484f-45fa-a8cd-4bab28c97636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779998730, "uuid": "4f19e127-86b0-4e3f-b375-57df6c5bd283", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0e64c7-5aea-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1780009943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009943, "uuid": "c305dc3f-ddc5-4a09-b531-61592b053c9e", "comment": "Malware payload (ACRStealer)", "value": "fcf8f11748c96bf1a0e4e76388f53833", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009943, "uuid": "dd7ecb6b-1831-474a-8ec0-c716e4991a9f", "comment": "Malware payload (ACRStealer)", "value": "bd7832157bc4ccff2632e3e457d47042fddd8327a72549f1dda6bb822c85f04f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009943, "uuid": "40d9f3fd-3cfb-4d5c-8f08-b4164a605d7a", "comment": "Malware payload (ACRStealer)", "value": "203f93f7db22551fc6d0c80d1403544d366a3a92", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780009943, "uuid": "9370f8cf-b8cd-4879-8181-40887b77ddf6", "comment": "Malware payload (ACRStealer)", "value": "6e93a4664a44052e0e5cb8675bea59c94b83d13e6cfb790e20a0da0bb53f9774ca2905beb5f88432e4a51fae462fd1b9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009943, "uuid": "162bdc2d-1758-4950-8b68-a7e41cfd7e1b", "value": "T1E6667C5A7CE048FAC0AA933689B762817B71BC490F7263C72E5072782FB3AE45D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009943, "uuid": "0ecc3345-ab45-4eb4-87fe-ff49c0edde2b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009943, "uuid": "d2fa3b53-e976-45cc-bc1f-1a1998da0315", "value": "49152:MSNDrgTOq8V97fDn3/dwHpaM6sTZM3X9tP:MiC+70aOa3NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780009943, "uuid": "c6de5b60-fd50-40cf-9e06-d898cf47bbc3", "value": 6509184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780009943, "uuid": "19dba709-aba3-496f-9b2d-f6bc54ad3ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780009943, "uuid": "e9510a45-dfd0-47c0-99bc-9fcf435d361d", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56497d2e-5a64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779952241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952241, "uuid": "e4b3adbe-f148-4a3f-8cea-19692fef9615", "comment": "Malware payload", "value": "efa6c7cc38e94a1d3e5e6b7f52181de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952241, "uuid": "4ca45b88-0710-4c93-a435-580f634bf485", "comment": "Malware payload", "value": "bd93fd7c18fdb514d451f8faf64a68584e967403ef5f75886ccafbadb203f422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952241, "uuid": "fc1adc2c-2a82-473e-a8f4-fbfc11940b22", "comment": "Malware payload", "value": "7dcfe9ee25841dfd58d3d6871bf867fe32141dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952241, "uuid": "8f3cc98b-7f5c-457a-b1eb-fbccc038548e", "comment": "Malware payload", "value": "f6e30f70b67bf7ead6d8a85a4588f42461b56738225bcc137c801fcd391a89f1d70712e807d36e82651bfa3836f2880a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952241, "uuid": "741088c2-e5ec-4638-a6fe-5de4d68c62c3", "value": "T18922D95847ACCA23ED3F0BBD489352834FF2F6259466FB9F0ECC59DA291174004A276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952241, "uuid": "4a4c7f2e-8843-4d5a-898b-9c6724e8ab28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952241, "uuid": "feaf1756-d691-480e-965c-5b7cdf3054a8", "value": "96:mXrlvuNvSgtgIdLukUupTFQIkdmou4n/J0pFW9moPPYW3Ew5H+KEAOjUBo7No/zj:gukbIBUu92IIZJ0A1zH+KKjUo7+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952241, "uuid": "1f59be99-70db-4d8d-a147-f7eda8561610", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952241, "uuid": "27fcb742-9f6a-426e-a985-0c2e704a0a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952241, "uuid": "85cc4737-4529-43d2-a25d-6a3e9fb3f544", "value": "bd93fd7c18fdb514d451f8faf64a68584e967403ef5f75886ccafbadb203f422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fd87dc-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970095, "uuid": "3b424e3a-d023-4146-bd95-bb99cea32e60", "comment": "Malware payload (Mirai)", "value": "3bce45dfd212a58de45d2eb0c40c4c22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970095, "uuid": "949fdfcc-eb49-4f83-9046-18878255e810", "comment": "Malware payload (Mirai)", "value": "be23caa83970fcdf72e40d450c8317c85b9499a70e6f8419cfb9a9b05be6be0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970095, "uuid": "f73f2d28-bbad-40ba-ab93-39c3933019f0", "comment": "Malware payload (Mirai)", "value": "6bc7b517167df18a65ae88a1f3d173cc861e4940", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970095, "uuid": "2c6620de-3b0a-45d7-97d1-40c6523c6c16", "comment": "Malware payload (Mirai)", "value": "2d45e883cfe99ccb689eef10b1d06086a871f12405c8a3b3fddc2f3ee68cd813a631bf90844b64a70efcdd20975f1567", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970095, "uuid": "b0c190f7-83de-43d5-81a9-6f891043a77f", "value": "T14AA3198ABC858B10D5D526BAFE0F118D33139BB8E3F97113CE145B2E638AC5B0A7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970095, "uuid": "525cd59d-7eaf-4cd2-9f97-6f282b48cc5c", "value": "1536:Djnm0bURA8IieZgIjoVNsET/sFdv/3wgHhsR9nee4DQH0PIxYqlUyiUaHmEqnX:fbURA8I7GIjoVWET/sFN3wQhqNe/DQHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970095, "uuid": "cc6cc43a-d9f2-4396-a998-dc0a4854ab5c", "value": 97788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970095, "uuid": "50268867-c64f-427d-a6ef-689921504027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970095, "uuid": "39717820-890d-4672-94db-08452d6eca96", "value": "v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b056b66-5a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779944411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944411, "uuid": "153b05b0-6cd0-477f-b22b-96a62d7d45ed", "comment": "Malware payload", "value": "ccdfeccef243b10212ae9fd37da2585f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944411, "uuid": "7efc013d-4906-4cb2-8925-8ac9fc25417d", "comment": "Malware payload", "value": "c04a6527aaabafe3a203ff7ada59d46e247b8457b1ce396fdb08ab5fb605cf91", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944411, "uuid": "99d51e11-8a26-43ae-ba6f-aa18bd21dcb6", "comment": "Malware payload", "value": "b796ef59e4e32df342ce318673c80be5b02f0534", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944411, "uuid": "b92eb61e-9462-4687-a869-8bf5eddc2874", "comment": "Malware payload", "value": "9c85fed03e401eddabc03337c9e974840db7733ca40cdd18d064fd0644ff9c05e18b6ee2a13f4d90342f5c2f30571042", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944411, "uuid": "db43b806-67d7-4232-bc3e-0ea49ab37adc", "value": "T1A2A31441F7F94119BEB72F442AB946B8497BBFA2253DC9DDCA100D4D0B32518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944411, "uuid": "d3c12706-0467-4bf9-8292-f8c4cf09823b", "value": "768:KBiIJ7wlvPCTRu+PWG35//cQibaJukbsr9hQPbkerPHCdZW50Db7NOcdEVCsOk2x:qXVhsLqI3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779944411, "uuid": "5160a644-05d5-43f1-b69d-51b7e6111893", "value": 105772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779944411, "uuid": "fb2b3f92-cadd-4367-b7a9-71f502ee9d6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944411, "uuid": "c18215a4-bb01-4b29-8538-51497cb8ce51", "value": "rnota_9f9cbf39.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e1242-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932272, "uuid": "132b8212-9708-47bb-a237-3b59bed7156c", "comment": "Malware payload (Mirai)", "value": "0a33ba1118730a195f831abfaa141fcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932272, "uuid": "c95c3007-c503-4b0d-b5a4-681eaca88bbe", "comment": "Malware payload (Mirai)", "value": "c16390050a103c2bdbdcac74a2113bd99ebc5b4e497a7edb3e82d394b2f3e050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932272, "uuid": "aa20bff3-48a9-4fc9-a871-bc76ee54eeee", "comment": "Malware payload (Mirai)", "value": "5fdd1c1ad3fd2d2b094fc5d12658782283d5ea8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932272, "uuid": "c2fc2873-e0a3-40b1-a6f1-2c48b28df405", "comment": "Malware payload (Mirai)", "value": "4ae9eb1d2badf22685d074f8ff9d45803c3dd7b3ca43338a11321df76456e48d51bf85662490678b2beaf4bb686920d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932272, "uuid": "f841afa2-0309-4a19-9446-0a198096402f", "value": "T1BBE608927F85EE4FE2A420348AA6C23463D53E40C6E074329662F3191E7F2759D6BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932272, "uuid": "05d64820-5e0c-42f4-9144-df34c4902038", "value": "98304:49ffLBn+++91nz+SGQuy/mZwcFrz8CjEf:49s++91nz+SG9ysrz8xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932272, "uuid": "c9d2e58d-1a05-4a12-aa43-46a19551c08d", "value": 14090402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932272, "uuid": "9ec6eb64-1aae-4baf-a057-af75ebd91623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932272, "uuid": "cd8d4fa5-5f4e-4461-aaa7-466bfae54937", "value": "wife.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f009a94a-5aa5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779980416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980416, "uuid": "1b2878bd-458b-4586-806d-dd5d3f0aadd8", "comment": "Malware payload", "value": "36cfb799c73460165c64888fa73c384b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980416, "uuid": "600bbf31-3a9f-4c7d-a466-9ed9755f03e1", "comment": "Malware payload", "value": "c16e9a9afc6de27ca943202ac9a9eaf87bf2eb6dae2fb6dd664649511830b159", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980416, "uuid": "898ea62e-888d-4d56-9312-771840c9e663", "comment": "Malware payload", "value": "35eca0afd983cb9d4f8508a0d9a46b2e29f05708", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980416, "uuid": "ccc322d0-1f47-4cc6-8a9c-a1f7c7a2d3c5", "comment": "Malware payload", "value": "0b9635c99774eba122cb28431a531e103b880fb0c716083b6568095692938629f4b13ea89d01bb278c31e107275f5143", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980416, "uuid": "b50f0720-4aa4-4d15-adf6-36c5303f5678", "value": "T1AFA32441F7F94119BAB72F442AB946B8497BBF92253DC9DDCA100D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980416, "uuid": "4043db89-55c9-44ab-98e1-fc0f5f5f7336", "value": "768:ZrxhI+96KKcCuferm5jXb+vHclaV11TeAv47zhxWNNBXjM1UQQEZQbURXw9KssNM:NJ93dzQ+60o9z22P9/L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779980416, "uuid": "d293a806-b54a-4593-b58a-85e2b9d8faf8", "value": 105886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779980416, "uuid": "ff8a752a-f9e9-429c-869a-8ee4f69e6462", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980416, "uuid": "0bcb8a9f-2cbf-45fa-9084-93117cc6bd0c", "value": "rlembretepedido_40667ad1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8736b4ea-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "80e613da-9072-4a01-9062-47982c02238e", "comment": "Malware payload (Mirai)", "value": "bb78d3d3eab5187e88f6047e6abbbce3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "028ab71e-20c2-42ea-b471-68e474ef1858", "comment": "Malware payload (Mirai)", "value": "c185f0177531642d142323f1f2654589f06eaa7b5d94bf21b4c3c7fa86c5f1bf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "5c27bae8-6594-485b-a54d-6185acdb6311", "comment": "Malware payload (Mirai)", "value": "f8266bfe2fa46b859f5fb3597d2115814e4f8123", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "eee03cbe-de55-43a6-b4ab-9dec7df6d05f", "comment": "Malware payload (Mirai)", "value": "0faff07a74d0a15383460ffde1dd1bc7461a81933351b26638ea6e138e75dd0d5be181fbda7f5ffb5ce64c5c4548b766", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969074, "uuid": "7623a181-8a21-48e8-9f98-c8b56882d90e", "value": "T18F933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969074, "uuid": "37b72cdc-6825-40fa-aaa7-a426cdd8556b", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2D3:eyxt7W+G+3QBBntmzg6d7WidD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969074, "uuid": "3dd7cad5-4b2b-4891-94e4-0d05f0c3a2da", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969074, "uuid": "1def33c5-3924-4b91-9041-51358b2fa484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969074, "uuid": "4fc26feb-3e76-4633-983e-e10efce1442d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55e9369-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (SchoolBoy)", "timestamp": 1779969661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969661, "uuid": "df87b845-055d-4510-8230-e0e2109a12ed", "comment": "Malware payload (SchoolBoy)", "value": "c1cbcb43edc5589886556887de2f3704", "object_relation": "md5", "Tag": [ { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969661, "uuid": "de249d31-df50-4703-86a2-39f747d5aff1", "comment": "Malware payload (SchoolBoy)", "value": "c18cb7267747fc55042f49b302d41e9cb7e75080c80aa5fdf580a7b23fa90a8e", "object_relation": "sha256", "Tag": [ { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969661, "uuid": "815becbe-ad1e-4315-8246-3d31dc0f3544", "comment": "Malware payload (SchoolBoy)", "value": "c0da932ebd4ad3cec1b47767502f13338163d565", "object_relation": "sha1", "Tag": [ { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969661, "uuid": "2cc342ad-c1c4-438b-a7ed-c96dd9367b91", "comment": "Malware payload (SchoolBoy)", "value": "c142fba66dba973c705dbc897dc6cc04dbfc37f0b9eff5155417c8c1cebb9328fbfc4b9a5238b7670e5df7463ea0f602", "object_relation": "sha3-384", "Tag": [ { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969661, "uuid": "d801d9f4-edf1-4999-824a-5a09be5fd0d6", "value": "T1619733BD87FB3F142BE38821BA1560B1884F32964578D9A1BE35F899760F7D341A350B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969661, "uuid": "1c1691e9-9def-4df6-9ea8-b70f02170a46", "value": "786432:wxT+LOi8eixpI+t0RNijWM8mpzYlCbeBxCVVkXDNjkj+EIiJKgxLDP3klPW5W:uTA8eixpI/mWTmVSHCvImxLD/gPWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969661, "uuid": "2f5315f4-001d-4a2f-97f8-f7c8d9448f51", "value": 40764166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969661, "uuid": "f798e695-a8a0-4bdf-8c3b-49c4dd625acc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969661, "uuid": "a0055b0e-321c-4048-b084-bb44133cca15", "value": "TencentMeeting.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d11d88-5ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780007431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007431, "uuid": "cac0a9da-e030-4f67-9700-6e83343b8256", "comment": "Malware payload (Mirai)", "value": "aa3fbbd2796b9b6b5f1adc54b590861a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007431, "uuid": "ac78362c-be3c-448e-a463-14c3ba5fb713", "comment": "Malware payload (Mirai)", "value": "c209b01904955fae5564f486e63d372f997069b7f8f5267594703795a67527ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007431, "uuid": "2bcd4f01-3ca6-41c2-90e6-2a831e4c2cd2", "comment": "Malware payload (Mirai)", "value": "2c67e15eb5f1f9d5e443c704adb7b2772f527091", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007431, "uuid": "d86062fa-f914-49fe-b53e-aea8e15577bb", "comment": "Malware payload (Mirai)", "value": "6fa8b676b20531bdbd61a0b676adcc4aebe6e651dafe631caa2e7d4beb7341dec7be53af41fec61c6547de03e481c9b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007431, "uuid": "afef3d2a-7233-449f-9fab-1c0b6539debb", "value": "T16E23E153A3B7A6FCC531C43669AF90D4DDBA2421268D470B0EA621FD1E729D8FF012E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007431, "uuid": "48aa61e8-09c2-4a8d-8fbc-18b231338846", "value": "768:rBCzxD3kzKd+sJs7R+22cIAe3DoJRtottqc2EpjVPGc+1oq7Ix6868yExrYfPa4a:klbkKu42lIAi0XKbqjEp5GhLufyExrYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007431, "uuid": "60e24e75-48bd-4e83-8040-f1d3db81aee5", "value": 47720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007431, "uuid": "dc4071ee-1aaa-4610-9092-41442376bee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007431, "uuid": "cc1f300e-fd45-4da5-b138-651047958035", "value": "c209b01904955fae5564f486e63d372f997069b7f8f5267594703795a67527ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23142ab1-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931110, "uuid": "17326d6a-dcb4-426f-a3cb-68a2794d56e7", "comment": "Malware payload (Mirai)", "value": "deca58cb64f6f596ccd23a77a3183662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931110, "uuid": "86b576a3-5763-48fd-a226-0e572fe20f20", "comment": "Malware payload (Mirai)", "value": "c25a27ed5ade2fb06a4697a1e818c054d86244b7897b3a818d556fe615420ac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931110, "uuid": "3dae3895-27e9-4713-85f3-fe70a3141c7c", "comment": "Malware payload (Mirai)", "value": "221577fa351782d8321f68781c954c92a86c85ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931110, "uuid": "25b96e8a-da7d-4b6d-85f3-864d63e95cf2", "comment": "Malware payload (Mirai)", "value": "0249a0b3ba7f626bd07023e31445d394bc707cae9d932792c0a04a7b721b5a89e38b585776f2ad15192759a0416e6f7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931110, "uuid": "ea4b79d8-023e-4837-b733-8b5a6eb4c8de", "value": "T193D34D86FC918A12CAD522BBF72E628D331653E8D2DA3203DD245F2537C659F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931110, "uuid": "99a196bc-6b4e-4aa2-bee2-3c71472f867a", "value": "3072:Bh4d1PI5BNFlgXHMlRLSfxVpQdoF4fsNdE:n4d1PIJFOXMDLYOdo4odE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931110, "uuid": "b6ab14de-cb15-4bcc-beb9-16f3e049e8b2", "value": 133936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931110, "uuid": "7bd5ef11-403e-4f57-9929-628ac0b364bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931110, "uuid": "3f86dfad-d137-49f4-8fe3-49b4b23269e9", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b54081-5a64-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779952403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952403, "uuid": "607270c0-d376-4acf-89a0-ffe614755b92", "comment": "Malware payload (PureHVNC)", "value": "a3f3ca718c8734148012e3577c78452a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952403, "uuid": "c05d0d63-5cd8-439f-91c1-988973333cc8", "comment": "Malware payload (PureHVNC)", "value": "c28b6a43b3d0d0b5ad592ad76c71756e79cebf6566cb31e58de1742cfbc629a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952403, "uuid": "4681e8f6-3e53-4091-a069-7133484ddee7", "comment": "Malware payload (PureHVNC)", "value": "42f5a15dd21961f4555ebbf3da5f9c997a310997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952403, "uuid": "451c818b-0adc-4271-8f1a-d1707490f3b4", "comment": "Malware payload (PureHVNC)", "value": "d5b4cc8444a6459d00c7c7e6f1f490b901469a246079fa9f3ed6f69331b811673075343e14aec16dfb0a99bb814f072e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952403, "uuid": "01aca373-7aa6-4265-943c-bf7e5d15837f", "value": "T1F0648D5813ED8A26E6FE62B5E43D140D47FAB51A612EFB4F1AA010FD6C13F8449017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952403, "uuid": "0b76b0e9-f312-4015-8338-eed3b6adbb4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952403, "uuid": "3227dbb8-408f-407b-972d-7cab0d8ed1d7", "value": "6144:e4e4pwEittxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:7BmEiteu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952403, "uuid": "e9cc8bb6-b6b0-4734-bd9e-a466dd2f7856", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952403, "uuid": "fafaec69-f8bb-4ec6-bb9e-b10bfb5c398c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952403, "uuid": "d102411f-f99c-4165-9d58-d20f659a0ec9", "value": "Vxzfruph.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9210afd-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "b263a0e3-99d5-4050-83fd-cbd35071fe65", "comment": "Malware payload (Mirai)", "value": "2fbb34e501f340b751336dfe9759d45f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "8a46d547-105d-4290-9069-8f5e471e20d1", "comment": "Malware payload (Mirai)", "value": "c292a9501c815c6de3bda6e2afe6119cc7d71bb064a121033b3ef94841dd18f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "17b6844c-2372-446d-a7ce-36cfcd1830e7", "comment": "Malware payload (Mirai)", "value": "406e5136a38f57420743078afe924165231e5ef9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973935, "uuid": "2f2d2afd-b789-4e2b-acfc-8f5b0ff5f291", "comment": "Malware payload (Mirai)", "value": "5110a7df40e6be4d2bdb361880187f5cdf9bd38ffc92dbe710f312fc31def72433bab01766696b5188c62f77bc911b8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973935, "uuid": "9da03062-f23b-483d-8b16-b70c55c204e5", "value": "T1C2A3F649FD416B10E9D635FAFA4F024933934B6CE3FA7101AA245B3123CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973935, "uuid": "d6acb37a-158e-407b-a878-38a4df5bca17", "value": "3072:xonrHQmNGQhemIha7NAldl/8CQyTK/ZE:xonrxGQIxha7NAldxCy2/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973935, "uuid": "c9c9bc44-0707-418a-9d7c-36b4724b994b", "value": 104300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973935, "uuid": "5a948eca-6de2-44ec-8879-73d947670905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973935, "uuid": "603087df-c661-4470-b15a-e3d51642dbff", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bb4092-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969868, "uuid": "a59470ca-0084-4a2a-b00c-59b983641842", "comment": "Malware payload", "value": "01f865dd8b4bc5fcd63cd0dd1183e565", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969868, "uuid": "0959091d-4394-427b-8c76-3ee8af52076b", "comment": "Malware payload", "value": "c2c32128bc6834b0312188e2fd525704979b28b2b49a6c4676f069c6d2026bdb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969868, "uuid": "992d7d0f-31f8-440f-afc2-c58d1c0464c9", "comment": "Malware payload", "value": "253424f404fca652fe647d04810de150c5fd1085", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969868, "uuid": "c1bca80a-25f8-4353-b794-bacb99385244", "comment": "Malware payload", "value": "6e0b4790b1a62be33d19e0281797d22a14ec1944348200be8edaa736d1e8629a837a523a4c7d9d3751d07e168dc09e5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969868, "uuid": "461f50fc-08a0-4617-b275-4b8758943d39", "value": "T17C312BC408D17B7FDDD8A9157662A06D102868CA3E6F3EC4DDDA289DA7D42C2F220E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969868, "uuid": "a5fceb25-0c63-4758-9fea-b848c15ff08b", "value": "24:e1EBvi1ykBFBvK9hZAYTtqBvTm7TwC1BvWP9sBvpbEByTvDp8wjOMtqBVSjRwOBt:e1oviwkB7v8hZLcvIECLvA9gvK07pb1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969868, "uuid": "fd79b2fd-3c11-4fba-bbae-104e0b8262c1", "value": 1499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969868, "uuid": "8b57b3a9-0871-44c0-8338-3e2ce343c74b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969868, "uuid": "53c017d7-60c0-4678-aac1-fd33554ee00e", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a988f9-5a6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779956231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956231, "uuid": "df343c0d-a723-4883-a0d1-f446c86d4b5b", "comment": "Malware payload (Phorpiex)", "value": "95914629ded29f1a3af8ab9ffa337c4a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956231, "uuid": "58dd1575-20ef-41db-8f5d-0da358ae8af6", "comment": "Malware payload (Phorpiex)", "value": "c3e27798412ff16970b774c9e6a62fc9bff97debaa4c7c0e025b38d9bdb449be", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956231, "uuid": "17576343-dcfa-4d29-9230-67369b7f91df", "comment": "Malware payload (Phorpiex)", "value": "5ef59e0073c856d3e9e8d4d69fb565ebd7914d69", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956231, "uuid": "0b10207a-90d3-4d53-b114-06f8cb589880", "comment": "Malware payload (Phorpiex)", "value": "0e31ff6832d954042a2a94a27493fb403359005cd9ea6fd9925366d3154316ec4d379430562c519dc9aa54fa3e109644", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956231, "uuid": "4760aad9-6c81-4e71-8fcb-3065d7d4bf80", "value": "T11D824B0FB9868316C0E100B096768A7BDA799876338454DFF7D18ADA0F686D5FC3225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956231, "uuid": "9b7ce602-f54f-46ad-a5b0-218b6b7bf795", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956231, "uuid": "c0ec08e8-48c5-47f4-941c-6fca9fda339e", "value": "192:czIQSCngTBvs/VfTPDWMZhzk9m6lewmVc8fQKUSvu9zw+ggSmOiMbO5Ot1EdkFGN:cZIs/VfNZ+m60zu9JgPL71av8U9cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956231, "uuid": "3252bcc8-2953-44c1-a05c-8723f57e7d89", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956231, "uuid": "3ca57683-577c-41fc-ac28-3c4e40fdc238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956231, "uuid": "eb1d5e1f-bbea-4d39-a7d2-6a52f4c62eeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb365732-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779973563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973563, "uuid": "db7e75da-9b64-48a8-99b0-747841a79559", "comment": "Malware payload", "value": "7e9fcb11539b7671bba0209764f82c61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973563, "uuid": "643c17c1-192c-4754-8936-8a697d760601", "comment": "Malware payload", "value": "c4013f8833f35406640e99bb9396f93f470a6152935de3ab447cda3e86d8e0e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973563, "uuid": "8ab73689-9768-437f-94dc-5833734be8c6", "comment": "Malware payload", "value": "d30d321c13c33dafb6cba4b60b1dcb1cba533849", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973563, "uuid": "5a336412-8c73-4e12-a6c4-42547e3ea506", "comment": "Malware payload", "value": "203b224124f0487ff629ea160426b5f701f7521a7ffac5a2109d0fa7195424f3930811799efdb59b2bf702ad73fcfd4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973563, "uuid": "4f64d8d4-66ba-4f29-bbe1-18004a13427b", "value": "T16F137D6526953C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973563, "uuid": "d4846c18-5331-4590-a623-4e034d2135fb", "value": "768:7XRWNGxVm9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:Vlxtcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973563, "uuid": "ed4d3ff1-bddf-422b-98eb-0b884b990e66", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973563, "uuid": "1bf2eddf-151c-482c-af69-f34611038e19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973563, "uuid": "fd115794-0bb1-4173-9bf2-b45686257e84", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c7bcc8-5a6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779956052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956052, "uuid": "0cd1d2e3-0eaa-4731-9bed-e31ebfd10c96", "comment": "Malware payload", "value": "8504c7bc56ea6d629a384c047217c4f5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956052, "uuid": "33054de1-1e42-45ad-ada0-534ebece20ab", "comment": "Malware payload", "value": "c4416abc1c30d3993c025584cf588640f79152bb015dffa51a2c8580f4c4d2db", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956052, "uuid": "42a6502b-e1a2-4e8f-9556-c6ce0e6627c5", "comment": "Malware payload", "value": "fcc1f3aaf35257f748e9236132c2a468576fbd5a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956052, "uuid": "e240f9b2-1fda-40e3-a17b-319b08713d8c", "comment": "Malware payload", "value": "adb05493f87583cf7da0d3cfe8749e0250677521d43e4b2a7c76c736a6ce3c65a5cba74de8f97836b099d8fdcbafca71", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956052, "uuid": "18f18350-1f2d-407e-8b3f-0f68d9d8726c", "value": "T198942304F36D7F5C829C3536B47F4D4920DAFA520C74E186F26E1ABA9F8B345802B09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956052, "uuid": "7dcb7db3-1a3a-467d-b6de-096706fb44b8", "value": "6144:RjtXKIuxYCmFys3QMdV8oQJjxqyHWf67474+YJXK6twx/YvZ/fY2SuU+QFNE9H6p:NEzxCF1QM7l0qOWfo1nHwx4fY26+UkG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956052, "uuid": "943e8968-184f-48aa-b1b8-af1938085151", "value": 429370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956052, "uuid": "08ba8378-8838-4b16-bdb9-2d819e5cdf4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956052, "uuid": "ed46a202-2946-40bb-8dc1-345a7a9415f7", "value": "knfip9I.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f04c360-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000306, "uuid": "a0eea9a7-fe8a-4816-a51b-9fb4d9f7a734", "comment": "Malware payload", "value": "5cb9d5aab6cd6f5b8b5f6ace0cc32b27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000306, "uuid": "f8af41de-c79d-4376-afa9-bfd8acd6478e", "comment": "Malware payload", "value": "c4424864cb5a57df4e81561cac23913d02f908bcf92f3c11f188679d9ab02c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000306, "uuid": "ffd5b76e-8a32-4436-8c9e-c4a27b2d528e", "comment": "Malware payload", "value": "eca1852f23c9a178ddd867b6076f1880673b39ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000306, "uuid": "2b6d0b3a-f519-411f-b69f-5610a600e14a", "comment": "Malware payload", "value": "41904ba7d877ee58f17e2a86cbf348f34f06413d9a63f5db496c5a078f9f0996a1826f6ff67cf9d59fd30c3d35774f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000306, "uuid": "815f53d6-17c7-4508-8155-035bfecfa296", "value": "T136953309007BF9ADD1DE26234BCC0325331B8424BDA95285AB3DFBB5F3E44C6D98657A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000306, "uuid": "bc2f6ae4-78c4-4e2c-bc71-d0f86bfb35f1", "value": "49152:VQqERF+0+3njT5TL+alMgDj+QEMOKzzKQTMGszL/H+dGoi:6qER0T3jVTL+C21KzzK6MtcGoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000306, "uuid": "eca0cb8d-b7b8-41e7-8f27-3a14ebc78547", "value": 2028732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000306, "uuid": "e51682bd-ce36-4fb8-9077-d6d1b8829bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000306, "uuid": "c626c815-f592-46b5-82ac-a66d23bb8183", "value": "vulcan_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c3c964-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "5872d6f9-d4b9-4143-84b3-cb4618242127", "comment": "Malware payload (Mirai)", "value": "7aa9f121c8b01dfb1343dc0d51eb080e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "eddb31ed-28de-42d8-ad58-3731274ecd7b", "comment": "Malware payload (Mirai)", "value": "c59a4c57bda53d507d0d00d0d34c06e2903673e087022b717e47143fd8f90c9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "c3498ff5-7962-4ee4-a279-2b720ca239f1", "comment": "Malware payload (Mirai)", "value": "5bcae9e94531ba6d501a966981a2c9a53718da2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969074, "uuid": "c25a34b3-8662-4d98-b8a5-18dc9a8d25ff", "comment": "Malware payload (Mirai)", "value": "c776dec8260a9322366a7feae0bd1e1c26eb8fbfceab7ed9d3a5135252df1c670447703d7b51eb715cd23069986ac3d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969074, "uuid": "b2f4b5cb-e668-4605-876c-00ab0e3fbfcf", "value": "T10EB33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969074, "uuid": "542c91e2-967e-4f5a-96dd-84eb7554b009", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJx:4azwz102cPPaRl+AS97Jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969074, "uuid": "e95d4d92-5ae0-4bb8-8683-8cbbaa1179ff", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969074, "uuid": "9941599c-20ee-4212-8a25-2e9c67ce4584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969074, "uuid": "7026f7a0-7ff9-4695-83a1-b3f1235b6d7b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc80ec-5ab6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779987362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987362, "uuid": "bda09b1b-f7b5-4a47-829c-1b954de90f85", "comment": "Malware payload", "value": "3d44516077b263a0b300476e74727c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987362, "uuid": "339bdac1-e4f8-498b-b3e6-bbf02e1656c0", "comment": "Malware payload", "value": "c5b8d1b89af16d100021edb32f085de5704eee08bc51bd3edc82f0a997981c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987362, "uuid": "2f004333-a086-41dd-a7e7-bf10bae004b5", "comment": "Malware payload", "value": "5f9b2f15a7bf570e209dc3a59a1eaefcc29727a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987362, "uuid": "5d2ccf1f-0d8d-468f-9154-1c2a7d678a62", "comment": "Malware payload", "value": "956cd76997aa5e72a610868de158d8f324ae9ba0118ea828843300a5c16ebbf8523b4d5d99a236b6614ba5243554f889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987362, "uuid": "c4e4f939-30d7-4d0a-b6ec-d330cf568834", "value": "T182C57C1B7CE009EAC46A633289A7A2D17B71BC560F3663C72E5072383FB26E45D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987362, "uuid": "90bf474f-ccf2-4878-91ac-0ab24985887e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987362, "uuid": "2d50ac90-ba94-4f54-88d3-da2e7479daf2", "value": "49152:yr7zTO8GZysKrKJy5Mqlg4X8Ve8v6zCEEcXPjR:yTOIlw+dlg4SeA6fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779987362, "uuid": "5811c319-92b8-4380-8ba6-60788020f434", "value": 2556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779987362, "uuid": "1511adbd-842a-462f-9043-63e9bd456cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987362, "uuid": "0326bfcc-2027-4994-9777-837c85f956fa", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ba908c-5acd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779997602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997602, "uuid": "995d9253-891f-48b3-8037-1b5f5ba2b082", "comment": "Malware payload (Mirai)", "value": "4b6c14011d3f93fafc9512ec60dd0f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997602, "uuid": "0126a4f0-a751-4036-a150-ac0210d1a267", "comment": "Malware payload (Mirai)", "value": "c609f236a30cd21efa650697125bc71481a5b93846f79497e709c6c99c03a9c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997602, "uuid": "67f484c2-9ae6-4379-a6af-9a60e853a698", "comment": "Malware payload (Mirai)", "value": "4cfcd7e447d9655d5d071495b72d7d050dae580f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997602, "uuid": "dc47b85e-ba2e-461b-8dd7-2dae2972661c", "comment": "Malware payload (Mirai)", "value": "3c5ef417f0acb0de4a29c38fae7eb944afa816f439252b3524eee76d249fa769eb685569e2075007c167619a5c76dddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997602, "uuid": "5d842b60-cdf0-4347-873c-11cb5cf99a20", "value": "T154C31649FD416F11D9D635FEFA4E028933530BACE3FE7101AA245B2523CAA6B0F76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997602, "uuid": "0a8805ad-240e-42e9-ae32-700dc9c3d6ba", "value": "3072:X+N5L/TLAUbylNJy4yaYtP/3Uk2wHDCZcyXlgp4lv+:o5bHyl3ByaYd/3Uk2cKc4ap4lv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779997602, "uuid": "9bd27b60-cbce-43b3-8b25-fa5cfcf936de", "value": 125272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779997602, "uuid": "2fc1b72a-6ba4-44b4-921e-0539d50d3998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997602, "uuid": "708128bc-bb5a-43c9-834e-1df793b420e9", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb09d6e-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "b60e2d8b-7c9b-481b-b356-9fe6f4b17cf6", "comment": "Malware payload (Mirai)", "value": "ee963e12cd390188ed67ea9461f7ae6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "847aea54-3f28-4b50-9e3a-581fdb71cba3", "comment": "Malware payload (Mirai)", "value": "c60d87a7faa6031624cc85502b5cb610f9b57fa25db693f4efd5514fa71e9570", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "70605bfc-6569-4752-81ad-b8d18520d510", "comment": "Malware payload (Mirai)", "value": "6c47fbc3a5808e86e7f6226ddfe5d79cfbfcc32c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970960, "uuid": "46073b88-c2fd-4198-877f-a88b3674f61b", "comment": "Malware payload (Mirai)", "value": "d4ad6c66665b67a9d14bccb6045fc712995996cf8229844ae1cce86ea936c621cef176acdff069481cc1c7963dede191", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "2d465ad0-e398-4f87-913c-808862e143e9", "value": "T1B1635A02730C0A47D1A35EB0393F17E093BFE98021E0F685695FEB4A9672E725586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "70c7f501-ef70-4cdd-ab56-3227bb21f29d", "value": "1536:hbOmh0a+cq0FbXTieIYdDghg5IpBK8IQ9MkAw9lp:lZqYbmeVCRpk8IPk1lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970960, "uuid": "1815b975-8a57-45f8-bd63-c1f3abc8e6b7", "value": 71196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970960, "uuid": "01fbada2-c707-4a7d-b02b-a2a88caca962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970960, "uuid": "8d18a313-1cbd-4f11-88a1-b97345249210", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0078e9-5abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779989541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989541, "uuid": "b327d1a0-cf90-4ea2-949c-3d2f8f27c322", "comment": "Malware payload", "value": "57c6a969bf45263388633b11d70bf258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989541, "uuid": "802c7f84-6b3c-4667-a10e-a12eb7fa49c2", "comment": "Malware payload", "value": "c64eb93f00c92ad6367df8de17e7360ba57a34a4e2a85fe7322952513daa50d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989541, "uuid": "fa8eda6c-6847-440d-a761-b2cd8041104b", "comment": "Malware payload", "value": "da0996dedbe7acdbf984e96b0ead9c2de7095704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779989541, "uuid": "0c689418-abaf-4e04-b0d1-eb27c09c420a", "comment": "Malware payload", "value": "cf632df747b70ee6a95249236fd2f5c9ac1ed6eaed626ae64ecd539c818d5b8d94465641d12b6a65e4fdfc0fcf0752aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989541, "uuid": "80c6759f-438c-48bb-8887-c4aaab382748", "value": "T1EBC58C0A7CE049EAC0AAA33289B765927B75BC450F3263C72E5073383F726E45D7A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989541, "uuid": "a2445247-a862-4a62-8cce-58d75e42e177", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989541, "uuid": "0f38a62f-5c79-4c35-9df8-f84c8a00cef8", "value": "24576:8Asp7XRFEazgp6ia607VofxRVyuZJ6NZaKk+BGmQTHpSuObTK4fnBele5yK2tFV2:8Ak7BFmp6iL07mfou33fyGhHpSLK7X72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779989541, "uuid": "25abe753-08dd-4e60-9711-06618ad8b303", "value": 2558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779989541, "uuid": "6a6c65bd-3838-4b83-afe7-4e4c0d1746bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779989541, "uuid": "495aa879-91db-40f0-b736-c36ee9acad13", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e538f762-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "3e71cf0f-d303-4424-b67d-13a2c2670709", "comment": "Malware payload (Mirai)", "value": "405e0aea2b4bac9ad56988d1b9b4abf9", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "33b78061-b0e8-4294-bcda-056fb1e8ce29", "comment": "Malware payload (Mirai)", "value": "c6829ee8f180f8759c6055033305635f51f5d50aac90a00654427fec567a32c5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "069fec4f-f90f-46fd-8fab-a0b62e34c6c1", "comment": "Malware payload (Mirai)", "value": "b0c4c7278538f54a9cd6d3f84531c4b45a79ef31", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "9f5d6ac5-1067-4a6d-a2b4-169aa6457bfa", "comment": "Malware payload (Mirai)", "value": "ecac98c1dc3f6bb4d0f0c40824ddad12ee2f982ff4b322981ce860d513873936223437384d6971bfc2052d67fdb545ce", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970520, "uuid": "00e25ebd-fbc5-47fb-ba71-28c0e52ac448", "value": "T1C55302425AB8E83ACAD2D53D0B6841F645DC5DE498D3500E43CE7DF88B06D58B7DC68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970520, "uuid": "b19fff63-988f-4d6a-99da-a1eae13d2378", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VzRVAQ+:MaHJgMo8FwOA4zUFGUO3UhbFOQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970520, "uuid": "29797d53-b7bc-43b9-81b3-50d48091e3da", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970520, "uuid": "cba5eb52-305d-475d-9363-df3440aa8435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970520, "uuid": "4d500fd7-e6ed-4ebd-8702-e05ae2e52c53", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9153081f-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969520, "uuid": "e27de402-a814-4249-8b41-0428bf29fe78", "comment": "Malware payload (Mirai)", "value": "6bd0f580b99054c790e29e9d416e33fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969520, "uuid": "3bdf3a23-eb86-4d94-9b4b-1db80f50df9b", "comment": "Malware payload (Mirai)", "value": "c7a7df46767a74d01994f2257dd6f0c7ba109d0ba45a7cb1737d49a391823bb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969520, "uuid": "ade0c463-ce1a-4e1f-b8d8-d7b95e2edfef", "comment": "Malware payload (Mirai)", "value": "758cb1e8073da174c7d26cc1cbfe7a519aa24877", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969520, "uuid": "479bbeb0-e7ea-458e-90aa-7d9cf7c62f6d", "comment": "Malware payload (Mirai)", "value": "31e8b3ff160d9c6a2209e17c9c7cb6b0b9ea0d9aef541bc4a764c11a4ec992c3622da14ba5576fbbad3989512835d626", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969520, "uuid": "d1f29249-8f1e-4a1c-9229-79fbb850ba2f", "value": "T1A2837CE1A683E8F0ED19013520BBF33B6A36D9B90178FDE3F750963294269A4714735E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969520, "uuid": "165bf401-cd07-43a1-ba74-9625a8ee7b3a", "value": "1536:D+tsAVuk23pQDqS4aTYjc6gELeSfeC5PJY+PBdAWeMY5f0n4z:KGqY3pQ2S4aTkcxZS1Y+pqp1e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969520, "uuid": "70b281f0-f156-480e-991f-82e7ffcbebad", "value": 81712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969520, "uuid": "e0d93374-239d-4240-8322-e667f11d5976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969520, "uuid": "9873af5c-caef-4026-bffe-ce5afe0723c7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6688a86-5ab6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779987648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987648, "uuid": "36691d17-f2a8-4d14-ba11-6b15cd03ae17", "comment": "Malware payload", "value": "39e3e576fa21e59efdc747b8aa011ef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987648, "uuid": "1f5f341c-85fa-4e8d-90f7-a2639fe15e0e", "comment": "Malware payload", "value": "c7c9c45bed29cc38237843bb2abd3878a4e92ca284e20a3140a5db8ed42c2e12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987648, "uuid": "2698eb58-5085-4382-8377-a3fe374e4e98", "comment": "Malware payload", "value": "c0d85eac6456d3a3391e9585915cf097fb6432dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779987648, "uuid": "e5981acd-a729-4431-8ffa-e1dbedaf73d0", "comment": "Malware payload", "value": "3a36bd2cfe7f5c1c5108a6e4134c076389dded43ee9671843623ade55ca14adf115e8eda065c00acf051d6f0632ca88e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987648, "uuid": "cd910e59-65d9-41da-8e46-a954962145be", "value": "T1DF47DF77814338E9E5B98DB4D41025426DAC388B5738A3C7BAC471E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987648, "uuid": "820f8221-d048-4066-a13c-9696e063ff1f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQc:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779987648, "uuid": "73cbb9cc-e74e-437e-a0c0-4f74827363f1", "value": 26345472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779987648, "uuid": "776321f7-d93a-4c01-b3ca-5a3853ec250f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779987648, "uuid": "aa577361-bfac-4c74-b234-71e54efc5f37", "value": "c7c9c45bed29cc38237843bb2abd3878a4e92ca284e20a3140a5db8ed42c2e12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cc54e3-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966575, "uuid": "f7796e0c-7748-4fc5-83ed-76cf0df3d95c", "comment": "Malware payload", "value": "9f55b977e0d24554fec09e52c0d3457f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966575, "uuid": "99f30cb4-41d7-4665-8b65-ce4d78146db1", "comment": "Malware payload", "value": "c82a875a0ee65d52f62cf3d5f7c7aee739d5b94e4053beb896e8796a03830674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966575, "uuid": "8f43bb0c-c161-4ede-acdd-d1cc1ef52e66", "comment": "Malware payload", "value": "1ffe8b734bcf9fc7c1cdac01b8e8ef69bc15dd48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966575, "uuid": "409517e0-52c1-48a5-85d5-f46b28c288e0", "comment": "Malware payload", "value": "4810f0d06cd37046ace9c198dccf3eb9152d5b35b182918a241c0c865469faa22b8e97bfccab866ddd04450ea611188a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966575, "uuid": "ed7681dc-d1ba-49e1-9854-e241ba4da554", "value": "T1D675024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA71F23BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966575, "uuid": "faf92a24-3269-41ae-9f37-376d0862d6f9", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966575, "uuid": "4ae99934-5e1d-4dc7-82cd-d289e4444d35", "value": "24576:wxLZKAyt5tmx1Y51t05ZtP7gQA+YXIySn46BKuK5XaMsG0TM2jlX6cL:UByHh51t0jaBm4MKuK5Xaksjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966575, "uuid": "09fd15ff-72ad-4e26-9c76-9947d69ef1b1", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966575, "uuid": "ad7f0afb-26e2-4dff-adcf-967cd8c24479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966575, "uuid": "6dde5834-6e2a-4467-890d-bc1f7e2a03dc", "value": "br.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d619f-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "f4db69b6-4893-433c-b5c1-c535789bf0b0", "comment": "Malware payload (Mirai)", "value": "c596591d65f715213a7bac0aa551fc08", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "2aa0af89-c643-430b-8a5a-e398b8735592", "comment": "Malware payload (Mirai)", "value": "c84a035cfe96ed63f2768c6f7ce1e57a10e4bb3577d1fbbfe81784b59f74aecb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "a6e73cee-edaf-407b-af7b-6bfdff677816", "comment": "Malware payload (Mirai)", "value": "ea35fd84b0b9d1012fdba115437fa22fe6230e9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "8ecce91a-7737-455b-8deb-656bc7cbbad6", "comment": "Malware payload (Mirai)", "value": "9ab122328becc6a26b20d8af882fd5f48f775b4746bf787776c038a38660af4a88a29ef9ced7339992252b2bd3808da6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "61cf110f-a8fc-4de3-98db-9260245c7739", "value": "T17BA35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "eb80f7d5-8fc7-43d5-b77c-886687220136", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8QkRa:ip3PSVWxHcqRhzhNPt8QkRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970627, "uuid": "193b7623-cba3-483d-860c-e4e43e242e4f", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970627, "uuid": "6bd1891b-a7b4-4a7e-a831-b37e23b53234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "6284fe26-d260-447f-a95a-4b723bc48296", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6927d70-5aac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779983326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983326, "uuid": "257ab1d3-fbca-4e72-9b11-c23a4617c127", "comment": "Malware payload", "value": "7996350a7f500cb5929e6d1c4cbb0d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983326, "uuid": "d31cc991-acc1-4564-9c52-452a90568397", "comment": "Malware payload", "value": "ca63429ce1111480dc2e35b5c12043e354e4f43eade12e9ef9493457ab91dc33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983326, "uuid": "1d9c8fac-6aa8-40a3-a06c-3008b72230f5", "comment": "Malware payload", "value": "c42620b73e5c80d137c46db1027a2547c6cb0ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779983326, "uuid": "5d175e17-9973-45e3-9d78-e68d68d14dd1", "comment": "Malware payload", "value": "2d28de9e571ae539b9e406b2b552a3c19eea2f6e1361e2410b69a4956644edb73c6a3311349f8964bcdc6fe5e8cdcad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983326, "uuid": "11403da2-06a7-4005-9290-cd3bcae95a9c", "value": "T130A412AE94E323BDF8FBE235B0932191F4BB349514794F2BD340E1692831D60896EF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983326, "uuid": "2b5dfdc4-8941-4298-b137-64159b00467c", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983326, "uuid": "e373bd19-d75e-46e4-9bf5-a3c74f19b833", "value": "12288:1dFKPnUwOcRV0iJ26cXnXSF3HoPgFAfmZhT:RKPUwD0CwXI3HooA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779983326, "uuid": "7ae9b3d0-9988-4fc3-af71-234131db4ece", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779983326, "uuid": "39fb9e12-754c-4818-88ec-b3bf05e92863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779983326, "uuid": "8bd72676-7ce8-4f30-b33d-6f73303093f9", "value": "sqlite.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d19280-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001091, "uuid": "0be8d9bc-0fe6-4af1-a054-6a3efcab7107", "comment": "Malware payload (Mirai)", "value": "f381ad876b0d9ca74c3d11376c135363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001091, "uuid": "698c91ca-4a01-40f3-9db3-996aec3b798d", "comment": "Malware payload (Mirai)", "value": "caac26d9bfb94a4b3216520325c096cb9651a789cbee0ab1b28fdec5cc1ad2d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001091, "uuid": "49a54d59-84b3-4b0e-b34e-6e7a9afe0312", "comment": "Malware payload (Mirai)", "value": "6529f98c234a454ad55aaed02686083b8a3d60bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001091, "uuid": "5a45e571-45cf-481f-9d57-ea995869542e", "comment": "Malware payload (Mirai)", "value": "13fa82656637803877d015bd750852f83a0a984a9c91334a5272d5f47bc877bbfc871adf86a84aa56750d2b47365472b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001091, "uuid": "2f2fad0f-8e40-45e6-8208-4fd4e39c6f75", "value": "T1BBD32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001091, "uuid": "6c11c9a5-d1f7-4b98-bb70-be3780d92a68", "value": "1536:9roGHNTUZN0MIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7/8:nmmUiCx5t26wN7lDhLvj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001091, "uuid": "0566ddc0-71bc-46c1-bf17-5acae54e2553", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001091, "uuid": "bde89869-8458-4302-81f1-d43d163934da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001091, "uuid": "0e036569-b9a7-427b-bd4b-fd7d4e3e42b7", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9ed481-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "eca3fee4-fb14-4737-96b4-ce744fb6d870", "comment": "Malware payload (Mirai)", "value": "c96a5e94793d8207a70de6972429bad8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "93a7136b-2802-48bd-8e76-18814dde2843", "comment": "Malware payload (Mirai)", "value": "cb4e37e4968d119650a75643fcb83f24f4e27fc06818f0a413bc693a5a1cab9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "e49b6df0-b645-4994-9563-80c3d5229860", "comment": "Malware payload (Mirai)", "value": "d4b2c7518e5d76a4f27d5feb39861717058e89fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969539, "uuid": "66c2580e-eb3f-4971-a1b5-fb5b746df14b", "comment": "Malware payload (Mirai)", "value": "91be17d831cb2442bbef5896f96ed06284f503f1397ac7536248f1e2d806528e81cc8109ab5e5daa5d819b3b9684933f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "3d479a07-64f3-425e-bf95-98d1c3dd1454", "value": "T166932A86BCC1C611C5E1A1B6FF1FA1CD371643A8E3E6B107DD18AB29674B8670E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "823593eb-26a3-46a6-9b28-eec1a74fdebf", "value": "1536:BdBdeyd1B2X6D9BIrITus+rqVoJt8g8G6NBRii0TE/:rBd5z2qR5iBrq2JtkBRivI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969539, "uuid": "89a66ff9-45fa-48e9-a382-4f79b2bf6ef5", "value": 92912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969539, "uuid": "797ba5bd-261a-4665-a84f-32864087f6d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969539, "uuid": "9553052e-4928-44c8-8849-8cbd96ccd318", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1083d920-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001087, "uuid": "c58e3508-49a2-400e-b9dd-339ed6d30eda", "comment": "Malware payload (Mirai)", "value": "7af8370c6fae1471b87081eb6a8a3b25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001087, "uuid": "1dbe107a-beef-42d1-a462-8bb7342e6ddf", "comment": "Malware payload (Mirai)", "value": "cb58e148a7fe8abe5710e3bfaa8f7f6704d5d19e9d022914640d8b2f611c2ada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001087, "uuid": "4ab341e8-b48c-4d6c-a06d-e5aabd618580", "comment": "Malware payload (Mirai)", "value": "e10ec23e577b9244b15a85bb94e17c8ae8872ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001087, "uuid": "b215af8b-86bc-4caa-b67f-22ba6795743f", "comment": "Malware payload (Mirai)", "value": "e57f8897539113f4b08876fad881437b61457d6048a525228c89120bb6b8dfd1115b55f813f91d426d47db815d841afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001087, "uuid": "a192d752-cf9e-452d-b6c0-b6d7d3edcd26", "value": "T180E329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001087, "uuid": "cf3eeb41-7d48-44c4-b090-dcb558120183", "value": "3072:KmzTDH86Jn78rCdV5jAti2id2ow9+aVvjbitLLxGyMYE4j:K2TDH86J5fjAtiHde9+3L4yMP4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001087, "uuid": "979a19a8-ea9d-4d78-8300-5f59d44b4643", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001087, "uuid": "b5029eac-c00a-4ba1-a06f-d5bfecedd7ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001087, "uuid": "a71e7b7d-5c04-4e1f-9eb7-0d5c232f8d7a", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26302054-5a3b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934551, "uuid": "21863bc1-56ba-46a4-8eeb-163b1eb48acd", "comment": "Malware payload (Mirai)", "value": "9bcf776cfaa0babb0bd59373cc5445fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934551, "uuid": "f2c2d2e6-f410-435f-97f3-c18fe8c857c0", "comment": "Malware payload (Mirai)", "value": "cd6390f302128eabab87e1ad144d84344e016facf335e1f2fe7124d1b7c498f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934551, "uuid": "b8de4955-5fd5-40c4-aab2-9824f784f317", "comment": "Malware payload (Mirai)", "value": "f8ee930ec799f2a3c57ab8d48b2cc4e1dfa9f5f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934551, "uuid": "a3b0fbb6-14b0-4305-bf17-551b39851f5e", "comment": "Malware payload (Mirai)", "value": "7a948465153849f9144e89192072934e507fc0e6774d4837189250c52f12fb5bf44939d07b85706cf34c1a1e7b182b21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934551, "uuid": "e48485dc-bcb2-45e3-a270-cd386a835267", "value": "T15B4302DADBDCFC87CC0904FB468D6E6D2E84B0E16BAB1D4E93224CC85B40D4FE609665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934551, "uuid": "4c81e157-18c8-4a7c-ba98-831786b87df9", "value": "1536:EEuqtGS/NWSMH0OYwNBqtCc9Asi3Sb/t4gIC:zlGkNWSMHnOs+bDIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934551, "uuid": "de4d99da-5ff3-464d-ba6e-f833a8aa46f7", "value": 60016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934551, "uuid": "0365794c-0e67-4f72-aa45-b81f334b3648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934551, "uuid": "10aa79ae-7bd7-4417-806a-c7f2dabd6b38", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d7f20b-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969075, "uuid": "97c13c83-1b9f-48ad-9052-8a39b37522e1", "comment": "Malware payload (Mirai)", "value": "5a441d3efc9dcb434007b7da3d1c2c53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969075, "uuid": "aa96026d-4754-43e9-8595-cf229ed28a00", "comment": "Malware payload (Mirai)", "value": "cdee47fa0f31be2ad7aa45617ed87d77628a4274ad04795d7ba0d05d88078957", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969075, "uuid": "a04e7124-19e3-411b-81f3-c75135c36287", "comment": "Malware payload (Mirai)", "value": "4820e1783afa6e0d49b5725aba6c0054cbe35bb1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969075, "uuid": "bfbb831c-3079-46c2-a07e-b27c275d39dd", "comment": "Malware payload (Mirai)", "value": "fe66d44fef54d98187a51cbfbe84011ca83244ed96c98422eea3679dab3ea41a56da8caae7f67fc8b94eeb77ee6f1682", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969075, "uuid": "5c444e15-9278-4158-b4ae-3d03acab54b3", "value": "T142C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969075, "uuid": "69dbb7c6-ddb7-49fb-868b-e1eb28aa777d", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPjO:LzhWutxBaORaebXQd+mzBzlkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969075, "uuid": "5350c1e1-28bf-44dc-8831-5bdfc9061c3c", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969075, "uuid": "a84eccac-2d36-4efc-b338-34524afe2393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969075, "uuid": "6f03ae88-bbcd-4a7e-94d5-cde347009552", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe4e1c9-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970940, "uuid": "2f8761de-5df4-463e-a501-ac4b68157341", "comment": "Malware payload (Mirai)", "value": "f38fe749c8322889cd560bf4062a460a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970940, "uuid": "f79fafec-a368-4f4a-bb39-a996c01f788a", "comment": "Malware payload (Mirai)", "value": "cf57ab1b7638566c505bd9a41acc00688c3fe3078f715dd27a9ab186051bb800", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970940, "uuid": "fc75e39b-9838-4cdd-8f08-885c1526c95e", "comment": "Malware payload (Mirai)", "value": "3a8324b9cbe2f6b080943fff0fa12008ab1d398a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970940, "uuid": "eae01099-306f-41ff-a7c1-114bd5501c28", "comment": "Malware payload (Mirai)", "value": "d9de81b92773d6016cc7b984d683b127260f7b0c7ca03344ee8aceff729dc8490fdf3b373528e9e91790da2145050d06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970940, "uuid": "989afbd1-058d-4630-8dae-5887d95a1143", "value": "T19A633A11ED391D2BC5D0727A55E34930F5B6436D2ABC8A4E7EA32D5CEE04210313FAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970940, "uuid": "1fbfb822-1d31-4bcb-8c9b-e5580f9c2a61", "value": "768:lPom4dv34b7jGyutQCkhoWOyfHXGq0+wDLp5w7EMHWWnup6/qO+hjIpN:lPoQbHGztMdv29+wDLp58WSQq4hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970940, "uuid": "163a6cb9-a7c8-4746-af93-591583848e26", "value": 69356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970940, "uuid": "babae6c6-a608-400f-a4cc-6320772c48a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970940, "uuid": "972735df-5f86-4ada-a1d2-ae8b60253395", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e234ca-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970524, "uuid": "61403b01-bb1c-4a8d-931d-6e014366f2df", "comment": "Malware payload (Mirai)", "value": "d574545c6faace5dfa8d93b3dcadf76f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970524, "uuid": "0ee147bf-767c-46b5-9057-c30865441312", "comment": "Malware payload (Mirai)", "value": "cfab92d4575a7dc7bab0a26e68c0003d356e4f588427220d96b5fe50dcf2d158", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970524, "uuid": "1878ff96-3808-4ba7-970b-32118605b6a0", "comment": "Malware payload (Mirai)", "value": "16a511c84656e1051edad0decb669594e1149603", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970524, "uuid": "33d8e131-e8c6-4bfa-b582-fdd55d043fcd", "comment": "Malware payload (Mirai)", "value": "9fe14b480cb98d5ebc09169584aca979fe1b6c16060c7f46441da85289c75ab9018285a6090233e0ff3d83ba543e035f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970524, "uuid": "c4303fb4-f2ff-4a52-8602-9bf2bb62a2ab", "value": "T19CC3E185BB6369D1C1A342BDA4C01AC387916E318FA313080699F674387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970524, "uuid": "f828628c-308f-4219-9ea0-8be0a8ca8c02", "value": "3072:OBb4K+nqsnSjZldbaUXGSgqTWo1OWqEwztlMMTnC:0OCDjXG9qTWywxlxTnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970524, "uuid": "4dacafe4-3e11-452b-9634-a53bbe3e0597", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970524, "uuid": "7ed6587a-8983-4830-8eaf-d04d6c0f73ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970524, "uuid": "6515a85d-14be-4ccb-9953-ab43c90cb69a", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe8861e-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000307, "uuid": "62f02c80-c219-4be6-942c-d2be17971efd", "comment": "Malware payload", "value": "01c4b08a1e87a74d47e519afd1e7f61e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000307, "uuid": "6849296f-875f-4fc2-bef9-a4a75633382c", "comment": "Malware payload", "value": "d02b9d4d13df17ee401069adca3f51cc9f53af1ae78f1c6569bfa82230460bf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000307, "uuid": "bd8d8e58-444c-4e11-869d-ae05aa1df409", "comment": "Malware payload", "value": "8c3f3710dfad6b9752396ef3971460c1c94021cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000307, "uuid": "671e22f5-1c87-4ce5-b8b2-15a1e72bf979", "comment": "Malware payload", "value": "00ebe953ed15e4d889d93982d7a85a6de332e9339cddf7fe98b5c3dcadc10a0f40107f5ed7e287caec30e189d3de4918", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000307, "uuid": "8ee9e768-d20d-47cc-ab42-ac21e6859473", "value": "T131A533C030B46D816A2F36F6E0F7A4F06A4BD1B46363A2E7EAE4E3C51440787F959E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000307, "uuid": "e47a0750-1d22-4972-b897-f75f8001ed90", "value": "49152:hPztG6fu8gqb3GgMQI0ZaWrOqO5esxqqTKlL7mMS6P:hY+WgM/+XOqfqTW3/S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000307, "uuid": "ab2e35c7-e2b8-4c6f-b28f-1eccda85e335", "value": 2189428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000307, "uuid": "36cbb8f7-912a-4ee0-b92a-3103393763e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000307, "uuid": "97722947-9d32-4ca2-9146-2df6fa18a025", "value": "vulcan_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2294fdea-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970623, "uuid": "ea14be42-af0d-4457-84bc-f9ddde622126", "comment": "Malware payload (Mirai)", "value": "a75aa52307b991c68f0baefeefa4e5e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970623, "uuid": "5683287b-c92f-4ab7-be95-0cc2eb9acab0", "comment": "Malware payload (Mirai)", "value": "d1c14f3f79eff7c56c20b95a861253e5690e7e801daaed175ee2584edea3f40e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970623, "uuid": "d3edd3ac-e135-442a-9a8e-21e2cb97ae12", "comment": "Malware payload (Mirai)", "value": "23ca0993a2c6e863ab5d502db85ba9668ed859be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970623, "uuid": "1ee9a6a0-0e9b-404a-a00e-72aa8e44ab9e", "comment": "Malware payload (Mirai)", "value": "f357d920b93d816123d8a777c9cf2d61784391fef3d8d18cac6febc9967a56f85728e7d929b3b6973225d8ac90ff218a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970623, "uuid": "93fc53a9-c49d-4839-afda-f4ce8eb86d44", "value": "T1AE932894BC419A17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970623, "uuid": "470f90c4-ad07-45de-abe1-a073b3120775", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2y:AGUJtkyYEETn0T32TDBf0ns9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970623, "uuid": "7b6249da-2166-4661-ae6b-7184628fda89", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970623, "uuid": "faac35d3-4e2d-46c5-85dd-732883a987ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970623, "uuid": "e87d3f00-7ff5-45b1-a4a6-db3a1d1fff77", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fde3acb-5a63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779951801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951801, "uuid": "a0f9179d-a75b-4d4e-b9a8-46b7159d952a", "comment": "Malware payload (Mirai)", "value": "fffca744772d584c6f791e704a6bbef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951801, "uuid": "baf85223-ce60-41ab-9bde-269e904e87b0", "comment": "Malware payload (Mirai)", "value": "d2125a6addf9f4b0b69049383985f940bcb60556d4ef76ab58242dbc7dfe76da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951801, "uuid": "9e2fe3cd-e78a-4e3b-9aee-76d9919efbfd", "comment": "Malware payload (Mirai)", "value": "fa923d4d5a9646ceb7922befeef1fea0597d45cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951801, "uuid": "eb1a1589-4255-4a20-92bb-19de79a99bf7", "comment": "Malware payload (Mirai)", "value": "fe8346de95b7028d63f0e883e35dc35cef948d49ef1fea83ff8d32cfa4efa8aef158aea1e0c9af69becff90bf89e54ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951801, "uuid": "c08a20d8-5a12-4bfb-8018-cd824fb345b4", "value": "T115D35AC6F400CE7DF84BCAB741236909B121D36165931B26B76BBD63BC321E8995BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951801, "uuid": "13fbf7c4-ecbc-4bb7-8960-84e58dae3f39", "value": "3072:kjzjagLd9itb7w5Fb4lg+XKK5DQzFORIXuXxA5PqBKjryk1ayg/jvZE:kjztLd9kHw5Z4G+XV5DQz8RIX3CsjGk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951801, "uuid": "2dd97b55-966f-4787-843d-9e4b17ec9182", "value": 136116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951801, "uuid": "7d229f3b-19d1-4851-9528-19890d2e6ccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951801, "uuid": "5bccfa07-d607-43e8-9c58-c7cd010a1f1c", "value": "023782pler.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b01f9fe-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779953484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953484, "uuid": "c9db0def-0b77-48c9-9b28-928928bb7fa9", "comment": "Malware payload (AgentTesla)", "value": "d6ca7f30874671efd9cf5a9868f6d204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953484, "uuid": "c95a5951-f83b-45d8-85ec-370be01658e1", "comment": "Malware payload (AgentTesla)", "value": "d212b7434d098b644d7f233d8aa666baf1444b9505171cecd09ab7b0fe9319e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953484, "uuid": "c40d356f-042e-45d6-8e0e-a15976f922d1", "comment": "Malware payload (AgentTesla)", "value": "dccc8e0e2d54d13a0b0c415443ccc99e215efa2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953484, "uuid": "6d46ceae-62ec-4f01-a2e8-bb70b1f4f845", "comment": "Malware payload (AgentTesla)", "value": "db53d8cfbf14d7627635ad5adbc703674dcd609357024f7932a978e8b4f6a269376f3834e8fbedc88f7f234ec92cc590", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953484, "uuid": "8a449695-8978-4ea6-a80e-15301f2fb9c5", "value": "T176354029DBD9000DB0B29B14ADB5401FA86B7F56253DC94F11C9128F4F73A4CABAD72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953484, "uuid": "719b8140-26ed-4ef0-83b3-c94ad40d6296", "value": "6144:sSnJunnXL5g6z6LvCwsiPl3N8gNhC+4o2QVi/yKM2slTmjhb5Blos3Alq12f1M:EnnXLBz66i3vzpV/K9slSjtPBKq8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953484, "uuid": "d5ba2ad3-0ef7-41ae-8f08-19e9482ebae7", "value": 1090208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953484, "uuid": "23c30195-f236-4919-b3eb-935387890800", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953484, "uuid": "0d0e6e97-5438-49c6-bd9d-ed371a95fdd5", "value": "Purchase Order P1040885.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24712500-5acd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779997255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997255, "uuid": "ed83f140-e7ab-4101-b911-ca4e2c0af0f8", "comment": "Malware payload (Mirai)", "value": "a3af44927cd64801461310e4cc4047f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997255, "uuid": "d4c73c07-53c7-48ad-9eff-4eeb4688594b", "comment": "Malware payload (Mirai)", "value": "d3b4d99235cef2c2b41fd7f08f94f99994515c143424b8c24f1a4bbed563f8ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997255, "uuid": "641bff0c-56d9-4b8b-a3f9-a87459533944", "comment": "Malware payload (Mirai)", "value": "794ef45d98846a0350217a825e11e89e80f6410d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997255, "uuid": "cd188b06-798d-4051-b3bf-a25ed98b383b", "comment": "Malware payload (Mirai)", "value": "d2ae673b0b0c7e1941e21fc5f6823f9b3d8bbf7e4712826efa00f1e5c973cdea1862e8e88904a80f8ffe76b47b8fe081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997255, "uuid": "8e99f775-29df-4964-b250-a4fccdeef781", "value": "T1BBF31945FC914F23C6D622BBFB5D428D372A17E9D2EA72039D255F20378685B0E3A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997255, "uuid": "4d8dfe6d-36c7-4512-8219-2e28f0ca64d6", "value": "3072:OP++NurnDqjw1ZiQMO4Wg1/M4YaIHIV9thplVgzB+cSm:OPUIwLi3tR1/M4YxHITth3Vgl+cSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779997255, "uuid": "97aa4066-e180-4135-8b5f-77c93951a510", "value": 161888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779997255, "uuid": "9fa96e9d-f31a-47c1-8030-f856fae8f727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997255, "uuid": "c0138044-79f1-47f8-8323-a35fcb7a9a9f", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f009ad14-5a36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932742, "uuid": "c7fe0507-5958-4387-a79b-aafa438477b9", "comment": "Malware payload (Mirai)", "value": "fa977eadb4170b2cd19b9db58f0c378a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932742, "uuid": "ea09abe7-97d4-43af-9778-97eb6d5a3860", "comment": "Malware payload (Mirai)", "value": "d45a7186477faeadb280da9d1745753a0cabf8d6342b0922d0c4bdd1e4416647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932742, "uuid": "56bb42e3-b0d8-42f2-8bf0-2d01104e7339", "comment": "Malware payload (Mirai)", "value": "4aae8ea2e23314e992a761557412ecfa24c0c663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932742, "uuid": "19b3bcb5-3920-4490-a171-21cdf2b1eeeb", "comment": "Malware payload (Mirai)", "value": "8870897ac8163d3b075b6fcbc90caf8d29b08c832c1e3d3959bc73366201cc3d869e0ab4eba4236dac819ba8d9c46b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932742, "uuid": "9411bd5e-7e7a-4805-8dd4-b36e1a56d817", "value": "T109C36BC1E783D0F5DC1646B130B7BB369972D53E113AEA83E7B89C3169119C2942B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932742, "uuid": "b30f9a72-d1ff-43c4-af1d-c6b811d217c5", "value": "3072:e1ZiJbtnCA0wEEG81JT8ZGtR9pcQ93q/e:qA0z81F8o8QU/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932742, "uuid": "ffcbf18d-ad10-45da-9dd8-e526e69d4307", "value": 120148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932742, "uuid": "c5125aca-b7c1-4384-aa10-a43224eb7b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932742, "uuid": "9efadb9a-7962-4f8c-af96-0b8efa38fb0e", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857cf797-5a93-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779972507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972507, "uuid": "6df73a5b-7cc2-436b-927e-155fbe52d302", "comment": "Malware payload (Mirai)", "value": "551bf14acd00d92b8679616165d0d198", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972507, "uuid": "f45a5bce-4375-4172-a767-4411f3e9492d", "comment": "Malware payload (Mirai)", "value": "d4b4cc91f38ff54495bb6e92e8042d9147b50246eabe9e5ad1d5cd42593f2cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972507, "uuid": "08222e01-25dc-4846-98d7-29d9f5490dab", "comment": "Malware payload (Mirai)", "value": "6cfeec42e56f4f5a09ab8018ee8306cae46b7441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779972507, "uuid": "57eb575a-0f1b-47a5-8ba5-407951742296", "comment": "Malware payload (Mirai)", "value": "9af17ef4a43e329b5cd94d0eaf35501eb2ada466fc87bf221c953f094f971e32858640e6d2146b9f86818b63a723daed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972507, "uuid": "3034692a-d180-46c4-9a4e-5e1a09609a8f", "value": "T1C4C3F90ABF711EFBD4AFCE3345A94709299D560621B93F397A74D818F24A18F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972507, "uuid": "dfec5bce-90fa-405e-9be2-471180c72044", "value": "1536:I1M2cYMBlxAN9bwBm4hoouO8xxxQS9oj4dDb8HMr5fMoO95aqyhAexWPdA2XQ+7O:IyrxhoouOEX47TTeHTnZhD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779972507, "uuid": "eda1a1f8-7d88-4063-835f-4414f04790d2", "value": 118228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779972507, "uuid": "725386da-8012-4ec6-ba49-7924baf8c80f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779972507, "uuid": "85025f20-bea5-48ba-aad4-32e3f933ab15", "value": "SecuriteInfo.com.Linux.Mirai.9853.32394.32433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a978190a-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966554, "uuid": "b48e728c-a250-4cb7-9c8e-c1d35d52e59e", "comment": "Malware payload", "value": "b593307231eb56b7ffc0c41715e427dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966554, "uuid": "4b1114f6-6076-4d49-93f8-86e25545eb52", "comment": "Malware payload", "value": "d5d1888adc5de0a55f8f591960d0bbdde79df2f6b2260c15191d4ff85c02e971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966554, "uuid": "0b7e0339-196b-4064-8fdb-0ea35f46fd38", "comment": "Malware payload", "value": "e8bbf99e66bd12a2b848a23bed9d2fbe46900eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966554, "uuid": "0a9e4827-5652-4987-9676-33d38d7cc52d", "comment": "Malware payload", "value": "168d35db88e4f6f54608d2c39e3eb0e1e21fd0c3a93450ab40875578580a5ba14b3733d58f3a07359348b18564f16aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966554, "uuid": "9fcb5aaa-e91e-4e54-80ee-36e3b276f0d7", "value": "T1FC75024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA71F23BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966554, "uuid": "92be491b-7cb2-4163-8c31-b6b39bbafa1d", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966554, "uuid": "c118a90f-cafb-42d5-a426-d9ef185572d2", "value": "24576:q2LZKAyg5tmx1Y51t05ZtP7gQA+YXIySn46BKuKXXaMsG0TM2jlX6cL:tBymh51t0jaBm4MKuKXXaksjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966554, "uuid": "54a68815-5574-411c-b797-27c35c231dc7", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966554, "uuid": "bdeb82ed-fc40-4523-8a1a-6a29e87e8134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966554, "uuid": "cb4cece9-76ef-4ba6-aeb9-a6807bb74af7", "value": "sno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647caf8f-5a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934226, "uuid": "3909a0e7-1318-408a-a4ba-cdc4739e7bae", "comment": "Malware payload (Mirai)", "value": "f1967a57c05ec9dfa8e8373b436bfbc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934226, "uuid": "ad356327-e876-4871-a858-c8aca54bc003", "comment": "Malware payload (Mirai)", "value": "d5dac9061a40867ff4142f4b503610dd62cdff6913c84c4b307688d99837812b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934226, "uuid": "e4e7ff14-3a54-4f39-b0bb-0d45c345be16", "comment": "Malware payload (Mirai)", "value": "a597eab434eaaf43372afbff4451f51e76830cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934226, "uuid": "4af6d1c6-e51e-4fe5-96c2-8cf70aa6d6fe", "comment": "Malware payload (Mirai)", "value": "cd4ff4da54bd23cfea600d834d16f14f847ca1080ebc254bded16dcd9d6412dbc59c2994d26ddcaae1adc99d19dbebdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934226, "uuid": "5fea9612-11b9-4b96-bc11-d6f9330c2a92", "value": "T13AC66DA5FC1D6462D7CA7930AF6553953238BC049F42C7136A18BB3CE9F2B958F131A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934226, "uuid": "c118d146-7468-4e93-862a-5e06caa8c40c", "value": "196608:OzQL0O81Hp+ZRwPcGHlf7++91nz+SGsUpf8ug:GQLMHp+ZRwPcGHlf7++91nz+SGssfbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934226, "uuid": "b49f1a0e-c426-47ca-97c1-a978747718db", "value": 11862178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934226, "uuid": "35c33604-c36e-4405-821e-2711878678e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934226, "uuid": "744ac6a3-bd0c-461c-b36b-cdf71b7b7623", "value": "wife.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a97e7e8-5a65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779952544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952544, "uuid": "a1cada17-8194-40fb-b780-d4dccacec8f4", "comment": "Malware payload (Mirai)", "value": "6c1a23e3b35bd82dfdef9e560969e687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952544, "uuid": "2a6f21b2-f0a1-4fce-8ee1-76f5b748be21", "comment": "Malware payload (Mirai)", "value": "d64768a70daa96e9d1c81f2e341df402637be8eb93660c79ca3a9cd148001736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952544, "uuid": "69110f23-2eb1-4902-840e-a4d96a6e66b2", "comment": "Malware payload (Mirai)", "value": "0daa1fc499ca465bd9f849de39ad217adb0154ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779952544, "uuid": "479facea-62c5-45cf-8e5a-a8b21ee1dd55", "comment": "Malware payload (Mirai)", "value": "598e6b87adcf28e600f81f89e331a93ac7437e49538ca564fba4474379bd3e1d298fb606e8e06f2ffdf4a917187acaa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952544, "uuid": "0e5f344e-1ca2-4a36-9a1a-c1e7f5a28684", "value": "T1AE33F1629654D704E5587139FEEEFCC65A00962DA14071B2F1D090D72EAEFB22C3A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952544, "uuid": "f59b5415-981c-4335-9c54-431a2aeeb3ac", "value": "1536:fKrQ38PVebVlvvvVVMJxCgNPwwmCQTnouy8GyO:fKrQsPVElntSrCgNRmCQrouty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779952544, "uuid": "93be9fe2-49e8-425e-a617-015f58747b6c", "value": 54244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779952544, "uuid": "8001ded9-147e-4e03-80b8-2e76c8ce7ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779952544, "uuid": "7b2062e6-366f-49b5-8845-3a5e85c172b4", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84e9961-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932273, "uuid": "00271ac8-0da2-4317-b940-4ab6544bcab4", "comment": "Malware payload (Mirai)", "value": "0cb049285c0aeb0b419d975e5897d384", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932273, "uuid": "e2a2208c-514b-4cee-82c8-ec19ffe72c5c", "comment": "Malware payload (Mirai)", "value": "d6714f23e4e9e9eaedc6295af9face10921c8cc2da8f8fcfd71b98fea4a5a6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932273, "uuid": "12238281-6713-4cc1-ab49-0baf25053932", "comment": "Malware payload (Mirai)", "value": "1d2b404ebd1f373ee5bf69c618f1099be1b2da47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932273, "uuid": "c6a8f046-3b18-4ee5-ac07-27c1881c0d47", "comment": "Malware payload (Mirai)", "value": "df15a01eac815b2822eeb11c8acbaa685aa35ce13d23251a7dbadd4e64b11a58ae4663be932027715a1e4a904bf1bc5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932273, "uuid": "5222de7d-4aa4-4488-8f79-99bf3dbedc25", "value": "T12DF2F23056A96A60C6241835DF7ACB028AD999FCD181B9323991FA5D9BC7168F2E00DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932273, "uuid": "d10b0242-b2f4-4b19-904f-54a9ab85a9b8", "value": "768:XawsHSeDI64nIS2i9lCXjDAU77KxzGwTSmQfjNpJu9Rq3s3Uoz9b:qtVI64IkCTDL7LjmgjNpJO1zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932273, "uuid": "2b1da188-1786-4b22-b10a-0fa32822f468", "value": 36856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932273, "uuid": "b26df2b5-fc0d-4c25-915f-c088b9ebe3db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932273, "uuid": "f7e5a2e9-e03a-411c-af20-7ff11ddd6efb", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c2f05b-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "36596669-a565-42d6-bc99-dc97a7e4d68b", "comment": "Malware payload (Mirai)", "value": "c6ff99c36f662af90231db7ac147ecdd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "a817b32c-3195-45a0-8130-eecd89954a6f", "comment": "Malware payload (Mirai)", "value": "d674e4b7e57364e90ee736f6d4341d1347abe158297b0c21972ac87fafd64311", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "80371a8f-665f-45c4-a78d-b33e0dec4ce7", "comment": "Malware payload (Mirai)", "value": "1d902fcc27d421beb4a74a0671e4c07d8021b6ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "f5a4316d-f43c-4d14-9c7c-5bfc94fd8577", "comment": "Malware payload (Mirai)", "value": "9d392f8aa14e4a5e12d8d6473d47baa3d13cb5d49baebea152e8ee7fb4a3b6921b36d2d8260c43a1ba6a045db5a6ca97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "d58ec28d-815d-4c41-b297-fdaed947550c", "value": "T115A33A11EC751837C5C0713B51E34631F5B643A92A7C9A5E7EA31D9CEF18720323BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "8eb5798a-9f22-4ed5-a238-0aa80ecc5ab5", "value": "1536:hvPSRQZbKRrPnsqsYAOI8GkeNung5Dfzlc7+0NW1qI/MpHvM:RPzmrPzRlNB90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969546, "uuid": "947d2b0d-ca85-4939-9073-cccd5b3182e0", "value": 99980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969546, "uuid": "f2603a9b-2fa0-4565-85d5-13c2ca0e1221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "e77d8b09-9ada-41ed-a7d9-8839c448fb4a", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a108678-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "825aeca7-0d32-4f8f-8a66-8f4e241d0bd9", "comment": "Malware payload (Mirai)", "value": "81949dc4d077f71c35b0be1fb18fc090", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "d268c3b4-5de9-4db5-afa4-4de588e6e3ca", "comment": "Malware payload (Mirai)", "value": "d6b8645650a20205f76c5c8147535572a7e25f3229c6dfe792b2261bccfec3a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "ca7d680d-6697-40a1-8e5d-26357e84b7b3", "comment": "Malware payload (Mirai)", "value": "6fb57a8f3f956f41110faafccbda4033c89a9b77", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970635, "uuid": "59272810-f19b-47e4-902e-ad2abafe280f", "comment": "Malware payload (Mirai)", "value": "ea8446a32f28df5366619871ee06ce19026c96b7831e4a95b62f3433b00f11ac03a78975bf58ed922d85c7cf39d3bc9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970635, "uuid": "adc4403e-1aba-4287-ba65-1af9dcca0473", "value": "T19E635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970635, "uuid": "38d3567c-845a-4287-be9c-d4dc784526c8", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnP8:zGYxpTGASC4XTfyyLpIoYPsP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970635, "uuid": "0f9c73c0-de61-46a6-9eb8-970b564df10c", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970635, "uuid": "45cbc0cc-29c3-46d7-b675-b3e7a3be2f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970635, "uuid": "af0a904e-1eb4-4a1e-99fa-4b5e13ee6f4f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9b9185-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779961946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961946, "uuid": "4ecc959f-7db8-4753-932e-cd1c5e2d3819", "comment": "Malware payload (AgentTesla)", "value": "c12435dba84e3325a9dd67b75f9cc22d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961946, "uuid": "2fc0a5e4-2b5e-410c-9488-aae6693bb9b5", "comment": "Malware payload (AgentTesla)", "value": "d702322e43f468163353b2478ec1626e569d8a33e2732e95d6d4abf2432168bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961946, "uuid": "399851fe-d2a0-41e8-a7a6-f1c5f6c39565", "comment": "Malware payload (AgentTesla)", "value": "7def7edf8234947dc40b3df169f7b66d7581e0be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961946, "uuid": "7d8fba34-8357-4666-8676-fc6516e3a464", "comment": "Malware payload (AgentTesla)", "value": "fb275494e622416f7248688fa15e905ea07daaa3391379ad70ba77dc3eb2ff6d6efd5152dde83106374f546b9a5a4710", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961946, "uuid": "ba755b8e-f9a7-4a81-8946-10404a8645ed", "value": "T12494EE3CECEA402EB1B3EE598AD47597E95FB663371E981910D203864713942FDD223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961946, "uuid": "b595bfa9-d7b4-4b78-a244-ff5d2c117630", "value": "12288:Esf1J9RIjGtVucLXlCfBUqtHT1YR9a4YsPYcVL2:E4+eq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961946, "uuid": "63ed533a-e1e7-4640-b7d8-c7551072bcc6", "value": 425370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961946, "uuid": "fbb4eab3-8327-4e51-94b0-d0252ec03794", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961946, "uuid": "61425d91-4c1e-4e88-9454-3cca181abcbc", "value": "SCANDOC275.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0646686-5ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780006053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006053, "uuid": "ed8bc1c4-8c40-4bfa-82dd-9552f3874360", "comment": "Malware payload (Mirai)", "value": "3ef6ec4305f3690f0b38e7a2c5473066", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006053, "uuid": "e8d8c146-6626-4262-84a9-242181cb1264", "comment": "Malware payload (Mirai)", "value": "d705fe10311ee4d2ef79e1708bc7b2c3da086a15c1334706b1e4ab5a2e8e7518", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006053, "uuid": "15770ebb-0e27-4ae9-8f50-e4058ea031de", "comment": "Malware payload (Mirai)", "value": "8706444c048d5fa703aad781aeaef3749057939d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006053, "uuid": "eb5f706d-fa9b-459d-ac46-aaf206ce5b57", "comment": "Malware payload (Mirai)", "value": "8f5f5cb444c10346a77fdbf64c634f1adc4f4225e17ffc50a136370c3d0db46a3f0589e93523a6458bfda724965aa726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006053, "uuid": "19c8230e-354b-47a9-bd10-4ba7b6d8b28f", "value": "T108245C46EA408E13C4D227BAB69F524933339764D3DB73069D286FB43B8769E0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006053, "uuid": "23349c50-434f-4518-9c28-2aa78b93306b", "value": "6144:aR3DFavNaWevv6SIdsptQnNpNuh9AS1zM/96Y3um:aRTFavNaWevv6SIdCKnQ1Q/IYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780006053, "uuid": "7a7f26bd-68f1-4f34-a579-b9676cf020b2", "value": 224140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780006053, "uuid": "a696a28e-96ce-412b-9fad-40d685afa106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006053, "uuid": "42e8478a-3df3-4019-a02b-758088e2d873", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeb0982-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966456, "uuid": "40d269e4-b443-4aee-8728-1b5cff2ea333", "comment": "Malware payload", "value": "75d6e5af1d40589693efaacd08a68547", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966456, "uuid": "d656e8b9-e66b-438a-b7ca-e294ec7ed202", "comment": "Malware payload", "value": "d7e1731547b64bac2b01d26df00556916cbdd236cb4bff92f5392f5d8e50cbf5", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966456, "uuid": "10396ffa-c760-4f07-8277-70df06e220b8", "comment": "Malware payload", "value": "5dc58c9655e76eb7f50a3e2487d2f6a336035c62", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966456, "uuid": "34c2bc5b-5eb7-45d7-85d3-93839bef3c84", "comment": "Malware payload", "value": "13f7c7dc8a2dcd40d2a67810982cdbaac4c8876ed8a8cc20b8198c3e22288ee95c8ab376854aa260b8c8fa8c1823920b", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966456, "uuid": "424b1b09-cdc7-45aa-ad8d-ccc607298b12", "value": "T164E533F8EBEB2C12DA2D80594686E7F405FFDD2D0EB25124714D6042FA2B9F163B8D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966456, "uuid": "5ba6e934-20d2-4a93-ac7c-f927bd1846c3", "value": "49152:2eiHCOi8a9eLHDNqRKK3VnwzTtiLUsDOI7KTlpqnOWk7XAKdvRXVUkqmAqp92+u:xiiB8ZBqRKK3VnKAozIGTlQ3k7XVFSmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966456, "uuid": "f61f9fdd-b271-4abe-a9b9-3e09f23529f6", "value": 3120836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966456, "uuid": "e40dc7fa-2ed8-4268-92e7-963dd5336625", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966456, "uuid": "bc9c7fa1-a05f-41bb-b86a-53102d1a33fb", "value": "r.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56d41bd-5a88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779967970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967970, "uuid": "24639b12-1f5e-4a33-95ac-15a4f6c7682e", "comment": "Malware payload", "value": "516fd33303d0c68e1e9f2b13696d3cc6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967970, "uuid": "bb50af68-56b0-471f-b8a9-c1c3e0e38486", "comment": "Malware payload", "value": "d85a77cdd3a1c72d51d2c55857f818d9bdabaf722b03a0b37785638906a211a2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967970, "uuid": "7bcad5df-8d78-4cbe-b730-50f729fd4e6e", "comment": "Malware payload", "value": "672575ab8b5f19495fa2230619ee2bc5f7a8b627", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967970, "uuid": "607b8191-f754-4a5b-a756-6ac389d444ea", "comment": "Malware payload", "value": "55dbfedef9900e29bb647ea99cd5ec3d4ad5011093ef9e75db9d7f8629737e3d0ca2718cde99ec98b876189ea100e4d1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967970, "uuid": "003bb589-2781-4198-9ddb-80959a672fa6", "value": "T128772325D19F02F5E58BBB38994A1213EB64F92D736161C72F9827802DD3ED45B3BB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967970, "uuid": "2079bc48-933e-42f9-95c5-032ee344c7fa", "value": "786432:lGMYDt66JOF3HUVCGMESLWfBpNym51hmYbdHcfBuMLia:lGh6R3OSWfB7yQxbafBEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779967970, "uuid": "1c08e7cd-c081-41b6-997b-95715a14f50d", "value": 34822149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779967970, "uuid": "270838f9-1e4f-4670-91ab-08a4c4b2b376", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967970, "uuid": "f23eddaa-3d11-4390-9390-8edc5c108fb6", "value": "405dcf46a668cfe2bd4401f402e7bb3dde19df3e117f45423cb26090cd3294fa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7c3468-5aed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010957, "uuid": "3660ec54-3e7a-42ae-be18-60db656062ef", "comment": "Malware payload", "value": "2bba67908c877739311d0f2f1ce733cd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010957, "uuid": "b65725a7-e4fd-41cf-9d4a-90b2eaf9f369", "comment": "Malware payload", "value": "d8f0227793cbb22d7d2ed3522ab006b9959c348db25878325dc82b7cfecdbfb1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010957, "uuid": "6d9d6792-fdeb-4e64-b3a0-fe1dbce89879", "comment": "Malware payload", "value": "3f46e760d9f4eebe02e3a8f605775c52ea502d01", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010957, "uuid": "e0dffc12-986f-4137-8a9a-3d7efddab701", "comment": "Malware payload", "value": "835c624803695044ad57a1fafc5471c7f61e46c57d5e886206fb9b34d533fcdb7281ddb5cfeaebae1cc98e43d1a3c566", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010957, "uuid": "8c0607cc-95e5-4ed1-b926-0f8457389711", "value": "T1EAE6330D76D167DADAF3803C6EA1A0E1E570381607B7C59B1BF493A05E272D08D3A7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010957, "uuid": "502e5e9a-0d03-45ed-8aac-a87fa6c2872f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010957, "uuid": "73942a46-0bb0-48d2-9f41-9810f69f48a6", "value": "393216:SkVOaVUGMIHVvWDJuvPKuXMCHWUjX0cuI3/PGTAI:SjEU2H5gA6uXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010957, "uuid": "fc0dce15-ef4b-45ba-a383-12ce2a0e2b1e", "value": 13962982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010957, "uuid": "193814e5-4441-4dc4-86a4-a2d80446bc17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010957, "uuid": "2efcc2e0-3991-423d-a126-b91fedfac6cd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe042ed-5a6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779956901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956901, "uuid": "996c1853-8e4b-4208-b27f-1ffc310c48d9", "comment": "Malware payload (Mirai)", "value": "3e589706a7d9831b24846155b15e5782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956901, "uuid": "063e53f1-df80-47a6-9db4-d03645145260", "comment": "Malware payload (Mirai)", "value": "d96035d2b1eac911d417fb4f750cf21e4695ec9cef476bf5eff94a6539060be6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956901, "uuid": "5df60731-85b5-4c39-aaf7-78c3523835a0", "comment": "Malware payload (Mirai)", "value": "d3c9eda264c0ce8cb07514002e0047f3c66df77b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956901, "uuid": "4b004d2d-0c3f-4844-ab1e-956e344abf87", "comment": "Malware payload (Mirai)", "value": "44d9b680594ca8460a8f5370d52640c2f3ce09b66876e2424c9c6d73478a445483bfb8f8c8bf8eafb9fad4968a85b0b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956901, "uuid": "890a516b-5b4b-451a-818a-52143c42b59b", "value": "T1FCD32B86F8818A21C5D512BAFA1E218D331357B8E3EE7213DE145F31278A5AF0E7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956901, "uuid": "bbd7d267-ab2f-4892-b459-2e5f5fb07b42", "value": "3072:ShoYavTBZimlF4CySrR7sTMHaXUZU3tBcN9wz1Z:koPTpsTmaQWBcQ5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956901, "uuid": "02db87cb-d6d9-4f41-a325-aba5d2daaa3a", "value": 140828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956901, "uuid": "7ea3e3c6-a0a7-4d41-bf62-c112c254d6a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956901, "uuid": "80d6a1c4-a13a-43a0-ab0e-f7ccbae807da", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee022a3c-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970535, "uuid": "241ff610-0bdb-426a-af81-0225303b53eb", "comment": "Malware payload (Mirai)", "value": "9f85560f2cfdcbd564d9a9af01c44caa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970535, "uuid": "30007048-a1d4-4f62-a7f2-99c01e2d8865", "comment": "Malware payload (Mirai)", "value": "d964a397509389e349b953e0b323322c99027f58a2680cf007b0f22a97ba5227", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970535, "uuid": "6329b390-95a8-4bda-8bc8-8c83ef95134a", "comment": "Malware payload (Mirai)", "value": "84c9db9bd8f4302750ccfa7b8358993e69a1690f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970535, "uuid": "3ab1ad66-07e3-4c61-b92e-76d378b6e091", "comment": "Malware payload (Mirai)", "value": "69d9a7b5788c37845a633dc45900e6f962e269598d06a829182b3039aff3454e682797b46d7b11291b5ce1f284a89362", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970535, "uuid": "9ce7a7e5-7237-4460-b565-62969e60abf3", "value": "T14A147120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970535, "uuid": "88bc84ec-6e32-43fc-adab-a5ed850495fa", "value": "3072:IcHZcggt1NJmeDQBwnKUDMaVsb3pjr1lCRnUKG:IcY5JpMByVs9jSmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970535, "uuid": "81de03f6-e835-4224-b22c-12d4d45e85e9", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970535, "uuid": "2cb9fadf-65b6-4615-af99-570854d533ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970535, "uuid": "d4fac374-2363-4b8c-9bda-c8dd6de70e01", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da071591-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "36ce6db8-9560-404f-9481-adb490ea10bd", "comment": "Malware payload (Mirai)", "value": "86df95436caa8169831d2868ab2d96b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "c6f7c528-8f38-440e-b219-106aa44c36c3", "comment": "Malware payload (Mirai)", "value": "d9b39614f091892aad982fdcf1a300488f09609bd937e57567c9acaa64a267e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "9829490f-c83c-4414-a52f-95542f3465dd", "comment": "Malware payload (Mirai)", "value": "0ad7295ef27004e8ffe74ea1b49dcc69d9ce9884", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973937, "uuid": "488735f0-b8e2-43c4-b88b-2fa7c03eaeb1", "comment": "Malware payload (Mirai)", "value": "247f2d028eda68f621aa4e6108d11cbd02922fa7d4c38c75660f1970cd5ba76f94d3599076ac344f964b624cec5ba0d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "977fbe0d-affc-454d-b1b5-60acda6e4942", "value": "T19FC33B06B30C0943E1673EF43B3B27E1D3EF9A8121B4E684755FAA899272D325586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "9527f9f3-46a5-478f-8db0-83b9d546e2c4", "value": "1536:P8PqhLNG0xq4asXxk77K1HkATllpHq/tQS7PFVvAWW3+xlGjuLqqehaYD6RX:P8yhLNGgGsXxpqIHpwQWiWFI6RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973937, "uuid": "e3032fec-ff6f-4b32-9136-fe1f61c7ae2d", "value": 129700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973937, "uuid": "ee9663a5-ec22-4fed-bc3c-08b37699185c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973937, "uuid": "ba6c3751-cdba-4adc-9bb4-0cebfbe11f22", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae81cce4-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779953678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "df6f81ec-d00a-4713-903c-79bae6105a95", "comment": "Malware payload (Mirai)", "value": "85a3429ad8b8a5eae6cbf5ee7932696f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "00abc86b-1692-4241-835f-6a02952ea894", "comment": "Malware payload (Mirai)", "value": "da2f1487c4e81cd7a5592dd455409bfe67cc58ef78125f1702c6fce3dbd63b49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "0b9966a9-e7d5-4514-9052-3bfe21b381ff", "comment": "Malware payload (Mirai)", "value": "7ada2c5b4eb57027a9ded709eb675bdb149a2126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "e880ec34-8e95-46da-a4d5-1bc8e961b934", "comment": "Malware payload (Mirai)", "value": "1c5237a1fd38c1374550cc63466fcd02f0a40b2d2cddf314eaf6e494029a200571dccb8d1f4e190c76e10c894bfb1eb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953678, "uuid": "e68ae72f-001e-412c-8cc2-11098399a7e4", "value": "T142C33A03768044FDC449C07457BF7A36D831F86E023A729BA7C4FE262D4DEA1266EB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953678, "uuid": "4a7f396e-5e39-4439-9b29-28f2fcc0d1b4", "value": "1536:35cxrbgs4ghSlcfIGbWqterJo37grD+glPU+6C5UWIVLtsIzNBoDPDMNih:ixrbgVCfSqtdrg+gl7/5UWIVq1DVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953678, "uuid": "e0823465-52e0-413e-8fd2-106bc2564acb", "value": 126480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953678, "uuid": "23e17266-9463-4258-8986-d3a4b4b95d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953678, "uuid": "717d06e2-faf3-4312-aad4-e8553b6c3096", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3818a24-5ac7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779994891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994891, "uuid": "c54fe0fa-0fb8-4268-aeda-165d4aac42e4", "comment": "Malware payload (Mirai)", "value": "7390505145b4b4f33efd4679df73538a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994891, "uuid": "1c7fe41e-6ec4-467b-8f77-5eb1a05ccb34", "comment": "Malware payload (Mirai)", "value": "da71f71534b57eb124c8ee4aa9e8e72a2fd2560d61dd4f4a26ad2aedf5a4296b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994891, "uuid": "0d0b4b71-33a2-41c8-b366-2f90d3262294", "comment": "Malware payload (Mirai)", "value": "9ef0c93c724e7484cfa9d2547b55c115e5a9098d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994891, "uuid": "0dcdd648-8979-4554-9be8-5772debce66d", "comment": "Malware payload (Mirai)", "value": "b4f82aaaabd10eb1d9d47c6599aae9ccc5c32d7e86fc8dd80976b981c8cfed2b79f044e23b2782076ea960f44f3249a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994891, "uuid": "f7eac430-72fd-494b-8765-2c72ef203125", "value": "T1A234F707BB958EF7C89FCE3306FA871120CEF4572564672B7234DA5CBA0A54F49938A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994891, "uuid": "bec6284c-8657-43a8-aee7-c26fae05e9a1", "value": "6144:EiMW/XgheDevftDb1eZyAHFIMZDfK/Xce:ecZDedb1eZyAHFIMZDfK/Xce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779994891, "uuid": "b2f36580-d83e-4832-ab0f-0ba24b3eb58a", "value": 248040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779994891, "uuid": "e91a0c5d-e224-483b-beef-de30a7119066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994891, "uuid": "c732f7db-5be8-4087-97f4-cb9b6bb95694", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24341b07-5a84-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779965901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965901, "uuid": "49b04515-386f-4a7a-b7d0-749177b59fa7", "comment": "Malware payload", "value": "b656d21431d0d824d1357edc9fd0d800", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965901, "uuid": "b7c0252c-d941-45af-92f9-56b2ea62e415", "comment": "Malware payload", "value": "daa51245a96b8c6f76eff9f10c6949a18026de729e0873c295410b30380ca13e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965901, "uuid": "9f30cb97-41a2-4ebd-986d-22e9d3e76312", "comment": "Malware payload", "value": "a8e12efa765356cd4150860259377ac97638761f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779965901, "uuid": "e53fd675-e307-4341-aec5-7b0d2451720f", "comment": "Malware payload", "value": "1c4f66867effabae950b5ac8e1396fd48683329ffd82501a63701e1d502b7fe993ce75596ada1d2e44c605db2f43395c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965901, "uuid": "e38f03d3-3b22-4a8d-956f-1a774dc57bfb", "value": "T19FF1C509D721969AD8AE037D89F30712C3F899834625DB6315DD806C1F83B282A673F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965901, "uuid": "db72f957-f3f5-4901-8a7a-17507c61f36a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965901, "uuid": "7cf3bc53-e48b-4166-b272-f75105499143", "value": "96:Fl8cPiWrL5gKK45/SSgErvFimFSP/jfTEy74kZQ32wQpliuxDP2FtxCzkMx8SK:YsrL5gKtaSNimFOrH74kZQFevQrRMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779965901, "uuid": "30ac2afc-4720-4a1f-a65d-f4f281b68bbd", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779965901, "uuid": "b2d81a23-26be-4738-93b3-0baa10b52562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779965901, "uuid": "d41701af-d595-42f8-b73f-f0225f03b387", "value": "daa51245a96b8c6f76eff9f10c6949a18026de729e0873c295410b30380ca13e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999effb8-5a37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779933027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933027, "uuid": "406e8a84-f01f-4303-a7ac-a59708e9af86", "comment": "Malware payload (Mirai)", "value": "dee329b49ed6233fa51183bc1d48fb81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933027, "uuid": "679087e7-98bd-4ae4-b2b1-b0fc8b4b9723", "comment": "Malware payload (Mirai)", "value": "dba2e5d15351741b46fc0f580d8bf3bbc886a48cbaf182da1351c6d01a830b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933027, "uuid": "4b4ad86b-a4eb-49fc-998f-426aa29e09cc", "comment": "Malware payload (Mirai)", "value": "b32873f0b6a9056b2c653f49ba0b2307173177dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779933027, "uuid": "d007be5c-ce46-4654-a4c1-1d164c2c052d", "comment": "Malware payload (Mirai)", "value": "21a6c386bdaa47513bfc8ebf9780147b92ef94ef2e9f02508d244b83bd48dff618887bf74d9462e76c73974e1e9627f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933027, "uuid": "f3a39e39-9c87-4172-9653-9c34e0775719", "value": "T1354302B1AEA020F4A9F44A316A6C56C325CEFFD874ECF94119279E58D8D318792F6703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933027, "uuid": "92a6fbcd-77d0-4886-94b4-1c9e6a35b3f2", "value": "1536:O9VZqsUOnmm3U0+BhBRRRuXOHjW4pDRp0KOVD8v8VrEdSJ7LD:OjZqsUVmT+F0kjW4pYndadILD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779933027, "uuid": "7cf3f12e-4361-4c65-a7ad-54010281ab91", "value": 56680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779933027, "uuid": "5610a4b1-345d-4150-af65-9ffedd4f50ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779933027, "uuid": "9701f48d-7b0f-421a-98ba-813cf397e5bc", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1866d9f9-5a34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931521, "uuid": "1b3ecef9-3807-41d0-95a0-3b536f54572a", "comment": "Malware payload (Mirai)", "value": "d2496089a9ec56b5c8990e8bfcd70c7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931521, "uuid": "e4449c94-3570-4185-817c-afbf97074392", "comment": "Malware payload (Mirai)", "value": "dd714264173294410109df8e006cbda67e807db13b27febe4a43714649ae26b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931521, "uuid": "2f9a597d-ad40-4325-b174-d2e73390b550", "comment": "Malware payload (Mirai)", "value": "da2a154016e8a561b5ad6d1dacc1c5b1a193e1fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931521, "uuid": "bf230cc9-ec1b-4098-8ef2-90949598e6a8", "comment": "Malware payload (Mirai)", "value": "2d2a2c9f7655a74400f9c71407768015c9814651b14d209e6ff536005bae8831c234dc4ceb47c0a86235ebdcdc206c98", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931521, "uuid": "391bbde9-7547-4a10-b279-fbd5959a01e2", "value": "T1265130C971B510326CB9E53272FE49447490F09728CE6E58AFF87EE4D48FD86A0D1A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931521, "uuid": "65e599f9-02fb-4c50-ae56-c622b3918671", "value": "48:ip9ANpXqpo7Yp04pSIpgTIp+OWpvapAspJGpKQp0+pgCpDypIbl:iCk4YLRoIM8Lyx5ZAWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931521, "uuid": "6e888c37-a973-4ec0-8dc7-b8777059a5fc", "value": 3079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931521, "uuid": "c30eee46-0db6-46ca-b987-bd629cb1ba7e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931521, "uuid": "6136f427-e4eb-4406-8897-7e441183a27c", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a71ed0-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974329, "uuid": "1237d3f0-d61e-4b40-b9b2-6003e9995ae3", "comment": "Malware payload (Mirai)", "value": "a546820ff817b3b28f92a8d4c90b2a6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974329, "uuid": "4af0caf9-f296-4d82-a1d7-d1ceb1464109", "comment": "Malware payload (Mirai)", "value": "de4c02280b8cdf57012be89c6df2602b4d72d31ecdbd410447c898c7926165c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974329, "uuid": "acae4962-c0af-4d5c-a965-575557c83979", "comment": "Malware payload (Mirai)", "value": "6fcd18d58e5fd0893cb5ddbde18dac99b592ab56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974329, "uuid": "f3dd98ef-70be-49fe-b4d8-acd25ca55e29", "comment": "Malware payload (Mirai)", "value": "18afce8760602aa6889cd17bfb127cf95e8f0c3f2a1490a54dff01289e1272609ea4965562ed199cb177a04a619abe3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974329, "uuid": "a9a5c110-4091-4e89-8ba1-5fdca56e04f3", "value": "T1CC632981B880AA26C7C01777FA5F118E3315A7DCE1EA73438C156FA576CAC1F0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974329, "uuid": "ee92afb9-c217-45a1-9b82-092686f6f133", "value": "768:2IcI9rYg37dZobc4PrzXsOalwkbj3ybaXvoOBVUNOKo1w5kHuLwCVy/Jx+5H8hG4:YiJ3LokOaCKXtB1uBeZWlRQCU2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974329, "uuid": "e2df9f03-594f-41ee-a3c7-47c2ff76ac0c", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974329, "uuid": "4609fa13-73b7-46c3-8583-43cfcd31467f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974329, "uuid": "ac121a99-60b9-467a-9d43-feae4edbe50b", "value": "001cf9427a1b4a59ee7a04e047928645dd21e196ab033b23c3a0b6b68cfa4c6d.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7604f0ea-5adf-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1780005122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005122, "uuid": "5974a59d-f7e5-425b-ba51-034450e3145c", "comment": "Malware payload (GCleaner)", "value": "6147533a0fe7839780885e54c35f7ea8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005122, "uuid": "445f37c2-bdbe-4664-a291-c6ca8c10fcdf", "comment": "Malware payload (GCleaner)", "value": "de601a8a3d45d818f6bd867f5bba33d576bc1d9d983511b66f2b22447dd5d8e4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005122, "uuid": "cfdefafb-dcce-4a28-9d24-dacb926ec23c", "comment": "Malware payload (GCleaner)", "value": "5a507ce98f233b07276baaa3fa3f42369bcda96d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005122, "uuid": "af96d57f-0d71-4d46-a935-77627e994456", "comment": "Malware payload (GCleaner)", "value": "b3475410b0dab2a5b4975def01ebe7c0e8faa8f38ffe5e3f72e2a71d4f3dbc5e862ec2ea36056fcb432f37683d1ffc6e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005122, "uuid": "ceccabdc-5bdc-4bc0-b08f-a87427fd2e14", "value": "T1FB2219C4635591EAE00D033ED532CD23E942F10686A1B9BF94B9D6BB9F42B83697DF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005122, "uuid": "1b2103a7-8a8a-49c8-805f-00f698531bfb", "value": "56cec9df8972d62c264a5f8ff5aa5ab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005122, "uuid": "2fb17335-46e1-4a0d-aac1-bf0eb1ab5d3d", "value": "192:yfTP0fD5ExEbGrRwpHhfSGD8OX90gRiZSJaS4n:yfTMfD5ESbGrRkHcGD5X9uMJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780005122, "uuid": "84768ee1-b326-4495-9be7-8fb98c4230ac", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780005122, "uuid": "3f532488-3492-4172-8abc-05bdcc057e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005122, "uuid": "8013eee8-e1fb-415b-8121-d928809f971f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d283298-5acc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779996893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996893, "uuid": "cb14f922-d757-45ba-b2af-c54d6dbe1035", "comment": "Malware payload", "value": "f887f8b1de58ce2575e30768495cf1d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996893, "uuid": "91d5e918-da76-4167-b5a7-b45494370aa9", "comment": "Malware payload", "value": "deb6fc9e25f9e9df3006debc6415b5a85b10b31d9233b65e0e161a370364d31d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996893, "uuid": "b1cf3371-a450-41f7-805b-c698de33c9d9", "comment": "Malware payload", "value": "0bec7c3b6b71326db6c0892de5d40f8572dc8e8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996893, "uuid": "f555ef09-72b0-4c62-a635-8550a3815ab9", "comment": "Malware payload", "value": "047d16a33cb515de30c5a95991d249581a216d1027297f2cb9c45a68f360169ae195281224efb347010e0529364a9aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996893, "uuid": "c47859ab-681b-4750-a7fd-19318a153241", "value": "T111A42A65F8819B92C6D06EBFFB6E824C33131778E3DE71129D155B3132EB85A0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996893, "uuid": "c611d831-73bf-40be-b1d9-5948badb02f9", "value": "12288:o1lEdR+QM+4NS9d0QOgaR5xXEJxOO07c9GLzr2zOWY5v879L:DSun0IILn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779996893, "uuid": "bd7622c3-773a-40bd-a851-5e4c0a470d40", "value": 460876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779996893, "uuid": "3c29d882-814e-4489-a02f-ff1d0eaa3df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996893, "uuid": "78e3d930-12f0-4fc3-afd4-166bf9ded65e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc20575-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973940, "uuid": "ea497c61-668a-4dcb-96cf-9992c0344474", "comment": "Malware payload (Mirai)", "value": "46fcdf1ea9c1f6081d75f8dba6db4260", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973940, "uuid": "9ae4d6e1-5ba1-4c7d-bc00-bb205fb1c529", "comment": "Malware payload (Mirai)", "value": "df1302c1034994d9efd381a0329dc655a3e92063b2c00f5bc9f9cf8e01a3d15a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973940, "uuid": "73906286-7077-4b85-93f4-9a60e1ad81ae", "comment": "Malware payload (Mirai)", "value": "8f9f1ab1f8a0851c54953ead734424a563645187", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973940, "uuid": "3c7cdcdd-ba6e-41cb-9d2e-d0efec3f9665", "comment": "Malware payload (Mirai)", "value": "03445350c680125be7e34ecd596e628ba6d81292f86816f7ef9720c974309508756a3344ea92f8415388cf8fc568f1eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973940, "uuid": "9d8ef56d-845b-49c4-8d7d-6d8aebe3c4c2", "value": "T128D34B1BB5C090FDC8E9C1784BEAF126DD32B8295134B21E27D4AE222F9DF206F5D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973940, "uuid": "712dc1ce-7a93-4929-bc0c-c9b9be73b660", "value": "3072:iDdFFohEplO/N1B1k/niwRmv16LzfxIE5Z:kp+zZgjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973940, "uuid": "fd4dc107-1e8b-43f8-8299-5ea71361ba10", "value": 135048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973940, "uuid": "2eee8b5a-8e82-4b81-a144-5a558ef98451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973940, "uuid": "d0411196-448f-402d-acfa-af3285123daf", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e387d98b-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970946, "uuid": "733e7e95-74b1-44a7-b7d9-adc30088b414", "comment": "Malware payload (Mirai)", "value": "1f00d12211548efcc023f7f02655a7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970946, "uuid": "bf0ed339-c572-4ed5-82da-035e675f46b7", "comment": "Malware payload (Mirai)", "value": "e03a67abec4888dee4eaceab033954ccb0a1315f78a945e6b23bef8847aa5758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970946, "uuid": "c7151c87-a1d7-45a3-b591-25ef489e5482", "comment": "Malware payload (Mirai)", "value": "10f4226be2e7637f0471ef3b8946e2ca58d42c34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970946, "uuid": "77586ed1-fe9c-496e-a510-bfdb5a05b0c3", "comment": "Malware payload (Mirai)", "value": "0f83e02bc0342851ce13868a4e29c949e85f714f9fdc0774534fe1ba441b54c7255026989f0bb1833b85b52cead7389b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970946, "uuid": "63eecbc7-267a-4674-8000-18bf8df3db2f", "value": "T1EBA31BC6BC818B11C5D165BAFE1E61CD33134BB8E3EE72138E145B2D678A86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970946, "uuid": "76852d6c-1d5b-4ea2-b3a6-0d8a951ddd5a", "value": "3072:wpkRAXjtOwMmqekE3w30CvQW4/0GlfKSlvCO4clPmH:/le3M0CvY/XlfDvCPc1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970946, "uuid": "ddf2ff11-a6eb-4967-a17a-b19c10d2e1e6", "value": 98780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970946, "uuid": "bfdff186-e6ef-4a1b-96ad-13e16440e7f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970946, "uuid": "9ac4452e-9387-4066-8723-2433430f5361", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d90f0d7-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "b04915ca-2b05-428f-8658-3ad75577a6a7", "comment": "Malware payload (Mirai)", "value": "009f14025ce0929d4091065d3d69b206", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "b2e78cec-3986-48d0-af05-067ef43ca96f", "comment": "Malware payload (Mirai)", "value": "e078d3af0b80a4aace5832555a96cc73d13aa9e121113df3ef4b80d12ea4282c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "692cdebd-c7df-4e79-a9b1-6af5bdf5c466", "comment": "Malware payload (Mirai)", "value": "fdc973f882ad8838756aece19a59c8667839ba7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969541, "uuid": "4e462f85-4cfa-4560-91b5-3e84c1169491", "comment": "Malware payload (Mirai)", "value": "ec8ce282c0842ec8846ed609f2b49261bcae4d2fabd5b3a7ad858f1c60ccd8d86935a7d2afd512997c1fafdecd70c713", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969541, "uuid": "ca58ddd9-f02b-4926-ac40-9e104e7baa2b", "value": "T187B3F70ABF711FBBD4AFCD3345A94709299D560621B93F397A74D818B24B18F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969541, "uuid": "02644773-f928-4274-96f4-c09f8cb70304", "value": "1536:XFU2MYMBlxAN9bwBmBhNtgp8x6hQS9oj4dDb8Hc45fMoO95aqyhAexGtw7sA+1Xz:XKbIhNtgp3X/1OThofQhOt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969541, "uuid": "75c5783c-4ae4-4260-a63b-09ade3c863bf", "value": 118052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969541, "uuid": "6af05c61-f702-4f3a-a712-b1ef16a57306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969541, "uuid": "481a8bd6-4231-41ab-9db7-515de2c4b789", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7555018-5a97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779974389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974389, "uuid": "f3eb32b8-69ef-4367-8b5a-a6650c87db1c", "comment": "Malware payload", "value": "e12c15a44a735975ca2d15d93cbc9c95", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974389, "uuid": "b53c77f8-ff08-4369-aefe-932eaebd1b82", "comment": "Malware payload", "value": "e14cb7f34407a042fc6a20aebd73d36b0d7a91a724872988ec08e7e4e39934a6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974389, "uuid": "5d5caca2-eb72-4891-a206-9edef860c1fe", "comment": "Malware payload", "value": "7df12030d08c8672e70f53ec30821ba8b485e13b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974389, "uuid": "6f0f4c1c-3852-403a-998b-b55ac84febbf", "comment": "Malware payload", "value": "e73fcea4512a533ff0062e7bd5d9260b796a94e57c6ff31267cd32fe81c63984d747972df91e27928d79f3d3ca2e39bf", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974389, "uuid": "cbfb31b4-4fb0-4675-bc6c-ee9dc2e9085f", "value": "T1AE85B0203BEA6185F477BE56CBE4B1D6A67FB3233A079A8B1550034B4233945CF92D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974389, "uuid": "e0986c96-c87f-4ee5-8e52-1cb647cb3d81", "value": "24576:n+z+pHCbOUNYb6ILacgNzGHnueBCezOGof0xcM:/HnUNYmIWbA5Cea5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974389, "uuid": "7ac04b9e-dc47-40d8-87d0-6d256c3c16d7", "value": 1721344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974389, "uuid": "ae9856ee-b8d9-4060-b92e-6266cfbccfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974389, "uuid": "dff9cfa4-6982-4698-af8b-5cdafbda382f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b89f5fa-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "c8e8d116-91b3-4fbc-b1eb-0e7183f68026", "comment": "Malware payload (Mirai)", "value": "6a3e396f0e16065c8bd08c1b22910668", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "e707c36d-996e-4d79-96f8-874e28a2846d", "comment": "Malware payload (Mirai)", "value": "e1877854c8979453934607ad3d41520fe916ae6e45962c75ceeeebcc5312b9df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "1e647c2e-ec6d-4115-abee-ebbc7752e49e", "comment": "Malware payload (Mirai)", "value": "ac6619bf50e834f4f08272d5057e95591dd297a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "ee1dd103-94de-456f-b28b-1cebaebc6015", "comment": "Malware payload (Mirai)", "value": "40dfb63d23ae37b1a6612673c9088877d0a36d9a0b43f51a90bbb4477972cbafd1c44b91bd253ce956174713205e7e91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969081, "uuid": "312179d6-5586-4082-a5f3-92787eb740a2", "value": "T164934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969081, "uuid": "58e26caf-1803-4f71-a125-fb4021cb1bb2", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINyS:XGptyz+VJzB7T9/bLUAx9e/SBJOyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969081, "uuid": "8fa53fae-0b76-4683-bec3-a78f870b4c8a", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969081, "uuid": "914390bc-1498-4136-9291-0ecffd11c17e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969081, "uuid": "136b236f-db12-4f81-8c81-e316d20072f8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a87c14d-5acd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779997426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997426, "uuid": "7ace956d-ec38-46fa-ae5f-119d87b4a88e", "comment": "Malware payload", "value": "a13ced4758f569fb017c7daa86ab820b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997426, "uuid": "bc3545d2-4c37-4d3e-bc66-790a197dc007", "comment": "Malware payload", "value": "e189b788323941cc88d18dcc254e2832a2adff272d079d9c3e3889d19a163ce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997426, "uuid": "9452ea10-08a9-4692-941a-12d75ca1e220", "comment": "Malware payload", "value": "76e371b7fe28d55ba469bdd5f0d1e93d27081369", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779997426, "uuid": "5035fc4f-ed2f-4049-be07-1647fde7c1fb", "comment": "Malware payload", "value": "ad0ed5ec183d4b09775a3dc2f137b432e1bd56f2cc14b18b53ca1d2fb128343503d0bb41a258304fb307760320a074f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997426, "uuid": "b9b2708a-f821-4e2d-8f67-23428065dfb6", "value": "T14BB2F9377A7B5B4BC0E0777600D32323A0DAAFF51664970F3E951D8A5E94390392AB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997426, "uuid": "70f08af1-3437-4058-874d-9bb87ffd8ee1", "value": "384:ir6YLMtaKMOPBd/obo5AvsiLyonoYzSDE/ACKibkZLI3BM:M6YKaKMOJdgbeosOtHSDEnKkkZLIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779997426, "uuid": "7f27465e-a893-4671-8e06-cf3e8fa384ed", "value": 24128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779997426, "uuid": "6bf193a4-aa4b-47f6-80bf-994013d5e3ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779997426, "uuid": "3f82cb31-2b51-4a07-85cc-284fd799dbd8", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db3214a-5a63-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779951824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951824, "uuid": "b10b6b60-6049-4bb0-aeb0-8b8205f58e1d", "comment": "Malware payload (ConnectWise)", "value": "1e5f38f69505cdcb34172f39747ab39b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951824, "uuid": "c3503430-b68b-4436-95b7-ac116953a5b5", "comment": "Malware payload (ConnectWise)", "value": "e1cd006efa2d33192a1d909d099b9d2de54f4541f47940270dcd627fbad8a862", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951824, "uuid": "7c622fa3-fa8b-4b40-a2c7-e5927033a087", "comment": "Malware payload (ConnectWise)", "value": "6159c2411a6541b1a9ab26f79e8ef598fc2c56ee", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779951824, "uuid": "7c65d66d-d4af-4a07-a8df-c82e2125aef3", "comment": "Malware payload (ConnectWise)", "value": "c1328b9c897080c129bda20ff3b9923eccde9016da71c58a4c47992c597fa164a95743d428a2610593b67f2fdc107214", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951824, "uuid": "f7803de9-cedc-44f3-8c41-fe4bb33db48a", "value": "T1D511233B3742E0A4072B1165841E4564F80813039743387532B18479EFB6FC4E5FE6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951824, "uuid": "54fbc9b0-0d85-4c47-b519-212a52ca5f66", "value": "12:w3DQGglGkxntPhLC8HUlgw8cEPEnmLIis8DP2im6KtzDIjZQaTkLGr2fUATals6:KDQG+Bqgw81R8IjZzsKOUSalB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779951824, "uuid": "63a8ba81-1aa6-47b6-bd8d-17402c55a251", "value": 1052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779951824, "uuid": "deb25fd3-47ec-4608-b032-b80abdf8ed69", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779951824, "uuid": "d1a85422-abea-4606-988e-9b38ccd9b30d", "value": "invitedGuests.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a6e984-5ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780007451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007451, "uuid": "29f494a9-e82f-46ae-a71f-f3b4d2f6bc5b", "comment": "Malware payload (Mirai)", "value": "1ea3475ed74fe5a12f9ccc91cacdf7a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007451, "uuid": "c88c2a60-b62a-41e0-8fea-796d59f2d5ca", "comment": "Malware payload (Mirai)", "value": "e1cec6dc8127518b57690d8f8fb4f77faaaecba3059be137d7b22849e6add159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007451, "uuid": "b3cb09b7-3369-4115-9cd1-37484d813b24", "comment": "Malware payload (Mirai)", "value": "237d6a4ff686e41fb61dc91ccb2bdf860c3ef284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007451, "uuid": "f1a48d2b-b6aa-4972-bcb0-8da8b611f74e", "comment": "Malware payload (Mirai)", "value": "99c4774006db02fe9c4882fa51bb5ac1e182c0e54a868660e4f41bc3efee14caca28cdb4a756d0f37ec3d1ef59f0eadb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007451, "uuid": "6e101625-ac3a-4fe3-a9f9-68431020f6a2", "value": "T198C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007451, "uuid": "a1dde2a5-00a4-49ae-84ee-8a6e3f2a976c", "value": "1536:U1AFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3S:UGFmSmviqS1Bs0+Nd6lAqktNMxSNbmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007451, "uuid": "39dde653-e45b-46e4-a1eb-be434bee424e", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007451, "uuid": "05b5fdf3-bf77-4f64-be62-bf94449284d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007451, "uuid": "8e450934-f283-46f9-8b26-f8af2b97a982", "value": "c209b01904955fae5564f486e63d372f997069b7f8f5267594703795a67527ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db27a5d8-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "1ea745c9-c0de-4030-9923-a4f4ff9adc6d", "comment": "Malware payload (Mirai)", "value": "32b5ba8211b717b1aa7fb1e89579cfb7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "20152097-2c6b-464e-ac27-4fee9e3dd7c0", "comment": "Malware payload (Mirai)", "value": "e1d1bdc7b6130b2d097cdf5a2d231775804e106b1ba1dfbb1739ad057e5bcbb2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "9fee9c6f-964e-4361-a1c1-01296de8f32d", "comment": "Malware payload (Mirai)", "value": "ea93e74ef38d4d70b685fafed596d30214d709a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "f02a1cb3-d7a4-4119-9731-352a0193b9c1", "comment": "Malware payload (Mirai)", "value": "a8f4d16dfff1a140e48016a041592a9bc8794aeb13332fa1db7de38a4ec2c6933b062f1db8e434a4b4a78590262c74fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "7e964f00-defa-4c02-8e79-df945801c511", "value": "T163E307C7F900DDFAF80AE73748570509B230BBA209925A373257356FED3A1991477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "4e9f9e25-89a7-4cbe-9de2-7e90a179b00a", "value": "3072:EZN8x+5r8+ayEPvoFkyhxYiou2ukLX4Vqjbi8LW7dwhm:yyVyEHoC0x9aLXfLWWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973939, "uuid": "27325407-5a98-4a0d-9d76-87f5a696fdb6", "value": 148736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973939, "uuid": "e0596b9d-07cc-4030-886a-b5d17498d0c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "0bd500e4-fd31-455f-a860-c2a6ec5f98af", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e744fe-5ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779995831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995831, "uuid": "9541a00e-a8d5-456d-92f9-33ca33e792fa", "comment": "Malware payload (Mirai)", "value": "6d04d70d44388502febe2949595caac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995831, "uuid": "b314b206-9d6d-41f6-9564-64292d40bb20", "comment": "Malware payload (Mirai)", "value": "e28886142e669aec9ad91b076d088bde7161fc7ddb57e89b561d01eafa70f28b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995831, "uuid": "6e9cbc68-0974-4be1-8844-1cd665464cf5", "comment": "Malware payload (Mirai)", "value": "c48be863953e4e2dfde3006b10eeb2bc7c6dc5f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995831, "uuid": "ecc8cbc2-6ffe-4a19-a49b-a081691e30dd", "comment": "Malware payload (Mirai)", "value": "2e50e78bf7170a213b435194dab0222849771058450b1f6834b1fda94622bad764d825930020e235040701be4528c1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995831, "uuid": "f996c1fe-63db-4c2e-9fe7-d0f06771bb0a", "value": "T1A6D30945FC445F17CAC256BBFB4E428C7B2A07ACD2EE720399255F71378B85A0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995831, "uuid": "bfda87f8-6085-427e-8fd1-0fb881790e83", "value": "3072:dfXGysdBj8x6MdN4c2Kwu9N57tqrx6VNbX:dvGNoxlT4NKwe57t20VdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995831, "uuid": "35c31944-e1c2-49c1-be7d-d7a2728eb2b2", "value": 137784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995831, "uuid": "36980ab7-d1eb-4e91-883d-964040adc032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995831, "uuid": "00fdaa6e-ca37-44d2-b249-41ed457f5806", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c034823-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931957, "uuid": "ff8f1df5-6bef-4ef0-89ce-93979d7fa322", "comment": "Malware payload (Mirai)", "value": "abc54a6368eff32de579c2db1a85ffba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931957, "uuid": "0a31fc8a-08b0-41fa-9007-e16f5e2985d5", "comment": "Malware payload (Mirai)", "value": "e29002dde4dc845fb3af8315e05750fd1b54dc53a146f606ef6fdadf8d02e37c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931957, "uuid": "cdf2e386-9e84-4aa3-a470-57219fb47c2f", "comment": "Malware payload (Mirai)", "value": "c4b529b3255bda25e952d95ff82c486c5268e6e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931957, "uuid": "679d143c-c0ff-4a5b-afa5-9204bfc5b5ad", "comment": "Malware payload (Mirai)", "value": "4ec60982db1100cab154a4988a65c7efbd1c1b12c7a987fde2de62f4cabe601a955ec6f18e4ac95ea751ced6ebfed262", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931957, "uuid": "353af820-0ffa-4254-a3b7-46aac5c54c2f", "value": "T1DFA2C0B07F48EE78C7A05831DA5DC87731620978FAEA372724B547789A4624C16FCA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931957, "uuid": "21e986fb-82e0-4247-8938-3324802239cf", "value": "384:PDyna7vz1qA6zgd0nRzYb/IftcY7w1ybp+VMN2Y6GUmKJzpLhymdGUop5htn:ma77dMk/YtcnQpXzKXLs3UozLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931957, "uuid": "570f0ec9-99d1-4e6c-bde6-03d79da7ca81", "value": 22260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931957, "uuid": "647964d7-9d8f-4ea5-9eab-346d7c67cd6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931957, "uuid": "2887c8c7-80e5-4647-858b-111543b188e0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8a1bad-5a67-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779953678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "12bf4900-7ef8-43c8-ae77-98fab7198444", "comment": "Malware payload (ConnectWise)", "value": "e62176874613d192f05e3167801e05a9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "97a76af7-615c-443c-b763-2d5381f2a688", "comment": "Malware payload (ConnectWise)", "value": "e2ac4547aaa9dca69877b260c3eed4dde7768330fc5efabebc84ff6d3326d97b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "3851dacc-aee6-4db7-aab2-a1e87659b39a", "comment": "Malware payload (ConnectWise)", "value": "f048880bf68e06c359a71ac5519f9faf7c51f945", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779953678, "uuid": "8842634d-dedd-4c7c-bbd2-f4005068c789", "comment": "Malware payload (ConnectWise)", "value": "e10a553a603c631f2c477435ce9773af6ea5906fc4f496884c1e6a27e7d3c8dc5fd2dc94fde0393f4a55fb96e1906f6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953678, "uuid": "bdaa5d41-7ecb-45f7-8ea1-2f52930b2596", "value": "T19AA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953678, "uuid": "7d44b0ab-cd6b-45a4-8641-e913c27d9b8d", "value": "196608:LnCtVYqI5MvbWEpKkqyIJqKmnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqYnCtO:TCXvI5MvHxyJICXvI5MvHx6CXvI5MvHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779953678, "uuid": "cad9e261-3898-4d3c-92b6-026e8e649ab7", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779953678, "uuid": "eac13545-6445-4ce3-8234-9f56ead12f12", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779953678, "uuid": "76d95a95-9fc2-457b-a6d6-2e3798c630b7", "value": "e2ac4547aaa9dca69877b260c3eed4dde7768330fc5efabebc84ff6d3326d97b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d846d94d-5a86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779967062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967062, "uuid": "671b17e4-ca85-456c-9caa-fe496b2e4e5d", "comment": "Malware payload", "value": "4c0436debed2c869847d34b209bc50f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967062, "uuid": "344ac5a4-26f0-469c-9024-35218d19ebdd", "comment": "Malware payload", "value": "e2c80c59b5ee2b6922057bbedb1d20d4ed0812cd880819ed25f136d9b2d0e480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967062, "uuid": "187076a1-8c4e-4e93-ab88-7e62315b2dba", "comment": "Malware payload", "value": "45257a546cf930db833f91ba6f66135c84085d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779967062, "uuid": "fe9bb7c1-815b-4ffc-a0a7-d6aa8d9c0737", "comment": "Malware payload", "value": "237a47c503105da486ebd656528a11335513b50277906ef3e766d7b80334be2b39f5c8b8aac9ebedcd234eb32f60388a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967062, "uuid": "bcaf6207-b495-4c4f-a7ec-606f7ddac610", "value": "T1AB43391B635181BCC806C27491362A16F436BC950770E9EFBB9AA7215F787D0B73E0E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967062, "uuid": "25d34660-c83e-4cc0-9744-2d85820af55d", "value": "3c5a84cec6d7e9301fbc05ed25d65f9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967062, "uuid": "ac90d266-8c54-4a3b-889c-100440c5d003", "value": "1536:0tjBnMPTENC7fsCf3h9ZyO6WWnjuv5dOHHeozVmd8:0tjBn+XfsyR9ZyO6WskOHHeozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779967062, "uuid": "bb7e5b2f-4354-46fc-958f-fa95761bc96f", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779967062, "uuid": "7fa1112e-9702-4a97-a4eb-03c86ad6cdde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779967062, "uuid": "b2b64bde-bebc-4fc2-9143-6e7233f719ab", "value": "c2r64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60caf9d-5a5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779950281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950281, "uuid": "22a4ed4a-8e0e-4a9d-906f-4ebe844a3def", "comment": "Malware payload", "value": "441901bd15a0fa2d65bc6b792fc9f3be", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950281, "uuid": "cef9d2fa-a417-4d56-af17-d545f79182b7", "comment": "Malware payload", "value": "e37d2309da0646ba84124ec5fe83e5843c1cc1bc4b44373fe1a7a316998d2522", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950281, "uuid": "9e2d4dd5-7b77-4025-92c7-1f31d935fa84", "comment": "Malware payload", "value": "812779c2af92824fd2ef9f49bf66ac7a225cc077", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779950281, "uuid": "98685d75-eec7-4fa0-906a-da2b26900bbf", "comment": "Malware payload", "value": "99ff56e0317c8639cd3add7e5e2c819b7af28b5c7cb737a781f6d3a334ebcdb5abe665f3dc318e03d9b09df39820951f", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950281, "uuid": "ab8657a0-152e-445e-acdc-ca7a865345fd", "value": "T1B03733ED57A6592FDB010374803BC2A6175B2C5E5A94FA9B730931102EB77C7EAF3680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950281, "uuid": "8f98a252-3e60-42ec-a5c9-8228735acc2b", "value": "393216:OxVtAvldeh6QybQDcyh5KhxR8To0Y3L82qIC4bSq7xxVtAvl/eh6QybQDckh5KhO:qtAtyybbm5Khv8xw42qf4b15tAtYybb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779950281, "uuid": "bc8be210-9448-4b50-920b-2dbcf76b5de9", "value": 22581248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779950281, "uuid": "7df8f5dd-a7ff-4ddc-87dd-f0df4c60bb18", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779950281, "uuid": "ed10821a-0bce-41e6-9e3e-dba0231677fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03484b8-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961948, "uuid": "cc8bac65-c4d8-4bf5-8f35-b2819ba228b5", "comment": "Malware payload (RemcosRAT)", "value": "d0027026c5d8fde031c005f8e8f7cbf8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961948, "uuid": "34ba7e30-e99e-4801-bd7f-564ca0cfa8b2", "comment": "Malware payload (RemcosRAT)", "value": "e3897708f5a716c87d00866e53985f30e1547a94470a56de5b786aa6c75b36ff", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961948, "uuid": "7db0bb70-c77c-4077-92af-4f0487b7fad3", "comment": "Malware payload (RemcosRAT)", "value": "693558e0f0ee4647233b4c502fcf122ce510984e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961948, "uuid": "dd354ad5-7196-4e4a-8ab1-83110c7d3297", "comment": "Malware payload (RemcosRAT)", "value": "d63225f03b906a6cc576bdf632fe90a215e8a362209961e05ef055356474a72544449fda09743fbc209f4b555a31ae3e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961948, "uuid": "bad7a1b4-cdae-4956-944d-0a9a86a44561", "value": "T1FE242396CBAE4DD1A51C4A82DCED1EBC6383A037D95B9B23497ACCA3005CB793F10466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961948, "uuid": "4b2d07c1-b13b-4fc3-9418-a1b2c2f3a807", "value": "6144:ZJwJcAo2sn02KMuQsIXGv4gt+ZKl/bCwMwqHL:DRRntKEWAE+ZKl/bCjwqHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961948, "uuid": "ee7f6814-82e3-48ed-9a9d-977041d0ebd7", "value": 212810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961948, "uuid": "fad5557a-ce8b-47e4-9270-3964b40c7dcc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961948, "uuid": "827186ab-2520-4133-8452-43c827f7565e", "value": "POXNo.X4300001762.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce83977-5ae2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780006530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006530, "uuid": "467589df-498a-4226-aa57-bc80128df056", "comment": "Malware payload (Mirai)", "value": "4f7a2276d2124299a58a35b74de713ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006530, "uuid": "143a180e-5ff5-4a09-8289-87d5c5e6cac3", "comment": "Malware payload (Mirai)", "value": "e40e6688f31ed4ec711ff74f4295f71742bd4e19e975bf3c12cd37f3d5a4cb1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006530, "uuid": "fdeb4e78-39e2-4719-a20d-d4b8a4c828b7", "comment": "Malware payload (Mirai)", "value": "12102f3087fdea3dac2444851c4b6432d7010186", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780006530, "uuid": "b408bea1-1e9c-4319-9f7e-7c853b1b3c42", "comment": "Malware payload (Mirai)", "value": "e738b1e8e911935eabd41e885e874cf67f271c9cc386e67199d099ed6468f1aae2a2fff1f47d5d4b0760fe7a1b584e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006530, "uuid": "cf261b19-d672-4aa3-ae1e-8c539a30b0a1", "value": "T13AD30A45FD449F17CAC256B7FB4D428C7B2A17ACD2EE720399256F20379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006530, "uuid": "05eefd29-6928-4f2b-a0f5-c711ea4b71a7", "value": "3072:P4sQBmTOXret+QwjFRAbnW4dPmbNWvVK0oqq:zK6iqt+Qw5RAbn9d+xWvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780006530, "uuid": "5b42a0c6-2d57-4a89-a4ef-bd758baa86a3", "value": 134168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780006530, "uuid": "8770aa29-8fce-4af3-b334-14bdf413261d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780006530, "uuid": "61d41d44-f328-4dfe-a0dc-9bf547b0a6f0", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca909218-5ab1-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779985507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985507, "uuid": "5166c768-5231-4925-9655-2ffad390ba3b", "comment": "Malware payload (NanoCore)", "value": "3dd5893303e0befaeb44b403175d697b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985507, "uuid": "b1bc77a3-36f7-4581-8d5e-27965ec027b0", "comment": "Malware payload (NanoCore)", "value": "e4774281b944c049949b4a2ad4ac3123aef31275be846ab026c2f005f8dbf9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985507, "uuid": "4d8cbb58-e47e-4e2b-8614-bbd3afd518c7", "comment": "Malware payload (NanoCore)", "value": "4ccb2035f7754f14d1669009674ab1020752d2b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779985507, "uuid": "228b0bf4-373e-4ed5-b483-a650b725a5c3", "comment": "Malware payload (NanoCore)", "value": "b927e46b346bbc80db49c0e1e005ec1867aca8d91e6bf6ff010f8604a3ce2fba78ad22284ae615b4720e42eeac9c7356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985507, "uuid": "2e6da369-967f-4249-b50c-00923c5328f8", "value": "T12614CF5677E9892FE2DE86BD612241539379C2E3D8C3F3DE28D415B69B223E146070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985507, "uuid": "7ee1d64b-52aa-4ca8-99d5-5ef95fd6e103", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985507, "uuid": "baefa5ce-d0c0-4f95-9c50-0df43d7c7b6d", "value": "6144:MLV6Bta6dtJmakIM5CUBPnGZd3wwMi5T4:MLV6BtpmkpMOhwwMi14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779985507, "uuid": "7075901f-9360-49ea-a1aa-34bfb068fcb4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779985507, "uuid": "bee0f36e-63cb-4f2d-97f9-6fb169d7019c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779985507, "uuid": "fe70641f-d9b1-45e6-bd6d-ab5089c6fc61", "value": "aboddehousing.co.uk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f12f8e2-5a75-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779959584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959584, "uuid": "ba581a03-5494-44ea-b6c6-d2359bdc9bf1", "comment": "Malware payload (PureHVNC)", "value": "db809d7db46ef335d61f5e405af9f4fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959584, "uuid": "8929b2a8-95ff-4cf6-8bf2-e3debc12e73a", "comment": "Malware payload (PureHVNC)", "value": "e4a3010ada8d972b2256e1b698d93a2a5bdf48860e4bd030dac47920504d60cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959584, "uuid": "e8874df4-d585-41dd-a7bb-421ca49c4eaa", "comment": "Malware payload (PureHVNC)", "value": "45b73a1ef6bef3270d270b87c622a9b1497ddf23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959584, "uuid": "6e5c0e8f-950f-4f8b-8eb7-aec5c6d2363b", "comment": "Malware payload (PureHVNC)", "value": "4b070405fd100a2edaba2a6d3fc2a4ed3ad37e4357efa940ef8bfcdcc70ba230a73ee6b31228d8d5193187223fb9c389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959584, "uuid": "7c973b64-423f-449a-b4b1-59aa986bac4a", "value": "T12DE4AE1B76568E12C2C89337C0C75A0593E4D6C63673EB0E768923961E073EBDD4A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959584, "uuid": "774f5ca8-057a-4545-af06-2db225cbf0c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959584, "uuid": "57985968-1278-41a8-966a-121986af00cd", "value": "12288:ZwAWTFXbm6yI2BN59OsH8k47MgRso+o4:mRWBN59Oq8k4LmoJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779959584, "uuid": "974dceea-5ffb-4b1f-9d51-286e9f2dfa10", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779959584, "uuid": "9841314b-57da-4641-869b-e16b2e3b5d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959584, "uuid": "2ba4a884-3be8-4171-aafc-d52dcdc28cd9", "value": "db809d7db46ef335d61f5e405af9f4fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ee55d6-5aa5-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779980104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980104, "uuid": "f68b9a5d-dd18-44c9-afe9-018e309dc104", "comment": "Malware payload (NanoCore)", "value": "e921bd4b95f536959a190a5b7cf4a975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980104, "uuid": "f5ab4cb4-a9d2-49a3-ab67-6645483e53c5", "comment": "Malware payload (NanoCore)", "value": "e4ee45f1f01384d107d20584330249d8dd11337bff4a455264d8ece860f5c899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980104, "uuid": "5cb07b6a-6913-49d3-bd71-f9ff9cb36b5b", "comment": "Malware payload (NanoCore)", "value": "817b47fcce9ec6e64cf5dfca0caa105ade68f74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779980104, "uuid": "3697b65f-3f34-4bf0-aa72-d190dfd2cf68", "comment": "Malware payload (NanoCore)", "value": "7f5358b66d4cd3df2fab72871553c1c5b2ae17c7bf36a9e37cccb671d083f9ea12871e7449e3a1bec229c35444a2cc4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980104, "uuid": "2d192fc9-5261-4cb9-a917-511340c6fe2a", "value": "T1B714CF163BA84A2FD2DE86B9711212178779C2E3D8C3F3DE28D451B39B667E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980104, "uuid": "5b6c6e26-4be8-4173-aece-2ac4a0bdc698", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980104, "uuid": "6b0268f9-e40d-4b99-9120-83ff8cf46562", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIdNXzMrrC/Y6jmdzBb6KaGaOCX:MLV6Bta6dtJmakIM5wkC/nqzp6jGaOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779980104, "uuid": "661d21bd-c84d-4e5a-a247-a73e272683c1", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779980104, "uuid": "8a123466-986a-4ea3-a491-2421be46b53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779980104, "uuid": "67b07c97-a3f8-41d2-b911-da4f10c5a63c", "value": "gg88.yellowred.in.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76f8e7d-5a34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931815, "uuid": "98e9bee5-eb46-41fc-983f-fbc39ad4e9f5", "comment": "Malware payload (Mirai)", "value": "598cebd09e3820adcab66c7b41199a3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931815, "uuid": "b2642525-6eca-4665-aa97-f8722fca2a67", "comment": "Malware payload (Mirai)", "value": "e56be6189d3dbd5f52cde9647be4733657033c215752f1ed133df1ee3d9d0309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931815, "uuid": "92c00a7b-8d0e-46aa-80b2-8dd7e8cc466e", "comment": "Malware payload (Mirai)", "value": "f0efc1493444d5d648e5988d2e8be2dcf0a7b13f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931815, "uuid": "4dfde927-3a54-4e00-9ff7-270008af7f7d", "comment": "Malware payload (Mirai)", "value": "68f09b06b0e069c03c446b70360ba9e7246ae30ff1803a9d990faf24be50164f9f2942307dc42532d01c57103a096163", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931815, "uuid": "de6fd81d-8742-46e0-996c-2997df79fd8d", "value": "T196C63C8BB9924982C5E43A37F8BD80C433670FB99B8756565D14FD3C3ABE5DA1A38310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931815, "uuid": "ad87293b-3bc2-4f34-be97-9e98b4f0c8e3", "value": "98304:XL0/94OqhqcJ13q1GJBKape+dVHz+SGJI7EBav8P09+5dPE/:Q9MJ1a2Kae+dVHz+SGiABaKdM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931815, "uuid": "0edde596-42d2-4927-a522-0d16ccd63ea2", "value": 12255394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931815, "uuid": "bc5a8f26-3e3d-48d7-98d1-587499900e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931815, "uuid": "4e698823-66ac-461b-9bd1-7c4e07f316ba", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a40649e-5a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934075, "uuid": "57f7191a-30b9-4a4c-a855-1b374fd4ebad", "comment": "Malware payload (Mirai)", "value": "68eff07b394c2360cbaffb9f2a26c482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934075, "uuid": "f76f0444-ffe5-48ed-9304-a5099d2cf88a", "comment": "Malware payload (Mirai)", "value": "e5a87d5bd50fd7dffef6a33be10e4a04265c0af81db952888fb9b46181774285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934075, "uuid": "4c69a15f-c473-4bcc-9f72-915e33771655", "comment": "Malware payload (Mirai)", "value": "8b9bdccf19d5d5343b4d0f71ddd5ad1bec1de623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934075, "uuid": "f462d6eb-5ba3-4544-b310-0e9040dd30ff", "comment": "Malware payload (Mirai)", "value": "5deb006e7c68396e572a415dc8fcc910c4a1fba27258a2d6db23bfb5a0dad97041446a092fc9c8c2fe58394b1b30e574", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934075, "uuid": "83661426-0c28-42e6-ae57-a9d180930e62", "value": "T1B2530242A38BB061DD740D78E75CC788538F32D050A97BE794A662F5278E057B2A3FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934075, "uuid": "cdc08f44-ba66-4c60-9ef8-2748e6535340", "value": "1536:Mjb8eu8WROSxTOwvF/TrdBq3kMCZzvtKGvZND+qUbEC6qaoDb:MP8e2RPbrdBpMCZzvtKntbEbxon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934075, "uuid": "ae67d85a-02fd-4842-8561-7db555b6cb43", "value": 66028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934075, "uuid": "b30c545e-bfc0-4dcf-9a46-227ced703e43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934075, "uuid": "7d60a182-9a4d-477c-aba7-444429ad1e28", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6024c958-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000361, "uuid": "03e75891-ff3f-4ee9-95e9-c0dbf43fac72", "comment": "Malware payload", "value": "42671fb2dd289692203ed6ab827a2157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000361, "uuid": "68728e9e-0fe7-4d15-9f94-05e175bd62f3", "comment": "Malware payload", "value": "e5e2b96f4159dfdf7ed8ac9c023e6909a6539797e08fc31fd5770fd2fc18ff01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000361, "uuid": "c3b042ad-533e-461a-beaa-d23dd5adc42c", "comment": "Malware payload", "value": "a5ee01817607bcbcb1d211f6d81671a1ebfe5a63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000361, "uuid": "a081a5a5-7b46-4fc1-bf9f-239dcb5160b0", "comment": "Malware payload", "value": "eb09695a7b9921876e7314383944cdc6e7f449920109f04ec4a0575f6a9283f03278df181a2391d302e7435ce0a1dbd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000361, "uuid": "681d2809-725b-4f6b-ad56-e66cc4d47b46", "value": "T196764A07EC6549E9C1EED2348AB29213BA717C495B2123D32B60F7382F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000361, "uuid": "cc04f5a3-5be5-47c3-ac4e-95fce2b457ee", "value": "98304:uReUIZ2lsVbdzfHL2vtUnuUrfdnnDXWEf:uPsHzfH6UPrFDXTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000361, "uuid": "09e87fe4-fd6e-4ac3-81ae-28788c1a50b2", "value": 7553208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000361, "uuid": "3e0a239b-0c35-4f89-82e4-43c23895ac64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000361, "uuid": "f3c916f8-cbcb-44a6-a08a-b9ffc4d014b2", "value": "vulcan_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6e81d0-5aca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779996008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996008, "uuid": "36781794-dd7b-4892-ba48-1472de37283b", "comment": "Malware payload (Mirai)", "value": "1b26bfb42bf34e822a3540760e2cf463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996008, "uuid": "a2d2eaad-d5fc-430f-a50f-272bf9462016", "comment": "Malware payload (Mirai)", "value": "e68d772053eb7926429256140c92bbcbb394089ce9b88d3c4ac765d753680913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996008, "uuid": "b477b792-0eb3-49e9-a8c3-da60a3333e03", "comment": "Malware payload (Mirai)", "value": "497b50d9fe059f5b56e352362907395188820354", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779996008, "uuid": "38782041-11c9-4e09-af89-623cbe86767c", "comment": "Malware payload (Mirai)", "value": "be31e72cd46864268d5b33caca152c629b6a8929da79bff6845bfa12146c3ad5b108a8b161926d20f9dbc3410e3e158f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996008, "uuid": "9e682795-32fd-4507-91ae-8b4c00eda4bb", "value": "T104C33AB3D8256F58C664D4B4B0708FBA2B539560814B2FBE6977C6B88083C8DF6457F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996008, "uuid": "b6e2ffc3-b5f7-45d5-81ce-d320067293c2", "value": "3072:VTmzOu0ju13YbVvILW6UK72zpY2u8CMO:VCzOu5kIarK72i8CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779996008, "uuid": "11ff7d95-e8cb-4345-ab98-6360d464d883", "value": 122172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779996008, "uuid": "64a5c5f4-ec07-4323-afbe-438cc021565e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779996008, "uuid": "af17d01c-1aeb-4e5b-abd6-3aa19ba60220", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71aa905-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970952, "uuid": "0580c2af-999d-427f-8bda-2eff56a93b75", "comment": "Malware payload (Mirai)", "value": "8128c3f9a8de02f03c56895ad96a7834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970952, "uuid": "94f8087a-ebaf-412c-8c37-d845f9a18829", "comment": "Malware payload (Mirai)", "value": "e6e6eab270c1f9931a93729f2ae630b60c3210b092a1e3a276de79506c06f8f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970952, "uuid": "ae86b423-96d1-491c-9015-48b34d182629", "comment": "Malware payload (Mirai)", "value": "970709f6dc31a105da79c2a241c7e50e8d379f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970952, "uuid": "9d06ae6c-7247-410d-b470-8460c3fe2b8d", "comment": "Malware payload (Mirai)", "value": "fc2444e2dc0f72d1e5d5665f11dcc03e9abf2af8815337dbdbc377a673170112995f020d6ef421f1df9d43d06716472a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970952, "uuid": "5e9d4d27-2e83-4bc1-b0d8-3bd1b36d9285", "value": "T1D2931BA1B400DD3EF81BE6B7C0470B15B125B7A40F822B57B627FD63DAB90B45826D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970952, "uuid": "7031d18e-08b0-4f19-a650-1924b7bea1af", "value": "1536:XskiZsRE0j8fWJqOZpfInxY5xb0SOTy+bggHc8iZKZ:8XZsRPj8eYupfIxYT+T7bggHy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970952, "uuid": "1c2cfd2b-f18f-454a-80a7-eb70e58e1227", "value": 92580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970952, "uuid": "a1acb4a4-6e81-4ae6-8548-edc980ae6be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970952, "uuid": "c12d3f8f-ec4d-422b-9287-8a72d7caef64", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80e612a-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970525, "uuid": "59f483e5-46ea-4a00-a0fc-d9eb8fa1cbc2", "comment": "Malware payload (Mirai)", "value": "29c3d3d9668a6fd053647ce80d71d126", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970525, "uuid": "c62cdc43-d2e6-4459-9ecd-c6b1bbc0c353", "comment": "Malware payload (Mirai)", "value": "e77a4f864280a611348279526fea3c01f59ed1e98c6b73635dc9a1f3cf5fdd70", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970525, "uuid": "f7742327-616c-43ad-a4d9-121f63600f13", "comment": "Malware payload (Mirai)", "value": "4b08be359d679b318adf2094a09b515b46078d0b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970525, "uuid": "12af1b46-181e-4f4e-a125-bc3f296508b8", "comment": "Malware payload (Mirai)", "value": "99af371f88d65d81c8d11049547d8abce2e0f30f6d746e02afd1508a4658f2cd839b1d1147f5d3389f9bd2d45d994f20", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970525, "uuid": "937c8ad2-1471-4139-bcad-d44a3a481fec", "value": "T1E504392F358191F0F6411B746BCBD3976C390BBF51A9909F6B416329B6E0B7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970525, "uuid": "c81561d6-7ba7-4b72-a2ed-50da5fbd36d9", "value": "3072:7mPX5bl7RDfPIX5eG/L1AL0SFU66gOSNL9CnNgRdgJi55wTUXS:7eJpJUVD1A8n0YNgEJi5agi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970525, "uuid": "c0a58eaf-6424-4fad-83d8-82fa9ae40206", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970525, "uuid": "1190d68c-45a3-4210-a1a4-2710ba03d00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970525, "uuid": "6a983c75-e1e1-4ed2-ab5e-d65849de70ac", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0dc7c0-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "1baa6647-9f9d-4e70-ae07-100eab4f776f", "comment": "Malware payload (Mirai)", "value": "2e76cd3bd3914527237b5e02c9bb3fc8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "8bd412e0-17c6-4eb1-aa38-b1bea9137835", "comment": "Malware payload (Mirai)", "value": "e7b4aad05d2c840667202b09c9d8984c6abd9f3fe7d59b5ae641fa116f52741b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "b01a3f44-e546-4cc4-b9f3-78ab510f659a", "comment": "Malware payload (Mirai)", "value": "0d67084f23c773c8d7172d9128d328a37cb4dbe1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970957, "uuid": "aea412c4-076e-4603-8981-581331c05646", "comment": "Malware payload (Mirai)", "value": "2551427f122222efdbbf285e1ba52c81357eef8ba99bc2edb55b8b599f8aa69867fa921b95ee9e517190da6f211a4170", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970957, "uuid": "b5cea260-9bfd-47dd-a58f-cc5aa2fb6d2a", "value": "T155632A85BC819A12C6C522BBFB6F428C372653E8D2EB3207DE256F11778781B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970957, "uuid": "27a2c42b-3fa7-4de9-a2aa-3f387884991a", "value": "1536:g3eFJldRK0XeaO+UYMScuSt5+JvGkwAqDS/Tter9GbHzz:g3gHdx49buvGkwAqD1hoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970957, "uuid": "3486c27c-5f4f-4d73-ac24-9ecc903471af", "value": 71096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970957, "uuid": "6d981bee-0f60-4078-bf37-0bf5cb929931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970957, "uuid": "3bd5fdd7-e8b2-4ba6-8ffd-487a2636e822", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcefd80-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000354, "uuid": "154c9863-25ab-445e-b294-0dcd9ae82a4a", "comment": "Malware payload", "value": "d7f3496df78ea68ce383320cef311887", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000354, "uuid": "f8a340ad-cdb4-4998-9acc-1da13f62d8ed", "comment": "Malware payload", "value": "e800be22cbfc0e562b8ef0b49e53285bbce2c34746dff19758a736f86f83edd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000354, "uuid": "0461aebb-0688-4c99-bf19-c0c295d8e1f0", "comment": "Malware payload", "value": "114cbbaef84e6777db646aa2ace30e24b23d7386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000354, "uuid": "e1efe896-819e-465e-82b1-a5ff61e15b0e", "comment": "Malware payload", "value": "0eafd2491d62ee23955a84b4fe8ad43e36f7f860c7ff94c92ff67c825dc6b376b6eb05f08e0544246808f7c300361033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000354, "uuid": "d6d12496-01b1-49c5-b400-491760db7df4", "value": "T12C760897B9924942C4E83A77B8BE81C433A30EB98B8756565D05FE3C3EBE5D90E34314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000354, "uuid": "2a0fba72-54f2-4793-a266-ec46ad9ff62d", "value": "49152:ABU4S6mQzdVtRTIRBdxSgKUW9t0zJi5icvGJ3FHHsdDTuqqKswboai8lchtp5ec6:AU0VtRTIjsAhtpJJ6akE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000354, "uuid": "0883428c-86a0-4e77-9c99-fdc73fd95b42", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000354, "uuid": "786ea32a-bd32-47e3-9b14-a6f03db59ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000354, "uuid": "e78ffb74-bf6e-4fc9-98f3-5b940c4495b7", "value": "vulcan_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc9ca52-5ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780005622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005622, "uuid": "4f0b1f71-790b-4472-815e-16d22f927670", "comment": "Malware payload", "value": "d1f57a77948c9686c64f40635c8c8516", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005622, "uuid": "293304a4-dce7-47a8-81d4-fa1f5a914a87", "comment": "Malware payload", "value": "e85388455c8c0069c62e1d2f026f527a4e24e4c9704ab15f6edd67f459e8453d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005622, "uuid": "51fb4ffd-dbe5-4c4c-8e37-9de03b6a682e", "comment": "Malware payload", "value": "b0e8d1877420204b9309f5749af0f009cf088b68", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780005622, "uuid": "d31eb9af-ec50-4da0-bef2-46d2d929d575", "comment": "Malware payload", "value": "b657c14bb8aab8e1dbf73700b907c2bdc6f2b637033cf596e80060d28376e1764923459309d8dcce8e871a9c1b60bc00", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005622, "uuid": "269d50c9-4a43-45b1-ba36-083072dd096d", "value": "T184A31541F7F94119BEB72F442AB906B8497BBFA2153DC9DDCA110D8D0B32518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005622, "uuid": "56442ff5-182b-40a7-99c3-542521a992c2", "value": "768:W91msvqig//eMME4bUNKxIghwumNYsB7ep8SZU2oAHRfRYXevtWIvgLEWVCcA1a7:UuBS4AkcmwyOThs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780005622, "uuid": "c0011e0e-7e24-49d0-b93a-a348faf18391", "value": 105694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780005622, "uuid": "17896288-626d-4609-8ac3-6f525328ed0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780005622, "uuid": "63115826-d402-41f3-9494-e9f18198da09", "value": "rlembrete_9f6b750d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71203a8-5a33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779931358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931358, "uuid": "a88c224a-aa26-45d4-a791-ed2f766b2a14", "comment": "Malware payload (Mirai)", "value": "02a0c5640cea3c963b074b2d7b721808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931358, "uuid": "48ab367b-be09-4ef1-a113-70bf92f0fdcc", "comment": "Malware payload (Mirai)", "value": "e892f709059fd7714ecde6587484a25076de19676258a4d3c32fd05e38dcea35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931358, "uuid": "36b88905-b588-4ced-af93-b9522a21eeea", "comment": "Malware payload (Mirai)", "value": "715f6185a850ad122e4731b4c4dcda834ae980bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779931358, "uuid": "53d34fa8-2fbb-4b01-8345-e043cc5ed79e", "comment": "Malware payload (Mirai)", "value": "86236b76251e527eee351c0ca0843f704058d65f2075d716c629dbf0c023303c0aca167ce5261e4bbe712c94b88c434b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931358, "uuid": "d5010790-c387-42a3-9987-be6a813f1eb3", "value": "T1CA3301F5F65C5B62F796AC250DD1CF9D231EAD982F62D5F200AADF8210DB436A2002E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931358, "uuid": "89bad12e-2f07-45d9-b83f-ad42550f1919", "value": "1536:6XikIzz9c5PLdGb8pRl3He+r4u+qgw09N:WikIG5zd88pRlu+r4u+qgw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779931358, "uuid": "59e3ea9a-5ef2-48f6-a8d5-5a3a17b2b694", "value": 53168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779931358, "uuid": "7bfb86ca-80d3-4e4b-9f0c-55bea6b787a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779931358, "uuid": "f536bf4a-9659-4d60-9107-8574d34dc1b0", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e584dcfd-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "1c04bfce-ee0c-4493-92d2-9f80006848cc", "comment": "Malware payload (Mirai)", "value": "74539bf36d13f9785a1bc9c50ecc10b4", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "89a620d5-1d07-4136-8844-df94a1f4c913", "comment": "Malware payload (Mirai)", "value": "e8aebfdbda6947110c5ab9cb434b7c4c22d53ffb53ff29454011a7eb16e0894d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "a8e54d5f-c372-47a2-8c18-cbc7935a6c05", "comment": "Malware payload (Mirai)", "value": "9b49de25de51375fadcc531ebae7d8065a9bf24e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970520, "uuid": "498b7785-fa47-416a-87cd-3e2d0f7c6467", "comment": "Malware payload (Mirai)", "value": "eebcda10b335eba4c948efc6bce89f858a66ac9aa48a8fb0d5a0adab56afa6a0942727a30394a8fe474b99bfe09a2132", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970520, "uuid": "fac917c6-29ee-4867-aaa2-e06092c99330", "value": "T1C86301CF7EB02F66D0CCA1B1703815D5D83AED8AE243C69C83E1EB95473453654C8B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970520, "uuid": "e0ef92ea-ab5d-439b-a0db-8210ccb21101", "value": "1536:kaxZLmYKVDNSl2y08yumeJyGYVmIMGTNH:kaxZLmYKX+t08jmeJhYTTNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970520, "uuid": "3fae900c-b969-4daf-adb9-9ba2fbdbfcf0", "value": 70460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970520, "uuid": "743f18cd-2b3c-45e1-967b-f3147717266d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970520, "uuid": "7153e992-fce6-449f-9482-ba657f7bd752", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9752cf9-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970956, "uuid": "b55da3f7-a2e5-4e82-a72e-b6c03291d6e9", "comment": "Malware payload (Mirai)", "value": "3408c304e4ad5c2a0233de4d90c1c710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970956, "uuid": "256fc857-a35f-4b78-a6b1-320283a18d3c", "comment": "Malware payload (Mirai)", "value": "e8c462ae86ec307f1143abbf645a5df744665470d46fb71d6634ad719dba74f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970956, "uuid": "2af152aa-fd7f-4d56-912b-5ac1382ccf12", "comment": "Malware payload (Mirai)", "value": "1b7f54d0717118633bdf335418f58853954c47fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970956, "uuid": "4950ee8d-12d3-4b06-b737-634129e28dd8", "comment": "Malware payload (Mirai)", "value": "c4b918e53fbdeb34ae1390f6c03c367c9cf378b46952c2ba5f7265f7fde26d4415617b71c38cdefc1153e5ecbcf74af0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970956, "uuid": "a5a2dba6-ea9e-416f-ab25-de9779cf551f", "value": "T11293394173694407F7A70DB12C3F6BF2979FD5A122A0A2C5695E9B0F8231E322586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970956, "uuid": "d234e3b5-faa6-48cf-8bb3-969ff9644ace", "value": "1536:y/Mqjty7lhHNAikrLYIHiv2PbRseA6s1v2I4jjEwUm+5q4o9b+5oxjpT3Oot:ZqQ7l0Vbue1F0wUm9bg0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970956, "uuid": "57644c0e-353b-4546-84be-81a84c5cb870", "value": 93640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970956, "uuid": "5a53a89b-810f-472d-886f-96e63c2eba49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970956, "uuid": "f92c5a07-50c2-469a-ad61-30e5212c53d2", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fe994d-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779974757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974757, "uuid": "5d874627-7d85-4335-8151-8c9767040cb0", "comment": "Malware payload", "value": "36fccb181a7b92887d01cd21a1aee283", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974757, "uuid": "02bd8e6f-a8a2-4b75-b652-7401430855ed", "comment": "Malware payload", "value": "e8cbe8c0f4425e647f1776c4bd8d8d841400c4dff647a7a1f108e831d8292348", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974757, "uuid": "70ca76fd-d8d8-4695-8feb-fbf8a5b38c76", "comment": "Malware payload", "value": "68e6c384127b26ae85971a32ae6511e7b4a9436b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974757, "uuid": "ae51ecb5-0cc9-44f1-bae5-4a1b035aab83", "comment": "Malware payload", "value": "d49936058f54251ed3b1c41ae3baea33d84ecee75f44a95ba0c25f3bed875eee6e920b15e9609d674a2f3cfda843aac6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974757, "uuid": "d52fb749-6b47-4285-9439-7e00e846213e", "value": "T117431FD43AE45CC6EE15627C51EA92322A3DF6D0CA434B17A53076321E13BD13DEB62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974757, "uuid": "648db109-e744-4256-bf72-1752d8726a3d", "value": "f013ccbcc27f1e4123860b78f486ce51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974757, "uuid": "52de08bc-45c6-43d5-90c0-379e7f3e85f7", "value": "1536:w4o+MNJNjlnL9Ta9ZoF3uaaMzQG6E6Aucw6UgsomsCM28IJEOs9Zx5d/IMdvzgj7:w4sNJVlLaIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974757, "uuid": "34f33873-d400-4a0f-96f3-6b09895ee50b", "value": 59331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974757, "uuid": "babf202d-8c74-4c9f-8902-3ce117a9fb1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974757, "uuid": "cfaabecf-39a5-4dd6-ac59-0e9609646f1a", "value": "certificado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8c55d7-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966448, "uuid": "0c6e62e6-28ea-46ae-85f3-384fd23e3152", "comment": "Malware payload", "value": "18648616a5e424f6c16676325db803b6", "object_relation": "md5", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966448, "uuid": "2ca5e2ff-f888-4108-abcf-31a6d77b939b", "comment": "Malware payload", "value": "e8e9674602e334e79263933b8d46f1fa505f661d378f3872921448a21ef2672f", "object_relation": "sha256", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966448, "uuid": "dc58429d-0700-4cfa-a880-c7451bec71cb", "comment": "Malware payload", "value": "2a3c59e37659d5df426739134998dc24e8d4387c", "object_relation": "sha1", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966448, "uuid": "e5e72a6e-3b58-44c8-a6d6-23dcec471d07", "comment": "Malware payload", "value": "55d0942fb2994c8e1ecc869dac402cad799bb4b06ab7ac8a657da5e37cea32479d4d9d1607a8a2459478b1a83a74d742", "object_relation": "sha3-384", "Tag": [ { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966448, "uuid": "5f8eca12-bab3-432b-b69a-c9388b2c8070", "value": "T194763336579F9C5CD83E08E33880CB78F46D713D26E958999AB0110153F38D29F9AEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966448, "uuid": "6cec5201-d193-4fbc-a6b0-d91ab48aefbd", "value": "196608:3jZ1Rr7XEaWuKi6SRmxZ1Rr7XEa9uKi6St3lNa:3jRnEiME6RnExMk3lNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966448, "uuid": "a7ccf9c5-f3f6-454d-b249-fc0e8d79fb22", "value": 7119413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966448, "uuid": "3174fe22-1f65-41c6-8096-ba582a89b5a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966448, "uuid": "0a99cbd4-3db4-4068-b229-79ed5573072b", "value": "test.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d6a083-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969848, "uuid": "6b1b467b-2df6-43ff-9789-6f7baa86d8f4", "comment": "Malware payload", "value": "2782b651c67b16911b2508beaf284262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969848, "uuid": "6f7716f6-088a-434c-82ef-33ddab00326f", "comment": "Malware payload", "value": "e90b71ee6c4851b5ed6fdf2ac78e15ca7b503618518e403d59c3e6aecf5c0d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969848, "uuid": "0f94e47c-8e1f-4c2b-9c7f-cf90b9efaa4f", "comment": "Malware payload", "value": "f946bd09d07344c35bb7bb324a3d2977fad9e781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969848, "uuid": "82a13c22-f744-4e31-bd0b-ff9f8efd34d2", "comment": "Malware payload", "value": "2503e5c54141f92ea82794e5c114482987ecacfaa7fc424c8d083ba3a34adcc3b8006f27f6e083ec8e55175a33905185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969848, "uuid": "6cf0b9a0-4261-49a3-8090-c06e7dd26d35", "value": "T1A4448D15B7A40CF9ED6B853DCD520A06EA72BC564761E7CF03A04A970F236E09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969848, "uuid": "c526e705-f106-4ad7-8468-9915e48a385d", "value": "28a35ab6e4e1b5d53856e1b65401fedf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969848, "uuid": "87e5f0f9-2e91-40e2-887e-1057ca250d0d", "value": "3072:kEsVTq4KomLzt/mnykXVwgfQoXfa6dpzfFFRu0LnWyaaMgefy6QDSVl/17:k723tuny2fRPbU0Lmfk6/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969848, "uuid": "2f752b72-4f98-4b63-9267-ebd6d4246b61", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969848, "uuid": "d932b957-9801-432c-b1e0-ae7f31858a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969848, "uuid": "79d582e8-3e72-4974-839b-4ddfa7946439", "value": "e90b71ee6c4851b5ed6fdf2ac78e15ca7b503618518e403d59c3e6aecf5c0d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ee30db-5a56-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779946301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946301, "uuid": "9728dd23-bf24-4014-9e31-42ac1917e72b", "comment": "Malware payload (Mirai)", "value": "d3a0330c717be6add43f68c130f5634d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946301, "uuid": "4b878fc0-5e51-4c54-af7c-a6099952d06d", "comment": "Malware payload (Mirai)", "value": "e959bbf197e9b3e1ba3c66af1c06f4858cf0d3308f3626bc5e8cb3b47f42e23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946301, "uuid": "f8acf18e-152f-481e-8a61-d807cec72bf8", "comment": "Malware payload (Mirai)", "value": "d4d2292dd221eb77d7295bd009e08a88b39d9c1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779946301, "uuid": "1f7b2b06-de13-455d-87bd-e31d37b74d50", "comment": "Malware payload (Mirai)", "value": "3d6ec7bcb8a3db1557c2a25d80ca8d83ba0108c149ca89aec7b9a1e83fefbd50c72aa8e3e3f7a1af237a12be97e9aba5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946301, "uuid": "8b21afc2-ecc1-4c8c-b9a5-6d608d386008", "value": "T1F4731986B9819A10C6C517B7FF1F014E33035798E2EEB3239D145B647B8EC5F0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946301, "uuid": "0557fbc3-6315-4355-ad45-88f8b3d261f7", "value": "1536:FNnYwmy6+c1jEWS16iT3rtqtli/NkCzVL9D11K7AyCcsI2i+GSdTL88T:IwuEEKbtb1hL9D3K7aGYTL88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779946301, "uuid": "3de6949d-b23c-43d8-8a04-79a9c7c9d17b", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779946301, "uuid": "129751e7-e74b-4f9d-bc04-dd8f88180467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779946301, "uuid": "5590eb66-47b3-4768-ac5a-235449328521", "value": "uranium.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b7518e-5aa9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779981828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981828, "uuid": "eeb96fbc-c090-421f-94fd-194db26c4788", "comment": "Malware payload", "value": "d40111f212eabc073a17006777a98633", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981828, "uuid": "bf625621-955b-4598-b354-7d494a581ab6", "comment": "Malware payload", "value": "e9634032df81334e9e960ab8b88ff05a0f7ec9c034dc012f816f09e23c18d41b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981828, "uuid": "979b43f6-3ed0-409c-a3f6-ecd9f970328c", "comment": "Malware payload", "value": "360d71eff7392b958321dc61e7f39fe7f44200ce", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779981828, "uuid": "56d1fc05-6771-40bd-b9e0-2f6836d73ecc", "comment": "Malware payload", "value": "560df82c145de0fcc7bb4e2d6b8c83b76a2e551787368e870a52a46afa5cca7e86092385e13a78da1c3dbb16948aca46", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779981828, "uuid": "a83734f5-7060-491e-b125-92bc689edd95", "value": "T1C042C093C9581C3634A971B674E576CB3AE0087868DE69DBECDD8B9B6210201B326DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779981828, "uuid": "5b798040-ea07-4f44-aca0-af4e0f62674f", "value": "192:6q9bIt8tWyNlfIftNf8/EXssCPXTRXAYaN5Mz88CTCtKqmY9x7U7UdvyBdrVCfGE:6gdf768+dyWYQ5d72tKqb9x7UaEhhrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779981828, "uuid": "ddd9ba3e-55eb-43cb-b7b0-f53423a23bed", "value": 12916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779981828, "uuid": "251b8ee2-2a69-4144-935d-e09f5bdce036", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779981828, "uuid": "c432eba7-e145-442b-8b76-20cd9b701786", "value": "e9634032df81334e9e960ab8b88ff05a0f7ec9c034dc012f816f09e23c18d41b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd067dd2-5aef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012114, "uuid": "4d85418c-b24b-4ff0-b734-c16f7844faea", "comment": "Malware payload", "value": "f7d564bcbdfeb8ea6a12779119f417e8", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012114, "uuid": "28ea021b-0a20-419a-b0f0-df51bc198ad2", "comment": "Malware payload", "value": "ea41d4b15a8e270f2113b16f050cb3e15cb5a5c85711fb6ec31dc6bb7279ba42", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012114, "uuid": "1df0ac69-2ade-4293-9963-1a6a8f3f48c4", "comment": "Malware payload", "value": "3b4b3cff8f42de84d58fdd304091b31a5b0290d3", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012114, "uuid": "b8291c7a-3cc9-4843-9c23-b04d87ea815f", "comment": "Malware payload", "value": "1a4cd643a591842baadc8bf1f29936b9c7a239cfdedbba3f0077f49e9a998d33f19ada543d34996aff35fa14a906b6c8", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012114, "uuid": "ca4647a1-3824-4229-a70c-0fe91349b4ac", "value": "T1F3855A067CC4A4B6D9FAA23288B152A17731FC990B2127C72B55B7B93E377D40E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012114, "uuid": "e93e065f-b00f-4ad1-9c51-63a99d077618", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012114, "uuid": "94301c9a-b739-40ae-8521-0173e6f433d1", "value": "24576:bBQ5ZEqSm3Q7ez7osUY/yVsiGhGDAkKlDJheSgk0H0s2+D1c7is:bBEZbSm3K2X/yVxGAdCDOSgk0g+D1fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012114, "uuid": "f0e983ae-dafb-4584-a44a-db2fb3c4e5dc", "value": 1761992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012114, "uuid": "a823c68b-4b16-46b9-860b-50fc383cb339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012114, "uuid": "6bdb9f46-ef5a-4546-acec-e08ed4681e34", "value": "GKGUIED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec46a0c4-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970532, "uuid": "b4e02c27-ca82-4830-ae07-0fcb05fd7a5b", "comment": "Malware payload (Mirai)", "value": "342a9420def4dc478ac50c10966bd2af", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970532, "uuid": "ff72aa5c-ae42-4791-be88-03a2c988d464", "comment": "Malware payload (Mirai)", "value": "ea86a93a67f3ef69d8c2e3c01153f833d7de80c318510f789728d4e4db9d0761", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970532, "uuid": "9cfa0767-e0b9-4b21-9472-36926ee6eb18", "comment": "Malware payload (Mirai)", "value": "282027fe55096d20be3d1460e0796e02ac0c1354", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970532, "uuid": "8daaf4d1-55dc-43a3-b339-14399748bb8c", "comment": "Malware payload (Mirai)", "value": "c3dd3ce0e56621621d65c646565cf64df6a3c5de237abda920315d4b4b6eb31bb63e84a835102ec933160f3900bb74d1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970532, "uuid": "1331e2aa-7278-4802-a484-d1790b77e8d1", "value": "T183D3B021E4006DD1EC2129F578BA97B80350EE740BDE1582EFFDF95E647BD9438AD2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970532, "uuid": "a11c8655-b987-427d-a171-866755a9a5d6", "value": "3072:PnicTtkAg7FSGp+VJE6AqUjq+c7zAbpb9/xg:PiySSGp+PMmT7zMplS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970532, "uuid": "cc45261b-3d48-4a4d-b1dd-8944c986a170", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970532, "uuid": "308b7077-e23a-4e60-99fc-2848104b2fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970532, "uuid": "50fa505c-7bb3-422c-ac28-9dd418854f42", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f633b72-5a98-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779974617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974617, "uuid": "d1528644-58a2-4e14-8308-82bfa093031c", "comment": "Malware payload (Mirai)", "value": "72bb6e4f61ee5577e01bd5a95131975b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974617, "uuid": "958cca88-906c-4da7-b46c-4da7990db066", "comment": "Malware payload (Mirai)", "value": "eb06a348a512b28ceaf3de3d20e1edb1a0326ef880ad128cf6a2bc24b25bf5fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974617, "uuid": "e2f98426-359e-48f8-8e3e-c9cf689bd731", "comment": "Malware payload (Mirai)", "value": "a405e966f94e5c9839f035ecba06226841ecca6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779974617, "uuid": "bc2d7889-5b24-4bde-b21b-aa1d571561ff", "comment": "Malware payload (Mirai)", "value": "fee2b51d8ee57c54e900d774f98357dbd6210ba9074c8fab19874077262546b640e3cbcb3978bff1298054e0e9c5f31a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974617, "uuid": "b996b33e-7ee5-4b02-81f6-dacae7551721", "value": "T1BA83A34A6F610FFBF89FDC374AE92B05249D541A60997F79B930D818F24A21F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974617, "uuid": "a7444356-ed77-44ea-a74e-1457dcc651f9", "value": "1536:Em3N2qK0YBEio6jWhDwYfMcQPJeTEPzA5D3/JgC:Ei0qujWiCbDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779974617, "uuid": "77302685-bc82-45e2-b18c-750eb018f399", "value": 88336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779974617, "uuid": "826c53f7-27db-496f-91c3-1475c23f74f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779974617, "uuid": "6f680aa9-a62f-4d12-8345-bc48999aca58", "value": "0046fab8cf1569cc88691ec1c1d44adb439f49eca8c5fed1f826c02f45c9e1f3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7adaa4-5a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970530, "uuid": "652316e3-48c7-4af8-b1d0-53d8563d827e", "comment": "Malware payload (Mirai)", "value": "8a5ee7e9247629950546fa872a87646f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970530, "uuid": "6b21490e-f63a-4f08-b8c5-3e3c25ab530d", "comment": "Malware payload (Mirai)", "value": "eb63172bdb29a02db9b096f362848ec08b766bf489d9a2ef0cc479d96a21f746", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970530, "uuid": "5697b30a-209d-460e-8746-5176f9b58a8c", "comment": "Malware payload (Mirai)", "value": "1afacfb3a27a5c9d1ed6b87408f6bda3d41da9fa", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970530, "uuid": "f0fa36ed-297f-4fb1-81c2-78d64e2f23d4", "comment": "Malware payload (Mirai)", "value": "5dce7f9acb27cfbcdc8a026636c4c8be7b6dca9fff5ca48bf71dc14261df771cb6e9d62528aad9c1c8be5abeffd68688", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970530, "uuid": "22aff1e0-43cf-4240-a929-79ac0814c509", "value": "T15FD3CF32E0086DA0DD2117B43476597C0340DEB40AD59243EFBEE5AE28B7DA57DEEB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970530, "uuid": "b503dea0-1895-44b7-b70b-2d2fd2a0922c", "value": "3072:jNOFV2mOAc6NBmjOd1CVOHVv3WDxGGRhaUNhkv0ZG6:xOFgpOEoVv3MXL5NhGOG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970530, "uuid": "12a6bf0d-1700-4dab-b235-5c5e6867a7bd", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970530, "uuid": "dc205b20-55c7-4880-8af8-5f107dcfaa8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970530, "uuid": "d8424061-b9cd-482c-bec2-2dd996fcba82", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bd3572-5a85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779966581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966581, "uuid": "ed8a7e88-21e4-4af4-a971-23007ed4cc2e", "comment": "Malware payload", "value": "0a77cc487fb4cdb74e2c3937b48bddf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966581, "uuid": "0459a314-f9e2-4c4a-afa4-e3e28fd269c2", "comment": "Malware payload", "value": "eb854d319ec7513b09c40c432ac3606449c1d1be661bcc771d751a49c0e97b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966581, "uuid": "47da463c-0fae-4e24-8a15-a0c91a7b5dce", "comment": "Malware payload", "value": "dbdb582fdb6d0218ff6bc32915503104dae42605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779966581, "uuid": "616bc459-8f1e-4198-9468-7ad06aeca493", "comment": "Malware payload", "value": "dccb567c08e28e834bb96dacd324dfa765a10e7f07bd092656a9d13a6119ec84122e161591c479b76601daaf4d36a813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gitlab-com--Hoangdepzaivcl", "colour": "#505186", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966581, "uuid": "747b6a86-0220-4686-90f9-10ffb018ad2c", "value": "T12375024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA61F23BE05E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966581, "uuid": "90883903-0b7b-429e-899b-fa928bfc3223", "value": "2f2e89dfe589208550c326494e73d786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966581, "uuid": "06d2ba08-047d-4bb9-b121-31c48de057ca", "value": "24576:76LZKAy/5tmx1Y51t05ZtP7gQA+YXIySn46BKuK+mqsc80DM2jlX6cw:YByhh51t0jaBm4MKuK+mqScjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779966581, "uuid": "47054f5a-5952-4005-97e0-b88a01574bb0", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779966581, "uuid": "3f35f665-1b8a-40d0-a0b5-5bcebb68ce94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779966581, "uuid": "fec9e9a3-e86b-4cee-ba15-3eb73d262b7a", "value": "b(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62d8ee6-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "a395b08a-e59f-4e2e-8cff-a85a505bd96e", "comment": "Malware payload (Mirai)", "value": "d3ab43fd00f94fdfd79bd11b77655f51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "cf530e87-acb1-417a-81d9-b1ebd6a62125", "comment": "Malware payload (Mirai)", "value": "eba52db8708a56f6fca56aa558874bbe6fcc7527b716fa035d67943f84891721", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "d1092300-79f1-4bf6-99a3-8f4f51a663a2", "comment": "Malware payload (Mirai)", "value": "2d602685dca53952285c529f2cbcec886919fd4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969555, "uuid": "0a4f4631-a2e9-4d46-9006-6c7704bf3ec9", "comment": "Malware payload (Mirai)", "value": "f614fd14a93eec43ded9ce8ef9721fa0ee07d9acb2775cb3aecfa8e61f035e56281f4bbfc097302f874a377631f86980", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969555, "uuid": "ca561ae7-378d-4bf8-a8a7-b9b36938d07d", "value": "T1646308867CC4C602C5F060B6BB1FA1CD376643A8E3E6B153DD19AB1E635F89B0A37215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969555, "uuid": "947ae76e-b3e4-4d49-9603-400045d5e496", "value": "768:wvWD88+GrCktR4a7eSUO6plfnWcd+ZfN5M5a2UwCw9+utFRk3vi8eh9J9cTP7zJ1:nDeQciuVtTz8etlTmYLpZ/DphFL1/ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969555, "uuid": "7945e248-8db8-4283-90b6-22a78218788f", "value": 71280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969555, "uuid": "75c5d785-c20d-41d4-9158-65a7763064e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969555, "uuid": "3d32743e-9e94-4df9-b774-2b92390c1ecc", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0662c8b-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970002, "uuid": "d567e229-a108-4fce-8774-1ae4750c215d", "comment": "Malware payload (Mirai)", "value": "d0fa562b23e593b7a4abdfae980b113e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970002, "uuid": "bc19b5d2-0d3d-45b1-93db-cb16e75ce8ce", "comment": "Malware payload (Mirai)", "value": "ebaee449188a52d6360ca2aa030a76bd7703c9065f94875a9cf48f5339d6b627", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970002, "uuid": "5d83728c-cb39-4125-9a47-26b85a32c57f", "comment": "Malware payload (Mirai)", "value": "3ff0711a7ee12be074e2d810e812632310811b8c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970002, "uuid": "14144961-3eb5-415c-8d85-89686845da46", "comment": "Malware payload (Mirai)", "value": "600847789682cf8a9565ce4f3e4ea4e482f77aa525c1c72c33cc6cf25c9bf55993a2164cebb4eba0d56eafbeb8ef99d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970002, "uuid": "3e1f5fb8-8646-4ff5-bfb8-b8cf5b9556f5", "value": "T166B3C80BBE529F7DF32C83344BB78B399755239633A0C585E26CEA105D6028D686FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970002, "uuid": "180b5a75-669b-4997-90a9-24e5e009dd9d", "value": "1536:qPMly3l9Ogfy1y6q56qapqD5UyPkUl3d3HTO5AVAabBVCoPVhKuDglOj:qkGl9c1K9tjO5AVAygWrgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970002, "uuid": "76f418e1-90f5-44bd-9d71-3d7535b839f2", "value": 114356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970002, "uuid": "b24ed200-f390-4da9-ba53-621642f019b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970002, "uuid": "c873cf46-f39b-4b85-b858-ae5a042aa147", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098a4760-5a3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779934073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934073, "uuid": "5de9236a-3445-4251-98e7-c9e55eba9f3a", "comment": "Malware payload (Mirai)", "value": "30d53aeaf9e2d03d9c4cabd9bf593967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934073, "uuid": "e181d2c8-0c5d-4e10-b083-ecaa4404d799", "comment": "Malware payload (Mirai)", "value": "ec5cfc4bec5bd0822940e33a52c1aaf963339d28e1e0d855c2fedcde37c56377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934073, "uuid": "286abc22-3317-4fb5-9b03-5835c5da4330", "comment": "Malware payload (Mirai)", "value": "1fe47d8568e9c6bc261655b6a42de0863e6ab756", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779934073, "uuid": "92309b52-d11d-485d-a069-2a56f2642924", "comment": "Malware payload (Mirai)", "value": "ebde7cb9d3194e8ddd7e15b2f9dead044a383b7e5ceb97006f4b6a134490edbe0e4a9dfb3ab7abd84f5d02a143ee426f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934073, "uuid": "916575e8-8f1f-4c90-ae72-48418ec14ca9", "value": "T14FC66B91FB0CA165DE4B0A3284670F74B3A01D42D2E5886B8349F32F45B26F77A4EED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934073, "uuid": "0c35bd08-bbf8-432c-8df6-aac267e1d6b7", "value": "196608:deY8UyN3H/qo2yqeZ6/dBC++91nz+SGp8grz8xU:krw/dM++91nz+SGp8grz8xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779934073, "uuid": "dac405fc-70a2-488d-b3ea-805ba91d2fa4", "value": 12517538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779934073, "uuid": "6a3a8225-a129-4843-be36-9adbd1c1c147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779934073, "uuid": "7c1f1a0d-7f95-48f7-a414-ac223352b0fb", "value": "wife.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e32a2fe-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000358, "uuid": "de4e79c4-6be0-460c-9738-46a339762f03", "comment": "Malware payload", "value": "06bf9417370cd8df7ef4b0a75721ba55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000358, "uuid": "d37b98cd-1315-4e50-b93d-887bbfbb4472", "comment": "Malware payload", "value": "ec95c31ea69cfb9163422846435810bea89613c17dc246cc3385b6ea1c0978d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000358, "uuid": "b7308fc5-2f6c-46f1-a7ad-313cbe741bf2", "comment": "Malware payload", "value": "c50ebfadcd5804d76ab83209c51a93c99f758b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000358, "uuid": "507c9016-34b1-4583-abdf-2337b2ab9133", "comment": "Malware payload", "value": "fe32ba49af6796fa655485bfb683d5818103d72b8dbfb67e8870e89a943e307e254805f05e440c95e3125422c0e94305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000358, "uuid": "ed412ae3-528d-4d9d-968a-f69a8bdd6c7c", "value": "T10E8618137B68E70EC61922340DF1CAD4276A1C9A06D79527B785F319E9F20BC4A6ECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000358, "uuid": "37d67652-f5f0-434f-9932-36d57909ea4d", "value": "49152:/MUsTzPfTx0GmddpySIKG2XfGcBzN0rXE5GPx6/nYQhds9r5yaIfWilM8wFihsdL:NGU/GQ/U0W9ie/b7nEjEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000358, "uuid": "ba105f52-f3d2-4d37-8154-8b300e674352", "value": 8257751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000358, "uuid": "327ea343-10cf-4a5d-a8f9-034cc62a5499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000358, "uuid": "3699d6ac-ff4b-45bf-8f42-49ff4c5d6a6c", "value": "vulcan_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec507a88-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "ef1879fc-1ed5-4dd4-89cd-918b45d7e2c1", "comment": "Malware payload (Mirai)", "value": "427647454897446c5f9ccda0075cc4d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "285e47bd-4d61-485c-be97-f6ad43f71b1a", "comment": "Malware payload (Mirai)", "value": "ecdfdb652582ebd5115141cf77e2235ddff0385760c7c6d4a112f8401841d11c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "7a48dd3d-1df5-47cf-8b62-6ab3d10f8d4f", "comment": "Malware payload (Mirai)", "value": "bbc8d9931a6ce8cf011ddd4a194e2ce15fdb99ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970961, "uuid": "07aa803b-f333-4cdc-b270-f6baf1362a8f", "comment": "Malware payload (Mirai)", "value": "be666dff969afb7abdb13596de920dd0a61fae6f9dd76df74b30e605c40f42f8ada981084fc55b48f2c571c3d9c7755c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "75345926-9b72-4694-a2fe-1c55b0f7d13c", "value": "T1D4932A86BCC1C712C5E1A1B6FB1FA1CD371643A8D3E67213DD18AB29674B8670E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "9098a419-8a96-48bc-b807-5d0f51825683", "value": "1536:M3de4Z1B216D9ByruTdpTrvV5ptcg8GQ7BZmUb+aT:M3dzz2gRhRlrvPptcBoUbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970961, "uuid": "a6de23e8-9b72-4664-91e1-cc961d01be92", "value": 93324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970961, "uuid": "b64860cc-f3d7-4629-ba8c-4e8e78dd0fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970961, "uuid": "701cc3b5-1bef-4736-911f-13a14f0b5580", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf5f1e7-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "7ad92426-7b7f-4e7b-95ab-6eb48d29958a", "comment": "Malware payload (Mirai)", "value": "73e9a4aa55717de38154835816468820", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "cdffc7a7-9c4c-4066-9b47-6136d913a696", "comment": "Malware payload (Mirai)", "value": "ecf336e19af1771f4266ffb6f2101438ea3f26506de1b22ccd35e9537a923c82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "fe9aa413-2b7c-463f-bd16-dc4b9862bde4", "comment": "Malware payload (Mirai)", "value": "39a7a0c2921184f2ad2c463e51e19430495ecaf6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970959, "uuid": "86a0a1d9-8439-4bcd-a944-ecc63fcbece6", "comment": "Malware payload (Mirai)", "value": "3ae58b30a5df772710644051f00c6e8fd32e3877bd07e7f4ed3bf99f96fadcf3039e5ffd463a5a4049c6df6682eed4c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "cc33e9ea-2c7a-4d70-b8c3-b78de4b2b58e", "value": "T14C831846B8818B12C5C512BAFE2E118E331357BCE3DF73169D206F24778A92B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "d79e101f-dca0-4cda-873a-6d9bdac315c4", "value": "1536:Mon/vnfHAcCPwAww2L+uumSAbTydaaCNf2QJWMLiuFK9klLC5rYeS:3fHA+w2L+uum3bTydaBFK9kLCxrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970959, "uuid": "1efc17f0-3168-44f6-b06b-d30d530a1fbe", "value": 83380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970959, "uuid": "8779664b-f411-47a8-82fc-3d251d5d2a0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970959, "uuid": "5468777c-cf06-452c-9a63-519f89208900", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecb1521-5aef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780011848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011848, "uuid": "7aa7877b-e4fe-46c9-a256-6aee2bb8778d", "comment": "Malware payload", "value": "99ad2ddf6e557a1c47845ec44fd461ca", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011848, "uuid": "086c3773-9ce7-4c40-a6e8-c113a2d42d58", "comment": "Malware payload", "value": "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011848, "uuid": "ab482c23-e4b4-45b5-84c0-b90f7bc52e53", "comment": "Malware payload", "value": "2abc1eb6da0a9d20b19b10ca1477e03b164032c3", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780011848, "uuid": "227b7d61-f4c0-4277-8af0-d119d5076135", "comment": "Malware payload", "value": "2e06c98b3336c03762a4ee925cb45d16e210c7110fce745021b929802f4a186067abce4f6d124a3c2d747f463314ee96", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "dust-packetflow-cc", "colour": "#8ADED3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011848, "uuid": "ca05d682-c400-4015-8cea-46fa54e4ba2c", "value": "T1B9267C00FCD719B6E40623728AA762AB273999064F329797EA44777EFD772D50C32309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011848, "uuid": "87dc1e2c-ea64-44cc-8c1a-d53c0764fd96", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011848, "uuid": "810235f7-8c39-4706-8993-10a6e50c49f1", "value": "49152:mbLf6J44F4KSnasi4/LsmJK6HBzbsO4iSC:2z6JP5rsi4mLObr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780011848, "uuid": "8fa87a20-dcd8-402d-af61-81224472957a", "value": 4619904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780011848, "uuid": "7c63e4c1-90ba-40c4-9e30-e5beda47420f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780011848, "uuid": "1265e750-2fad-4957-ab9b-d461f2fd7603", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2b00d0-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "9eff8969-cf5c-4637-a86e-61ab8141585d", "comment": "Malware payload", "value": "5ff5ead32d4b9350538708ef367e5aca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "65e97819-5fb7-4254-9263-27f92ba945f6", "comment": "Malware payload", "value": "ed687091ba91fa8931c2ef5666cfee269231bfc1dd0b6f590833b69da4b9ec21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "fa022275-7aae-488a-9ce6-964866fc2877", "comment": "Malware payload", "value": "1628af9beba63cde4359064aaa5505a25a950312", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969079, "uuid": "635db43b-dadd-48c6-aca2-f4adc734b963", "comment": "Malware payload", "value": "441848c5f04f8d96f9f9dfaa345c1c228a6eb629a91dda865aa8e842667840e9c4b9e5ff405bb1f9842e540b57051c31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969079, "uuid": "9fa8452d-a668-44ff-af26-f7862b41ed51", "value": "T15A21D3F1D29422B3A5A9803E7781E564258140F34C87FC7CBC1CAA21AFC269DB6356F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969079, "uuid": "5befa5ca-b999-41b4-99be-773833e5e074", "value": "24:bmdTY2WF1Jr02L7TY2Lo1Jr02eOBt2LIOBt2O3NtOt2Lk3NtOt25j:bMT7i1JbL7T7Lo1JbeOBALIOBAwXLGXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969079, "uuid": "f01fa600-b670-41d2-bc23-8f7652dde41f", "value": 1181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969079, "uuid": "f94b9873-379d-4b01-b11f-223249ca0d4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969079, "uuid": "3191ed64-f764-417b-beca-8b67ea85d8a8", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd73acf9-5a70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779957622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957622, "uuid": "7642dc42-5bb5-44d7-affb-43afce5dccb3", "comment": "Malware payload", "value": "cdd3140d4c1d0dd95fc03a96f66b122a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957622, "uuid": "25ac38e7-1a25-49a2-b7b4-396a856565f2", "comment": "Malware payload", "value": "ee03bd0fa17aa2e76bcc9e66415e27e3fda5512933e9a5cd4a54b3e3dfcfbe7d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957622, "uuid": "dd0b0129-82d5-4c28-956e-48e367af9691", "comment": "Malware payload", "value": "0668c1781fc33ae09af133274cb7a0e852a6f53c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779957622, "uuid": "8df06b5c-5a51-47e7-bc1f-5dfaac9b4bbb", "comment": "Malware payload", "value": "53097d2f752baf1789d444e67ad5afb2232318b7b19ec9c1e70eb410598931b2ddb6dbc3e5cf3edfbb636f86be4b47e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957622, "uuid": "4ee88482-98b3-4af6-a9ac-81a28ea458b4", "value": "T1A7136C6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957622, "uuid": "88973821-9270-4eb6-8cf9-9510607a9808", "value": "768:LXRWNGxVP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:FlxOcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779957622, "uuid": "2bc22d3b-273f-4f67-ad74-9404d6ef62e7", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779957622, "uuid": "9beacf62-cc5b-47e1-9eb9-62a53f772994", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779957622, "uuid": "2c80f34e-c4a7-42d1-9b1f-b30fa9db831c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fbfd45-5a81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779964862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964862, "uuid": "763a4595-83fa-4fe0-81b2-7e49c47ab92a", "comment": "Malware payload", "value": "bb15c7179eb5ba2599892ce77d9cf3e4", "object_relation": "md5", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964862, "uuid": "74319581-f878-4185-9431-5d8ad1e077db", "comment": "Malware payload", "value": "ee581d2e117a2f9b036188c76a994b6c7dc3c966e797011541c061aa62941c29", "object_relation": "sha256", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964862, "uuid": "7ddc508b-15e7-48cf-88a8-bf073efaa24f", "comment": "Malware payload", "value": "61427b63d55dee9cfbe81ecdb2073e6e6b3efae5", "object_relation": "sha1", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779964862, "uuid": "abb00120-25f9-4e6b-a1c3-5ed2466646f6", "comment": "Malware payload", "value": "40d2866f81f192b73e94634e886cea08bd1a628a0663e027b238c6be13542b3ad9d201e6f7728305a334e72112e865f5", "object_relation": "sha3-384", "Tag": [ { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "Vertex-Global-Solutions", "colour": "#0E6D5B", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964862, "uuid": "46da6af8-b347-4d0c-be6b-8f142b0501f6", "value": "T15F08BE47B2A445A4C1A6E23CC966876BF376FC194B2083C701A5BA792F337E41D39F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964862, "uuid": "9bc4391a-f004-4b9f-bb9a-6fd7f4d9c6c8", "value": "1572864:3LH+g48cBCx5x55y/pZ08/xLZ08RBCx5xd5y/:6gzcBCx5x55yBZ08/xLZ08RBCx5xd5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779964862, "uuid": "a34086fa-4886-4d66-80a3-ef60d617794f", "value": 79855616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779964862, "uuid": "158d8b97-a8b5-4b91-be01-71b3e8c2f594", "value": "application/x-virtualbox-vhd", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779964862, "uuid": "6378f9dd-e433-423a-bb80-178c54ef614a", "value": "Invoice-Vertex.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240dccf4-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "b6a8d88c-27bb-4c8c-995a-831e61c1e665", "comment": "Malware payload (Mirai)", "value": "31b818464f02e99f1fd9b64b436a8db4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "d728c18b-223f-4d8e-8943-dee092410fe4", "comment": "Malware payload (Mirai)", "value": "eeb2bb1e2801c99013dfc719d6b88262d586583fb2946b87b9f57aa75edf0e2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "c9421ebb-b621-4066-a300-4d5a7d62e4d6", "comment": "Malware payload (Mirai)", "value": "9b7bc3d20434511ffc65838e1c335ca52ea72b65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "83e184a2-ebac-419b-8877-2255b4b8a674", "comment": "Malware payload (Mirai)", "value": "bc6571e29cdc5732a9ebed0916f2eaea2e95c57ac6fa4fef2378e7e2eef8acae7142623b356050a5a79ef7347362f3f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970625, "uuid": "474f4647-3278-473e-9894-deb4e26f6968", "value": "T19AD35C0A78D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970625, "uuid": "16101683-f7bf-462e-8359-b44fee068af9", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQr:yIRfe3xvvSrlvZZ7Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970625, "uuid": "51431b5b-36aa-42be-84bc-776f7e584d4c", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970625, "uuid": "fb3b4304-65e7-4c8e-b4a5-d152edb6b820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970625, "uuid": "67ee0788-e3c3-4601-8334-46ca7edfb1fa", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a9b36c-5a32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779930634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930634, "uuid": "2f074f86-f3a6-4240-a194-66623c4db6f0", "comment": "Malware payload (Mirai)", "value": "2f2f63c01fd3a771b3b30188cdbc591f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930634, "uuid": "59970da2-320c-41ab-b8c9-33cb00ae329c", "comment": "Malware payload (Mirai)", "value": "eeefca5ffaf196599295bc136a2766b094838d70fda757fd00076e284cf0dce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930634, "uuid": "8ec615a8-3bcf-4a26-9160-eba834350134", "comment": "Malware payload (Mirai)", "value": "a711259ee68efe880bab46442854051bb54f9027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779930634, "uuid": "446f1180-e2f7-4e9c-8515-e890f84ec120", "comment": "Malware payload (Mirai)", "value": "10437f12659cbf3ef75c0f709d7f44bf50884a68eff55e58ae26e697e7c7aa1f4ee2286e6bd578e6920e7f987ac3cf6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930634, "uuid": "22823ef8-6d6b-4511-a5b6-5a662f01ecd3", "value": "T16AD64847FC6915E8C1EED534CA6692637B717C495B3123D31BA0F6282F72BE06AB9340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930634, "uuid": "c3e524b5-9248-4a8c-a1d7-e18eec0ee2f2", "value": "98304:4arrV6SptQqJnxXk1np22hvjY3++91nz+SGbTaBh+CED:4AASjw/jY3++91nz+SGb6YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779930634, "uuid": "46ebae16-e159-49c0-aa87-48e3a3d66b75", "value": 12820745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779930634, "uuid": "267dc2c0-2b2c-4ee2-a849-778bdac88086", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779930634, "uuid": "a500cf8a-876f-4c96-84eb-0f25a210c6c5", "value": "wife-bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1d63da-5ac6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779994454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994454, "uuid": "de3dffa8-7452-40f7-80e1-956e9853c6c1", "comment": "Malware payload", "value": "26cbf40afb58652750d7c335bd99c1be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994454, "uuid": "0d701890-27f9-4530-9d33-e7b7b4c2dfb5", "comment": "Malware payload", "value": "ef1e1fcf9feda5f16c1bbc33d68efbb12490ff93ed2c92a6906c72a9a715a72b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994454, "uuid": "bb4dde6f-1125-47a5-83d1-1400ab0df109", "comment": "Malware payload", "value": "a72df49a82436cc4627b020704f4528c6d56a9d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779994454, "uuid": "abffffd8-1d44-4e5c-9c70-529e5484d414", "comment": "Malware payload", "value": "9e3728d861e093f72393fe016ed4c6692aad7c25a38b212d3cd2a34b18acda47a09817c910302b1c38fd1b14c400c423", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994454, "uuid": "408bd750-2383-4985-ad1d-94e92a53aba2", "value": "T11537CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994454, "uuid": "4be1dcfe-ba29-4b26-a090-6f5fcdf6cc75", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQS:cqYUQuVDt0TZE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779994454, "uuid": "62eba5b8-ed68-4dd9-8720-1bcc0d0191c1", "value": 23592960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779994454, "uuid": "d8b06f62-b045-4ceb-a588-dd370b85c697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779994454, "uuid": "54c6f218-21a1-4ef2-9856-76d052856380", "value": "20260528-103246_sftp__root__2579425674836600089_sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2517024a-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "ac68d5db-6c26-4cb6-b6cb-96fd841e5e94", "comment": "Malware payload (Mirai)", "value": "37c408c6521d87aa1901e77885c45f90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "57dca7e6-b1f7-4bad-a7cd-e5908d01257b", "comment": "Malware payload (Mirai)", "value": "efc158644bbeb866a43082ff68b0eb4dd712e9caaf4d17a48a571067f9eaed13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "f1d33944-2196-46e0-b66b-55ece6ad1a2d", "comment": "Malware payload (Mirai)", "value": "513f65d93d04d02cb956938da055567f0a332e89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970627, "uuid": "1866ba72-f1e2-4eec-b832-1493109c74bb", "comment": "Malware payload (Mirai)", "value": "7d25e69e98e07eadc955fa4aa869518cbcbec04ee6c0ed5d6e5221006d268df098455106edf7af3cd827dcf52034f292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "132a12c0-435d-474a-b108-c052b9d0cc87", "value": "T18FC3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "204b0b57-2494-4bb2-854e-d35765b27289", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMPN:MwCvdHmezn0nUPMu9KryXsMPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970627, "uuid": "4ec091aa-735e-46fa-bb35-15b67aac8c78", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970627, "uuid": "e7230b7e-c3f4-4aba-85a9-407acd4f190e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970627, "uuid": "1c3d62da-abe2-4ccd-a87b-33fbeb48e8cc", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b7d128-5a7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779961951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961951, "uuid": "1fa0d448-2f2e-47f4-9e8a-ef2e1b51012e", "comment": "Malware payload (RemcosRAT)", "value": "2e4bc9317cc3c42bfbac7db8fdb0f53b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961951, "uuid": "070a745f-8056-4f49-8c22-e9197f2b3957", "comment": "Malware payload (RemcosRAT)", "value": "eff53185baddf63b12ce35450fb5ff8dd0951c1e561d7e042e8a630efa28268e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961951, "uuid": "39792c7d-9682-40ac-ac36-d8b2037ef5f1", "comment": "Malware payload (RemcosRAT)", "value": "76937ac519d809e600da9f574dc54c899b03022e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779961951, "uuid": "9c5963aa-7655-414d-882c-427e4f79f8b5", "comment": "Malware payload (RemcosRAT)", "value": "9dc17277d01ed57d597223d8b9ddcb16c121bb1ec6b2bdee94b2a464f0ec3e3919210f6ee2554aa09ce496ab29ee173e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961951, "uuid": "c6286cea-ccfa-4179-a747-e7f4850a59ad", "value": "T124D33920DDE007791E4317AEFD951B21C5FDC629422280FCF6D9171DA00A9BCEBBE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961951, "uuid": "e3225482-765f-4aef-9069-643dba6c9956", "value": "3072:0cu02QT9d486uTUq/jN1kTPQAfIszqn8/iE:402QTnPT/jm4ij28h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779961951, "uuid": "3bb798ef-a8d3-40f4-97a4-1989cf174874", "value": 140749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779961951, "uuid": "8134aa76-662a-4b62-910a-bc6e41948f83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779961951, "uuid": "c929ef8f-d69d-459e-97a5-629695a5c710", "value": "SE26050883.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a8c637-5a95-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973421, "uuid": "8a43f82c-5f40-4b6f-892e-f239f462e69f", "comment": "Malware payload (Mirai)", "value": "4dc53614de55731295379ea8b9ba5bbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973421, "uuid": "dddd4dbf-05de-49f4-8219-a2c365f060ab", "comment": "Malware payload (Mirai)", "value": "f011142fe76b4400971b7b4dc76d7e9510a89ca65e505a618e4635dbef8d59cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973421, "uuid": "a0b98780-fec7-463a-bb03-9960d03740fc", "comment": "Malware payload (Mirai)", "value": "0352a3f7206e8d320cc7fad29f29875c2a8270ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973421, "uuid": "0a0b89c4-ad2b-4806-9a5b-a562fc8e6342", "comment": "Malware payload (Mirai)", "value": "c8e922898d0a65e8eaf5a4046058981f6116b59fa6422e8871be22b16fa9b623deb7c3c0afe29a2677643c48888fe0ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973421, "uuid": "191cdea0-c64c-42f5-b10c-fd6eb658548f", "value": "T12FF3F80ABF610FFBE89FCD3746F92705148C591626A83F767630D818B64B28F26D3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973421, "uuid": "3c6e9388-4b0b-4f88-9af4-ad7885f8f112", "value": "3072:RYhVQ1F8dwAxjfX1RFDH6WrVPEjKxiFKKXPE8:Chg8d3xrX1/OexEGkFi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973421, "uuid": "1109bc15-a2a3-4017-993f-12d43bed9bf5", "value": 170644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973421, "uuid": "9612066c-e0aa-48b4-8dc0-92e8851adede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973421, "uuid": "0bc390bf-5260-4d69-b94a-c39baf29880e", "value": "023782pler.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b0341e-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779969257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969257, "uuid": "1796ee25-88b4-416b-b12d-e81b37034e95", "comment": "Malware payload (ValleyRAT)", "value": "227c216c62e2d878ea826d262465b218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969257, "uuid": "42cc5088-5c4f-4e15-89d1-660d6e0b6775", "comment": "Malware payload (ValleyRAT)", "value": "f02324201e28de1fe0472ce27265f57111f881d986253a265f328b329ae026d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969257, "uuid": "c4e60352-1663-465f-9ec2-991ba6b3fda7", "comment": "Malware payload (ValleyRAT)", "value": "8d878d29a2cff8f22559a32845faeccd70c7f989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969257, "uuid": "e6e37589-1f28-48dd-85bc-64e182ad074e", "comment": "Malware payload (ValleyRAT)", "value": "d8826c1964c4af4ab0525a3d894b6f93fd4d66b7545303eb3579e3df6464c967e6cf524e837f6988fc08448247d8adae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969257, "uuid": "3b11c868-d52b-4d1b-adc9-a1e21495a594", "value": "T1C6F733422BDDEF13F6040F7BA67A95D6005B7D41DCADB82E937DB00443BBA36948629C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969257, "uuid": "9128bcad-42de-4af2-8d5c-406d91ba5c4a", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969257, "uuid": "15af3187-ce6d-4570-a0b1-0b59af99f535", "value": "1572864:HjtYoJIh1cemxWXnMsXfCQGjVm4fl6izMO+oVoqKrEuMbNoadZFfOTaA7jHta:HjtYoSWemEXd6QKftVzJV7Kp1anhcBta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969257, "uuid": "2f3f5c0e-fe45-4614-8d3e-97d879d17ba8", "value": 70184418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969257, "uuid": "ab7ddb9c-336a-4cf1-b0a0-04328892503f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969257, "uuid": "00760c81-9ccc-4bc1-8ba4-81bc20b0a6b8", "value": "testup-x64.6.71.9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f86a9e-5a8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779969899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969899, "uuid": "b276d135-6834-4b3a-a75e-b656fe7ceec8", "comment": "Malware payload", "value": "29d3ec5d94619f724ceec8e93b64e02d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969899, "uuid": "2b24e929-57b9-4896-ad58-b8417ebf7a12", "comment": "Malware payload", "value": "f05e40494c92fa17ff66447a79a2632defd9b2533dec4a301710f1667f739a1f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969899, "uuid": "c373ecfb-7f2b-473b-983b-9774dfe2aba8", "comment": "Malware payload", "value": "1c17d34e0a171af0edab2dce237ba380cf62a414", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969899, "uuid": "9661b88c-019b-4aed-a40b-c18a61a04d2b", "comment": "Malware payload", "value": "1ac7ebdc589c4929c2fdecca570da6bee52ac6b6770b48e50fb965955227a34207dcb3d874334eb3cf7e279dd9019047", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969899, "uuid": "275dc1b8-fc7f-4330-8666-587b0bee840b", "value": "T192211EC164D63B7ECCE9A5273706203D112969CA2E2B1AC8DDDA68DCE3846C2F160D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969899, "uuid": "47818f52-8056-4fdb-bcec-e79584820ce7", "value": "24:yleEBvi1GlTBFBvK9hPlTeTtqBvTm7TclV1BvWPDJBlE1HEByTvDp8cPutqBVSjB:yleoviclTB7v8hPlScvIwlVLvADPluIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969899, "uuid": "dedcf2ad-0348-417b-bfbd-b8cde5dd5694", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969899, "uuid": "64de5a1c-2a7c-4332-a407-29db2756cf75", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969899, "uuid": "11307ae9-0489-44d3-be95-d7530edf9a87", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cd7009-5a35-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779932128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932128, "uuid": "693e1c4a-d49f-4080-be2e-4c9bb77db448", "comment": "Malware payload (Mirai)", "value": "9b8a50279886655fd2d99bd456ffca46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932128, "uuid": "75094167-0cf5-4c6f-91f7-efeae5328ab6", "comment": "Malware payload (Mirai)", "value": "f079a36015b9fb9a1709ef7cc3c19a4d114f27e939614d2e0da9c5464958f799", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932128, "uuid": "1038dcf6-1ba4-4214-a8e3-7413eae593ec", "comment": "Malware payload (Mirai)", "value": "9293bbd2821209696bc270f64cebc2e3297f683a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779932128, "uuid": "9eafc8e4-9c88-434f-a663-4a5a91b8b8bc", "comment": "Malware payload (Mirai)", "value": "9f920262655acef6d79e08959e27593b47542093dfae1b336441ef16a5b9d4af7394d74b9413eadd2a8c4d963377f6ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932128, "uuid": "9b9553f3-a0d0-41cc-b464-05d155905834", "value": "T1E3C65C43B6099DA7D3B71F30D8342A42B63E9D056B095367D35BF72CB8B63024A2E785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932128, "uuid": "6442e51c-eb30-41a3-a796-a2492b908048", "value": "196608:FriDucF4QlfhdLn3hKTC8H++91nz+SGq92+pkiZ:MDucF4QlfTLn3hKzH++91nz+SGq92EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779932128, "uuid": "2b08c9d8-5f66-4921-b644-dae849ef6e93", "value": 12583074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779932128, "uuid": "4bc52e8c-b5a4-4c37-bd09-58928e488e98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779932128, "uuid": "77c6633a-a192-49d6-acd3-d9167416ab74", "value": "wife.loong64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4bc5f2-5a96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779973939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "86743d0a-4354-493c-83c2-83c1dac5b2f9", "comment": "Malware payload (Mirai)", "value": "4f60173e4c03a0141c256a975f9261d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "b75d3df2-6c9c-4839-bc4d-5cb59ca91016", "comment": "Malware payload (Mirai)", "value": "f09d248d2c919cfbec61d5ae92496ad104ee89d763f28b764b3bc2691c7ee397", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "cb2218e4-d43c-4e59-af0b-30c9e1280072", "comment": "Malware payload (Mirai)", "value": "b1750f742c8d99bbb89546397b8bb4ced7b09e4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779973939, "uuid": "878ed052-40aa-46f0-8624-dc7194cad9fc", "comment": "Malware payload (Mirai)", "value": "68e34713a4e6b952105ca5b170b943c5a7163caca67453e45155dcd5db1b27b0d7575189f344d6c60614acadc2ec0ee7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "913ddd5b-e2ff-4ba5-a2af-61bb7d71bac6", "value": "T195B35AB3CC266F68C265E5B4B0B48F792B93A960818B5FBE5577C2748043D8DF6053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "a9e0df62-08bb-42d9-b13b-b80af08d00fd", "value": "3072:MW1Wk1jbHIORhXz731Rl3L2rDWXx4yMF:Mg5jbHIORhXz758SXDMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779973939, "uuid": "d9cdfe76-1db4-4205-abd6-58cfa8959970", "value": 113248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779973939, "uuid": "c503a600-f93f-4171-b29c-3c7ba138e134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779973939, "uuid": "329913ed-8009-41a8-ad44-717dbca571af", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d14de8-5ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780001096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001096, "uuid": "8afca945-7394-4d5d-9351-ceb808a77c05", "comment": "Malware payload (Mirai)", "value": "686252ac017c3e5f73098858f7b82c3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001096, "uuid": "a62e5143-0d82-4db2-90f5-d77768b63c42", "comment": "Malware payload (Mirai)", "value": "f12d8e4ddbc7fa3559bc0c0bedd96f73faf26466d0a9062164467e5023e1e341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001096, "uuid": "b754d266-1fb7-42fc-b945-f5d82bf0e34e", "comment": "Malware payload (Mirai)", "value": "a1aa912b9b8c0f4a3db6d255b0b04e632e8ae2fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780001096, "uuid": "faa369dd-253e-4af8-91ae-9fddf9ae1b36", "comment": "Malware payload (Mirai)", "value": "92a172d7d41b18a1587b0c82af5677432f4ee81274ad02f11566f8ba297cfcba6325ab412499c2f276768a8b8c70c992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001096, "uuid": "0b5ca2e2-57a1-4bc2-aa97-1854e53b1701", "value": "T1ED937CC0F683C4F2E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001096, "uuid": "1ebb41f8-4490-42fd-ab14-3687351efbc6", "value": "1536:W/QCZaxGdvts3i5JPhoeIxPu++ALtgUIKqI4FrS4LSi:WYCZa8dvm3oJPhTIxP5htSKfUmDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780001096, "uuid": "dccbd581-ea0e-4738-a032-8a9137e644e5", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780001096, "uuid": "55e3676b-65c9-476a-abfa-2f0711a8093e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780001096, "uuid": "e9e736d7-32d1-48bf-b1ce-cf53b283e607", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afbc8ae-5a5e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779949618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949618, "uuid": "fe3bb004-78d3-475c-8beb-3ecdfada7b57", "comment": "Malware payload (Formbook)", "value": "a8b52f3a47a42b21a734175259e553b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949618, "uuid": "1dcf6960-00b4-4fc8-8164-74d81bd3ee6e", "comment": "Malware payload (Formbook)", "value": "f186833e139a32ea467c86c2e30e49509581f5ebc2070ea4fa08420d59f36c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949618, "uuid": "1443c2f5-ce60-4794-ade2-b985fe152487", "comment": "Malware payload (Formbook)", "value": "9b7fd820ebafd2182c23ff75836bb9f937c37208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779949618, "uuid": "df05006b-b2ec-4673-a26e-197def4e8e04", "comment": "Malware payload (Formbook)", "value": "318b481fdd058957637ce8d9ca69c70a35016164f200dc336aafd7873c3b9e08eb79a0b7dd371aa4a314d938e03e5aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949618, "uuid": "e379cea5-7805-4f6c-8865-8c27c590f401", "value": "T13945F124235AC946C5AA0BB86921E2B453B45D9DE825D3039FD5BFEFBC3A7B07C00257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949618, "uuid": "d6505dad-dbd4-4187-aa1f-b436737f7bee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949618, "uuid": "1acd83b1-b085-41ae-b28d-7538d260ad8a", "value": "24576:1T37AEFT0DBA1NcN7UH7fQ31OrmLgkbMjfTHZMivn+:173FQqfcNcY31cmvI/Oa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779949618, "uuid": "f06ae2e0-743e-4352-80e2-1e24248289c0", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779949618, "uuid": "ea1ca9f8-5010-480e-b2f2-414c0871b85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779949618, "uuid": "aa6210b3-0341-4a8b-9bd6-0b2d3c5e53c0", "value": "JC49oHDkSj4Y1ZR.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8f2417-5af1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780012705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012705, "uuid": "d9698217-f6dd-4270-8295-df9a15177fe1", "comment": "Malware payload", "value": "8b42c4f9cc063ee1a0c4ada894366010", "object_relation": "md5", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012705, "uuid": "42389670-5576-4d64-a0dd-fb4ded256e1c", "comment": "Malware payload", "value": "f258a5d72c7058a6d4f424b2c9bf0dd96a7ab8e4548ffc9f645f2da17cf64a29", "object_relation": "sha256", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012705, "uuid": "de0fd30b-c2b2-4dd8-a321-fd6d5d5bd54a", "comment": "Malware payload", "value": "2d4150a7afab466e3febd076bb3888304bef5290", "object_relation": "sha1", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780012705, "uuid": "82a85944-de66-4c39-a003-3d7f6a7e765d", "comment": "Malware payload", "value": "bd589c7e25294f4829b1a59f4476782f340fb16d85f622e97531a90797d58c6dd1438c3660ae6986f4979b494788f52f", "object_relation": "sha3-384", "Tag": [ { "name": "cloud55file-cc", "colour": "#D85A29", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012705, "uuid": "b48329e1-cedf-4a68-a306-d035820df7bf", "value": "T149767C4A6CE048EAC46A533289B762957B72BC550F3263C72E90733C3FB26E85D75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012705, "uuid": "431a8e3f-e7be-4d24-92a6-e3c96e81143a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012705, "uuid": "e5a5640c-88e6-4495-afb0-c20c6daf2547", "value": "49152:X/YarR5q6X26AKdsMXH0Z7sIRwom5o1TRXR2umo:XTCGqMH0ZsI2b8RB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780012705, "uuid": "7fa9a288-3a67-4abc-9986-bbb4df8bb1a1", "value": 7550592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780012705, "uuid": "71226c34-ed54-4d9a-9fea-85304f7e4a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780012705, "uuid": "b07440a2-a2e4-4a25-a197-bee45391d9e2", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062e454f-5ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779995486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995486, "uuid": "b2b3892e-e295-4477-9a2e-44537934e50d", "comment": "Malware payload (Mirai)", "value": "657f1e70416e68174334324fd49189fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995486, "uuid": "01bfae60-30dd-4212-81e5-b33840d64cb7", "comment": "Malware payload (Mirai)", "value": "f2bdebed052a385138b75d1247b681b8f91bbaab3ded0ba111994ba7c7824496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995486, "uuid": "0a1f42e5-5871-402e-857e-bca7d11f5bfe", "comment": "Malware payload (Mirai)", "value": "ed837bbc6f6e34712e8e116607f9f9771a8b3aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995486, "uuid": "e6b84050-4b84-4b53-bf31-c5b43463c858", "comment": "Malware payload (Mirai)", "value": "587bdac142584fb9a3be0bfccc9362831c775dc17cb02d19ec05a49364b45c38d5df72ad11fb23d6665d6c6452ba450e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995486, "uuid": "1d2663cd-9a61-410b-9af0-bb5354086da4", "value": "T14824A74E6E228F7DF7A9833447B78E25A75833D622D1D585D1ACC2102E6039E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995486, "uuid": "d431e18d-e545-463a-89b7-fed293508380", "value": "3072:d0PLL1CxkBoO8VDre2Te+OD04U+o8mFwMKDqIFUitX:d0jLnBoO8VDC6Owt8mRKhOitX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995486, "uuid": "cd0eb8b4-b702-4767-9fb5-1671cf41967e", "value": 214824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995486, "uuid": "472280e9-b2cb-4f92-91ec-a027dbccc3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995486, "uuid": "5e23f0d1-1cd1-471e-ac0e-9018a15f3a3d", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241dbd92-5a8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779970625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "af2c01cc-85cb-4e2a-a566-cf6029cfc638", "comment": "Malware payload (Mirai)", "value": "340b1af66e51d7b54cab62c7e1470242", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "ba69198a-addb-4cc9-a106-aed953388b15", "comment": "Malware payload (Mirai)", "value": "f3114c8c602ff46d18b2a6bb077314977fe979abfb5430d46f18af821c02b90d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "2305cd55-8ab3-4099-b4e2-a0464dae68c5", "comment": "Malware payload (Mirai)", "value": "9fd9aafafd637d42c28829ba98a4d049b97d912b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779970625, "uuid": "e001785b-4d5c-4763-9780-4cf953468b41", "comment": "Malware payload (Mirai)", "value": "661a6005f3ffbbeff8cfc6486f155ce3972f1b622e8796138ee42990432d26cabc7dfb45a12ad24778a4746e2fdbcf30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970625, "uuid": "d5537922-e400-44e1-9c95-975bc514b2e8", "value": "T1B9933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970625, "uuid": "563ab30f-f69d-4633-92b1-8205b77c2290", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2D+:eyxt7W+G+3QBBntmzg6d7WidD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779970625, "uuid": "3b9f1310-473b-4571-931e-c7f22d78bf2a", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779970625, "uuid": "14900578-74f0-4a42-b9bb-95486fbc542a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779970625, "uuid": "c931d544-d58d-4d9f-bec3-af4c4c2b7616", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4af476d-5ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779995832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995832, "uuid": "4fb96ac4-2916-4eaf-8007-6cc40b1ee13a", "comment": "Malware payload (Mirai)", "value": "af013f3f161b40a2c4e59fa546e177b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995832, "uuid": "49eafceb-346f-40b4-8f41-d71deb59f1d8", "comment": "Malware payload (Mirai)", "value": "f36633ef7211b4a3e2f71cc6cbbb7e0ff7158134a79136b71ba841f438cde323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995832, "uuid": "215c88d0-f969-41d9-b206-c09dfccab2da", "comment": "Malware payload (Mirai)", "value": "2b55ce43ec3c0609dc4e743c3a1b73b0db408231", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995832, "uuid": "590e381c-21a2-4678-8543-cef7d368ad14", "comment": "Malware payload (Mirai)", "value": "1d80f26b9b35adde79f230446b41bd9e6ae59651259814c18d685c6be20fc7fd1a80a6e649da2f7bef067d67dd3d0d9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995832, "uuid": "1da0a12a-55a7-407e-9bca-f091a068f6c5", "value": "T103C36BD4F243D4F5EC1346752037FB369B33E07A2119DA83D3B8AE76AC51541DA0AAAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995832, "uuid": "71beb48e-fc97-4548-82b4-8809cf387e18", "value": "3072:k9qfGi0cnxUqFQcIaYxBiASknluS+ETs8ZpjAhl:k9qOi0cnxL7sBHpChl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995832, "uuid": "6e560e4a-c4e8-43a1-8546-807293738a95", "value": 119048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995832, "uuid": "bdf85771-9836-4930-ad41-19e26f540b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995832, "uuid": "5c93b4f8-c42f-436c-b735-196d7ee917f1", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62347e2f-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000365, "uuid": "56af53e3-0b6e-4e1d-8a02-853f35598671", "comment": "Malware payload", "value": "7fe6a1ac009c8e82ec0458eac6df0d7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000365, "uuid": "9a2bc5c4-4a20-4d9f-89e5-a14e026f1bd6", "comment": "Malware payload", "value": "f3be737d9b2779ba7777e6989a68a1d3765fedf10ce9d3f9f6e58b36fce76fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000365, "uuid": "1a39e1a5-fef8-478d-949f-f211a209e76a", "comment": "Malware payload", "value": "c884a94596e86a7933d998713636b7d501a3423a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000365, "uuid": "f107b980-c26e-4303-8e05-5f3996b5102a", "comment": "Malware payload", "value": "7291de4a921d83f7cdc63e1f5dbf6b3d676e939f960bd84ca3be357e74feb48965eac7e94e3b750edce80554dcd03a38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000365, "uuid": "b41dbc41-c47c-443d-ba0c-0533d1cba895", "value": "T16E86E719ACC52BE6C06C4E7450EECE5222B45D144BF14A3A26A4FFE9BC762347F0799C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000365, "uuid": "14a73b94-d573-4fb3-bb7f-a28495c7bf47", "value": "49152:xFqkIYs2SYn91PMpQq/UGThqYXcDvSSM8e7ISUV8RJ/xO/lT4OTcg5EL:eTHThckIVdTl9EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000365, "uuid": "af8f0fb4-d8e5-4bcb-a386-9b3fe75011b0", "value": 8257751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000365, "uuid": "abdd9825-3c39-43d4-b034-6035b6474e6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000365, "uuid": "60b22526-513c-4b3c-a6b8-dc0237e95486", "value": "vulcan_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a795eb-5a74-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779959189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959189, "uuid": "771d444a-60a3-43ee-9257-33ed7e3fd13a", "comment": "Malware payload (ACRStealer)", "value": "3972348620306bcc1ddd671124e72a35", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959189, "uuid": "2b6eedd1-2201-43f0-bb44-f7cb9d1b0bf5", "comment": "Malware payload (ACRStealer)", "value": "f668de57394d23a70ea59fcf2039b14ad28a479d59e4dc06ed31c64d740be30c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959189, "uuid": "6116a659-e0ea-4dec-9c58-0766ee53f689", "comment": "Malware payload (ACRStealer)", "value": "0315759fb2d50cfdf9258b7216bac3e902c3a82c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959189, "uuid": "6610520c-9a1c-4cee-8930-b8f617d9f582", "comment": "Malware payload (ACRStealer)", "value": "2a2007448b77012d4afa546571b0fccfc8167d80f2534eecaa78ee14a6488278a43295eb47dd04f856a9001a70429dd8", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959189, "uuid": "012d7bad-0ae8-44b8-b0a3-e72e7d7fe601", "value": "T14AA57C0A6CE04CEAC0AA533289B766917B71BC490F7263C72E6076783FB27E45D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959189, "uuid": "33d61154-030f-485b-996e-062a24d52e00", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959189, "uuid": "930a7428-acb9-473f-8c33-75a69a8601c5", "value": "24576:t108j2vTwY8Ajbnjf5S//f0Jo4+X99EfxYFE4VUG18U6np79fnBele5yK2tFc92o:t152MYVbnjBC/TTPdN1gWX29Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779959189, "uuid": "b44bc749-d345-4bb5-959a-2fefdc5432a3", "value": 2245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779959189, "uuid": "28f1ccae-25ba-4a87-86f9-57fe6e7f9183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959189, "uuid": "d902ffd7-246a-4cb4-ba96-713fd5813c66", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e093f65c-5aec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010885, "uuid": "705ec2e9-d899-476a-84c0-e9350b720e3f", "comment": "Malware payload", "value": "b5b603ff57142a454c3b0fb12eb8a4eb", "object_relation": "md5", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010885, "uuid": "1d080c67-26c6-482a-9523-f34fcca610ff", "comment": "Malware payload", "value": "f6e4b09ef788adef3f65fd2b99da8f5be5391be29471676dc07040a56c8fdfab", "object_relation": "sha256", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010885, "uuid": "925cca2c-f03b-4808-a996-d9e922b30e2a", "comment": "Malware payload", "value": "04ccc8f9f5e343f94ad9f41f08439b545d4b8486", "object_relation": "sha1", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010885, "uuid": "5351ec60-8f2c-4293-badd-5fa8da3322b8", "comment": "Malware payload", "value": "836dd2e0f80c8d6a8eb252de595b7f6808047ee5a1e169c60f50241795feab1e115fc8f48aa6840670d2fed2a082ae5e", "object_relation": "sha3-384", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010885, "uuid": "08fc75ce-87ae-468b-8ae1-18c48b9b58d6", "value": "T193973302E67E8CE49358096A3CAFBD6B7C450C480DDF48796364A16DCDCB7AC78A25C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010885, "uuid": "3d84a4f2-85a0-494f-a50b-aa74ce9d9d5f", "value": "786432:8Lfnns3J6tCEgRWUd9rs7s1CBf+MmzfaG14m9WjXaPn8fxGp99:8LvsWCpWUd9rsYCq4+aXaP8fxGpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010885, "uuid": "200a473b-85eb-490b-9fe4-4bcb1ea53850", "value": 43240050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010885, "uuid": "6c8fd570-15c4-49ed-b077-53a82274b4ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010885, "uuid": "aa4f1704-7ae7-4e09-8ddc-564d16193c8d", "value": "Setup_File_31.494.76090.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3958be-5aae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779984010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984010, "uuid": "2b96c9f6-b814-4d79-ae2b-292f144afdc0", "comment": "Malware payload", "value": "1eb9a2927003054760627382fdd80308", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984010, "uuid": "4e75329b-f9dd-4e70-a52d-6c5e52929876", "comment": "Malware payload", "value": "f79c48942818ca7f27dd4c6959d75c1a02cfa7248cc610d97c950c30c60bae26", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984010, "uuid": "546df04c-3a6c-4847-8fef-bb17bcad1f57", "comment": "Malware payload", "value": "ebd94aea654fd91e82111777b07d42d2a50bbc4c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779984010, "uuid": "7494f3bb-16a2-4ab1-9877-ccd12a519800", "comment": "Malware payload", "value": "ab911dd2ca94192897a2885961d0413dd2dab5bcb6ee3cbbc15549a99d083c0e70cb317c5aad013167351129992edc91", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984010, "uuid": "2003aefc-61d3-49e1-8bc1-c2cbc917ef66", "value": "T105A3F341F7F94119BAB72F442AB946B8497BBFA2153DC9DDCA100D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984010, "uuid": "7c3a5513-e1bd-4e2f-93f6-acfd426d559c", "value": "768:4OCAaur0Uh33Qaq7Iud9Vodn9XUQReB12CLSbJygE69ajZXtnQe9cIc9j2QxufaV:2Wh8JzWGwWQSPoOCpLbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779984010, "uuid": "6ede29d6-1ffc-4799-891a-0d15d2b61539", "value": 105748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779984010, "uuid": "08ee99de-0c8e-40bb-a7ea-085dd2e7d285", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779984010, "uuid": "9d4616c6-61d8-43dd-beaa-58e45b95132e", "value": "rlembrete_ac39ef98.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fe0c59-5aa4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779979616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779979616, "uuid": "f4cffb1b-f4c7-4760-8a49-808e19213035", "comment": "Malware payload", "value": "26b27f99458712b25665508be6649ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779979616, "uuid": "8e4b7449-d5c9-4bde-9084-d090656bde02", "comment": "Malware payload", "value": "f8ab87be57e458dc4ec8fb32cccda614acc08f3e197d033cc79032b244025283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779979616, "uuid": "cc9b2d25-37b2-4872-bf89-917c9ccbed42", "comment": "Malware payload", "value": "3d96972ecfe9bef3d7e925cdc6375135953f6bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779979616, "uuid": "fdbe29ec-2825-4a9e-83eb-a20075268ab2", "comment": "Malware payload", "value": "7a02ab05ec0d248c170b7d6dc8cc0f4e2950b498cbb3221710915033393d1812b64fb817d6e63558f3baeae90b1def74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779979616, "uuid": "09d75ab2-bca3-4917-bbef-cdd13233c0d1", "value": "T144D37C1BB3E531F8E5778238C4514A46E7B3B87147219B6F03E446A62F636D09E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779979616, "uuid": "a70467bd-ca82-49cc-8182-744baf7f4a94", "value": "12627c3bb255a8e0f393740c00bfb408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779979616, "uuid": "e5611ff4-ed01-438b-a992-95dfe00e1621", "value": "1536:61hbuy/2oUe3kliCgSbwd+8QhL99yyvhySbQeHcr+CUisCqtUlbmFNo1GtksWrC8:s1nDAL/T1bQe8rXsMlbmHWuwommTQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779979616, "uuid": "0891b25c-43f3-4df9-8e4c-267006181b9e", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779979616, "uuid": "4781e8cd-0eba-48d2-a6e7-55dc25de961a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779979616, "uuid": "c19c0175-d408-41d7-9ed1-17f7c330b97e", "value": "SecuriteInfo.com.Trojan.GenericFCA.4721.18346.15349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfcbb58-5aec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780010796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010796, "uuid": "41d300f7-4672-4bca-9866-64a8370b6c61", "comment": "Malware payload", "value": "7ee52909ab242a6bb25ac489fb052fe5", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010796, "uuid": "e27efa5a-0552-4347-84b2-bf488c844ffd", "comment": "Malware payload", "value": "f936a00eb5d00531d099c73d87b7e1dcf9854104300e3ae327fb5b9ccbe2619f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010796, "uuid": "c99734e1-358c-47cd-a5b6-c6724055b52b", "comment": "Malware payload", "value": "bf72c5dafa1ab9642793cc238c16e4013237b524", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780010796, "uuid": "47a1f147-cdbd-49e4-bb69-ea7e60b17d0b", "comment": "Malware payload", "value": "9c36120d6c83909fa2258853844541e96e2991c964d5cccdd9f1c21625d7cfff99e4107e5b932d06f36935064a14575f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010796, "uuid": "5e8ffea3-3da0-4a1c-ae53-320f46c6e383", "value": "T152172361932E0807D24FB137385B260A9F53CE08C2E96E2F95FC5E89DC97BB71B85611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010796, "uuid": "9eeccf9f-66f0-4cad-93c0-865d93f89230", "value": "393216:oczbrZlgxNp8nvkZHxnCoqn3zCUtwg+Vs+bYdQopF69yZ:J5kZHxnCBnjCUtuKfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780010796, "uuid": "1ed0e459-f5d5-4ef2-8c8e-324ed91ce063", "value": 19660580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780010796, "uuid": "5c25b60f-7e5c-4930-a0f1-bc1cc36fef08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780010796, "uuid": "ff103be8-5577-4418-84cf-46b00d1ad8ec", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c3d01a-5a8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "27d691a2-5f59-4486-a3c7-30e3c9a115b9", "comment": "Malware payload (Mirai)", "value": "9554c045b4435405e2d59f7cc3ea791d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "2e5168e4-8826-49f5-a8f3-3aeaa36c2e04", "comment": "Malware payload (Mirai)", "value": "f949391eb2dd8a7162ea49021a813d089ada2ec0757270d522c839ac3055910c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "2f038c92-5ee2-4153-ab6d-ca1e902e3cbe", "comment": "Malware payload (Mirai)", "value": "b94ac2c4bcc9f4cfc9866f189d5ca91d1566f8dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969546, "uuid": "3cb68305-748e-463e-9b93-c0cb7b45de6c", "comment": "Malware payload (Mirai)", "value": "2988aff731e1c1a8d112b14740f951dd71a42736ebe1919e2d9d3b58fddf2c69f7b996459c7ffd77fc0de88980f31f77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "7331099e-aac3-49b6-badc-f84b9b4c4399", "value": "T1B5837CE1A683E8F0ED19013520BBF33B6A36D9B90178FDE3F750963294269A4714735E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "5b139598-2d4e-461e-86ef-cc792bb16f95", "value": "1536:D+tsAVuk23pQDqS4aTYjc6gELeSfem5PJY+PBdAWeMY5f0n4z:KGqY3pQ2S4aTkcxZS9Y+pqp1e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969546, "uuid": "1d77d5d7-557b-489d-8f36-b72d6f887980", "value": 81712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969546, "uuid": "a996ff9a-a401-4ae2-b6fd-dabceadbd582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969546, "uuid": "d3b7e4f4-ec97-4d6d-bc4d-396a1782f89e", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f12b884-5ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779995313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995313, "uuid": "57a3b148-0755-4f3b-b387-f13991cbdead", "comment": "Malware payload", "value": "177f1f956c483377ad49f4a94cc385fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995313, "uuid": "36216b61-7f0e-43b6-90c9-f8c6aac73702", "comment": "Malware payload", "value": "f9e6b6a7a3528466e18e3124eafcd00369a4d31d765141b4639b9ebd06c92be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995313, "uuid": "3d9dcd79-cd64-4457-9293-243edc12d3e6", "comment": "Malware payload", "value": "1dcec1c8fcee72be05a25530439e87f965a04b7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779995313, "uuid": "4e8b8154-4246-4b61-a7c6-18e1edeb5065", "comment": "Malware payload", "value": "107307a2a229b606ee719baf6c3f96cd95a6af683997f364bbc98e21cc9f29e39521dc881c3f0c0930fdf87552f1bbb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995313, "uuid": "6814cd47-f935-47dd-aca4-bffc815925cd", "value": "T196D35B07B6C1D0FDC8D9C2B48BEAE126DA72B0296134B25E2BC46E276F5DE205F5D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995313, "uuid": "16800736-8cf1-4c95-88fb-6aac4829bc7b", "value": "3072:hQXTayvwKwZWCgkO1QQTaaAyKAVI8AUQtLs0FkQ8:9pwzTSlJL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779995313, "uuid": "8623e722-a647-4f9c-bec5-557bd6d22bbd", "value": 139976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779995313, "uuid": "feb6e23d-cae4-4e03-8d6d-8be860231f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779995313, "uuid": "95547921-fe59-4f28-b6a7-7ced7f9e9503", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e6ee6c-5a74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779959146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959146, "uuid": "f2e0eedc-4dfd-4d68-8831-800414fdd92f", "comment": "Malware payload", "value": "e4ff37cdb58008811695647fa0afa057", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959146, "uuid": "43ac7601-94f9-442d-bfb2-47a351ab323e", "comment": "Malware payload", "value": "f9fc553f7f916e355f33b47f3bc37080c90703e549019ce635f41bee5f76cc15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959146, "uuid": "2c80da56-06b7-4111-b8fb-4f58bf7b36e7", "comment": "Malware payload", "value": "e16e355ead093a9f4f2ffe539f945d514a43feac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779959146, "uuid": "df7ce0ee-49ce-43bb-8eff-88ba1e844c65", "comment": "Malware payload", "value": "6330bf30e1c58720811a95ea555d79fec2721563a7d6853c0dad8be88aa389107fc9826dcf5def975070ebd6ad692db8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959146, "uuid": "2fd917b8-6008-4bb1-856c-d4bd402020bb", "value": "T1E3136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959146, "uuid": "147a20df-df4f-4246-9079-bc4e4aad72a5", "value": "768:aXRWNGxVH9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:mlxGcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779959146, "uuid": "3ca58fcf-f12c-479a-84ab-7b01fa26cd52", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779959146, "uuid": "f0ca6fb4-ba46-4a22-bc47-86c812fe190f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779959146, "uuid": "3df2d42c-9cc4-4205-a146-3421622ef8f0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88cd3df-5ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780007435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007435, "uuid": "2e7183c8-1e08-43cf-859f-2a4b8f9ded89", "comment": "Malware payload (Mirai)", "value": "5ed429083d965d0a67937ecb4afab13d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007435, "uuid": "a04c16dc-b91a-445e-970c-c8ee78a09265", "comment": "Malware payload (Mirai)", "value": "fd9e81013e3e888f2d9c4bef17469d32964a7ad5fbf4b48ba66e1ee98c312429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007435, "uuid": "a066c607-256b-40bf-994a-535da9847c3f", "comment": "Malware payload (Mirai)", "value": "ee444949329daf84acb262138549ddfec19f32ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780007435, "uuid": "33c254f1-5297-4015-8fc6-e67ed19f3abd", "comment": "Malware payload (Mirai)", "value": "d03a697866a29f86d9ee2cd07a782ad4311f659fe67ae4afa0e5b5b78c283db5c9da8b5812beb6452083f26617a63f9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007435, "uuid": "1cac0a25-9cd6-4ef6-ba99-b159b051bc6e", "value": "T10FD308C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007435, "uuid": "6816dc4a-8db7-4783-b8ec-2c3436a1925d", "value": "3072:YXbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFI5x:prybytG/Oyi42VOgLNKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780007435, "uuid": "89375538-47a2-4183-86d2-3cc870ed2e4d", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780007435, "uuid": "b76d203f-ceb9-4ccb-8ad0-6a9d1c3ae5d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780007435, "uuid": "2b06959a-5122-4432-acbd-89fb5c14a235", "value": "fd9e81013e3e888f2d9c4bef17469d32964a7ad5fbf4b48ba66e1ee98c312429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9de39b-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "27e78f6c-cf87-4340-b981-6d453eab8008", "comment": "Malware payload (Mirai)", "value": "00f2359a3f6b8b2777294e1a3c644e95", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "5219aedd-7247-4b52-baa9-53cd99266f97", "comment": "Malware payload (Mirai)", "value": "fe2d7e13cd27388672eca605eb09f47be0e7fbab6b1551d0d97c22796f8781e5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "7b1a45c7-4deb-4365-8c28-de11ef68e035", "comment": "Malware payload (Mirai)", "value": "0b9faaa02ce0832cdb413dbc328871040fa7f5ab", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969081, "uuid": "e12cd548-e4c3-43cf-bcaf-0474bea9cf15", "comment": "Malware payload (Mirai)", "value": "7abcefb10e57ccb2dd4cb84e735368817c61d0bfd419d821b069852539bcc4f489443f3f55665b9358a8bfa6025e30c7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969081, "uuid": "a22e4520-c3fb-4d13-b56f-25711c8d9dd1", "value": "T10F83AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969081, "uuid": "50053b56-3c60-4aee-ac11-a675fca357fd", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7b:UeAsdukuhoNJVwbmuUqjLjwWib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969081, "uuid": "ce9ed32f-12f9-4b86-937a-c454bc920437", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969081, "uuid": "28196e40-b53b-42de-bb43-b18bbe0976f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969081, "uuid": "6b2ef21a-4ed4-4e30-a295-8d5893bbbe72", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8db56d-5a52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779944418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944418, "uuid": "4fcf9106-3dae-4e8d-9dd2-712097810750", "comment": "Malware payload", "value": "9a8ba2c555a5464901bf5872e120788b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944418, "uuid": "27fd8c97-d0c5-430e-8f51-834798b458be", "comment": "Malware payload", "value": "fe816b6ade53ec60929d8890e07e6db410ef8b22ad6301199bc36f6fba340421", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944418, "uuid": "257fadc5-6726-445d-acd7-82d25a3bf7cf", "comment": "Malware payload", "value": "b4e139b442c4306e685582cffa51ef8d23fa7e85", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779944418, "uuid": "9e0aae11-8be8-4fe3-bca6-e33d28cd9274", "comment": "Malware payload", "value": "29f012f13f344b85d0b1cdedfbbf1e544d1031d52b396794767b23f2bb79c511bd3cebb7fc98704dfb0f6cf2c95c266f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944418, "uuid": "0070af13-adff-4075-8474-b1be22e6b87d", "value": "T1DDA30441F7F94119BAB72F442AB946B8497BBFA2153DC9DDCA100D8D0B33518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944418, "uuid": "938d1389-2d0a-44ad-8c90-0c3217b9b4af", "value": "768:EacwaCos5Fk9HBg15c5BTRCQ9UGGgPxn0+Y1nftpS4/NwLYkLoXlZOXYZLgGq+Pz:KStTfPzxFOMGs+tt/19gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779944418, "uuid": "2d842e60-9b1c-4410-9d6d-8f7cb67ce7e5", "value": 105676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779944418, "uuid": "3a2551a3-0909-4ff1-8a3b-cf4b2616c450", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779944418, "uuid": "9be71f35-20c6-474f-8c9a-451c805b3b6c", "value": "rcontrato_d6fac7a8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ca3e05-5a6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779956693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956693, "uuid": "4e401a8a-94dc-45d1-bdf4-19b0d1b0c887", "comment": "Malware payload (Mirai)", "value": "a5877f8e60c014e1c347e50b0c9ac0e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956693, "uuid": "6166f6f1-7871-4925-84b8-81f3dc064e39", "comment": "Malware payload (Mirai)", "value": "fe876fac8ee7dc4a49732be7f2ff706fbda37a4f279c8c92d60dfc03b36fc8d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956693, "uuid": "e2cb217b-020f-4fc3-9ef1-f3332efc31cc", "comment": "Malware payload (Mirai)", "value": "9f999cad12808462db3523dfa4a1c0d1af02c15d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779956693, "uuid": "1ad09129-5347-4f4e-ab4b-62f6b91a6463", "comment": "Malware payload (Mirai)", "value": "81554b21aaa8a508bb498ba69309fd3137c9cbe3566b4d33410928756d1b2727546d29cd8a8a751c0589de3cc17d80b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956693, "uuid": "77f71820-704e-4df4-8a60-0f78273e53c7", "value": "T137D36D22E9391D17C5D4A87701F35336F1F3078A24E88A1EBDB10E8DAF19AA035577B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956693, "uuid": "3d55eaf5-86fd-4355-85b3-c7da396a1be1", "value": "1536:sHQ4B761BYLgi0tH9D4h1DT1UfdvgYIHPca1K1t2L0Ym5F3LaBtcI1tOtDg6jy6r:piY3x9M1UYP+ML0YOF3LaBKdUSLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779956693, "uuid": "eadf0988-edac-4a43-9752-19f14c2666f5", "value": 133816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779956693, "uuid": "0f84d23e-5c39-47e6-b02d-594921f5fc70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779956693, "uuid": "702c537f-1b02-463a-84b3-9ff1a9ca2b60", "value": "023782pler.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2dbd2c-5a8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779969080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "5ee26f1d-7a6d-4c8e-8353-499adcdc3ed1", "comment": "Malware payload (Mirai)", "value": "78627318b1db16334be0e79c7734d04a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "2878be76-748e-4bfc-a6b0-cd2b4c2e3413", "comment": "Malware payload (Mirai)", "value": "fea0a9bbe0dc6ab1d4c0fb8e34fec3c56846f5b39d19d2665243eadf8e0f642a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "1b652b0c-1239-4e7c-bfe0-1eeb9f114517", "comment": "Malware payload (Mirai)", "value": "a6f60c68780e0abedc62b10d3c8c783fc423f411", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779969080, "uuid": "e9024e0c-d6ec-470f-b7d0-38a2c89593fe", "comment": "Malware payload (Mirai)", "value": "832c24eb3c63525776eb15face4d4166658902f8ca82ca9f6ac1d930e4536672c261ca7023258fb16a22e889d5430edb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969080, "uuid": "6ff66553-29b9-49b7-96f6-dfcb9b20be2c", "value": "T1F0C3E71E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969080, "uuid": "8e0955b5-6fd0-43fd-bbbe-184c33765da5", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3/0j:IaOulLUUogcQ9BvMEWSWC2h3/0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779969080, "uuid": "f039eeda-1309-4673-804f-26c8d6aec9b8", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779969080, "uuid": "9a29859c-cff2-4de4-9a83-c77ff07e7ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779969080, "uuid": "230a5199-bd82-487c-88c3-be910561ef4c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527f4d9-5ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780000209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000209, "uuid": "14696798-42d2-4604-ae08-2a78e8bf0a87", "comment": "Malware payload", "value": "8fbab3bc9b862db5e2f8079ce0f83557", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000209, "uuid": "775f4b98-c7ae-4b9f-a65d-ba0310806d48", "comment": "Malware payload", "value": "ffe32daf6b3fd1a8cadce7542a1c028f83276590ce01532f53149aa0ca94ef18", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000209, "uuid": "0cb1e54d-c238-4dbf-8b20-4a8b5e3eba6d", "comment": "Malware payload", "value": "d545b1ef174fba21e0cade0b546f0d5d80e6693d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780000209, "uuid": "6dee2e03-9903-47cc-a965-a1e4bef2579f", "comment": "Malware payload", "value": "aa99f8ac08b9afec3265ddf2e2af54298ae847b069d05cb11d055a62fb8dcc64e7d3b3b20c8769770a5aacdc19162b98", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000209, "uuid": "026546c8-cff8-42b5-b4ad-35a644134c08", "value": "T152A31541F7F94119BEB72F442AB946B8493BBF92153DC9DDCA500D8D0B32518A93873B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000209, "uuid": "b2284d2f-e271-49cb-b346-71b92b1cfc66", "value": "768:ClrUjBmDbiE4edMmqeuZBt7yWuiDwDvxiiw6wrzlEyV+jKhysE8wILG2EDLDylmT:qDS1zoPdcgZhdinS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780000209, "uuid": "9f57c514-f673-4a87-9cb2-fad20bc02759", "value": 105854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780000209, "uuid": "bf99e183-1e80-4139-919d-878e0d308d65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780000209, "uuid": "cdd3e37d-6b20-444a-a810-9367538251dc", "value": "rmemorando_82ca1617.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }