{ "Event": { "published": true, "date": "2026-08-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-01", "timestamp": 1785628981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "353bba06-fa66-4d41-8636-4792fcbfac12", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8b1f7a-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785547599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547599, "uuid": "fe98c03e-ad21-4171-8ffa-84c78299dae6", "comment": "Malware payload (Mirai)", "value": "49e5c59818aa9de1822c6493a83e0926", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547599, "uuid": "014c1ce4-4c60-429a-a7e3-ee116c778091", "comment": "Malware payload (Mirai)", "value": "000d6d9e36795845c30894f29e7c3be7db37e1127e0a1e2b3cfcebd45e9cd9e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547599, "uuid": "3c36301a-ca57-49eb-85cd-ffadd4bac693", "comment": "Malware payload (Mirai)", "value": "a15fc14ac1434df8d027e00d6d68ddf012cdf579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547599, "uuid": "4e1c518f-456c-4baf-a68f-dc0c1a14c20e", "comment": "Malware payload (Mirai)", "value": "13dc3d618802203a10d97e57f426060b786e8168bdbba02b7e8bb42677da40433eb415e060ade9cf83777b6fc85a7471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547599, "uuid": "fe0fdc68-b9ba-4ee5-a80f-7ff9ef7cfdfd", "value": "T103836D89F793E0F4DD4705B1106BB77E8B30DE125024DE6BDB94BD72AC32A02A11A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547599, "uuid": "3a8add6a-ec86-476a-b4c5-d2923a18e7db", "value": "1536:mJPx87Gy00Ea/ZvmmvWFqnHoQWach2NUc31E+2QBweqZqr:mJZE/sa/RmmvWBVmC4/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547599, "uuid": "bbbfc716-76e9-405b-99cd-8a9633f74d0b", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547599, "uuid": "9f99166e-c247-44dd-9bb1-452a34291efe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547599, "uuid": "034fdc38-aa5f-4081-ad30-74073a07efc7", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af8dc5c-8dce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785605258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785605258, "uuid": "79f77a35-0b0a-46f4-afbd-a46b731765cc", "comment": "Malware payload", "value": "0bf33c127e244004411b7eab4bc15b5f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785605258, "uuid": "9eb5fd39-09fc-49a0-820e-ffbbd417165b", "comment": "Malware payload", "value": "01067bc1b1b5c8477002e1c04ce55fa4bf4c6ad2aa2049a53dd895c756413830", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785605258, "uuid": "ee689154-84e1-47b1-9e7a-0a4ecd7c7a03", "comment": "Malware payload", "value": "3b57290dd8292bc908cfc6e7f4f60a02c14e8c93", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785605258, "uuid": "d03fe108-d33a-460d-9756-e0224f658060", "comment": "Malware payload", "value": "853c356d1c1596743f38e7296455587b7d79cd2ee2a704712c5fbe6987f0ade010f9d7734106fa74b3e7ce6dbf253cf4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785605258, "uuid": "01a6180b-1b75-4e38-b7a8-9e1002f9b7f0", "value": "T109C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785605258, "uuid": "92b9e76b-97e7-4268-b299-65194181a1a1", "value": "768:Q8vCB+25j6es8Rk9FYpMSUpi+20qUpi+20YQX:Q8l25JCd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785605258, "uuid": "16d00cf5-2f90-4105-9288-4140b0f1a433", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785605258, "uuid": "32b2d9b9-928b-45c0-b2f4-eb78538b9c7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785605258, "uuid": "86d6c16f-b2c3-4f24-bef9-2ce8f5870d64", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daa5dc3-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545160, "uuid": "d01ff284-51cd-4422-a47e-b0a6a6757e87", "comment": "Malware payload (Mirai)", "value": "98ef14c3530595f99b70a736ddcd6770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545160, "uuid": "1710cae4-3a79-41d3-8c55-3c84b8b5fc6f", "comment": "Malware payload (Mirai)", "value": "02f8ce40a3e6af2558da63721edcd4e25527e44fba26256c65aad9873636e320", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545160, "uuid": "ece24ed3-4de3-4bbc-b1c3-5801dfb22ff0", "comment": "Malware payload (Mirai)", "value": "dce640e79dc7f139ef1cb2439ec7806e1d80846f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545160, "uuid": "6c4257ee-b7dc-4074-82aa-9a84ec15f6c9", "comment": "Malware payload (Mirai)", "value": "8f523fd20c662a6cc776998955216a18c7086c85f86b6e4fbd163a87126125a52f731c9da81c6660c8843f3c0a2e5c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545160, "uuid": "67cf0215-e645-4a09-8a34-c8b92c50e9a1", "value": "T1B8A31956FD818B61C6C116BAFA1E118E3313177CE2EE73129D146F2077CA96B0E7B846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545160, "uuid": "211a8112-b37e-4ac6-8c14-60c8aaad7f9a", "value": "1536:d8nqNGSaII5sG0EodMqoorsGUuQWC5dmrateB1oV3UcdiHkghx5d+L769YVgw:ZGSaIjGloouzCXmratjQkgL5d+LG9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545160, "uuid": "64d055c3-93ce-46a7-9042-0e2a0b93782d", "value": 100480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545160, "uuid": "ee220f35-ff26-49f0-8d16-4b11ca3f6964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545160, "uuid": "2794478b-f7df-423b-a366-0f034bb185b5", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20c133f-8da5-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785587795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587795, "uuid": "867431d6-57a7-4650-b2ff-1a646ca0b606", "comment": "Malware payload (SalatStealer)", "value": "e7b8a37f2bb2238b7ce955e0bc3e97c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587795, "uuid": "5976a2aa-1620-483b-ba37-415d5b87350a", "comment": "Malware payload (SalatStealer)", "value": "042c76861bfba62c1e4946697a143a185488c0e15f41431c3cd5a51dc11e52a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587795, "uuid": "32234132-edab-48dd-bdaa-5aca9bc22a58", "comment": "Malware payload (SalatStealer)", "value": "07139a197cb37cd7daf6cf6d17d7c738cc487f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587795, "uuid": "fe2523c3-67f2-491b-8d71-dba18d1ff4c6", "comment": "Malware payload (SalatStealer)", "value": "ba01e25768d8460e52ed8e41cc3db466010c8e1519dc8e61f376a19133291a1cdb8300560fe3e1541c6cf508843fe5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587795, "uuid": "cc133848-c5be-4479-a00b-3399f781bf02", "value": "T1DAC65B11FADB95F2E9035831016BB37F23315D048B28CB9BEB547B2AF87B6A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587795, "uuid": "0ae2bcb3-b7fd-4557-8aee-5eb9adaaa6b2", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587795, "uuid": "105c6445-631c-4898-957c-b43d91f6ff43", "value": "98304:sun+uBu7zmCvjkqwntcKNfAr4tG20CzEc0:4uK/jl4cKF0Ht1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785587795, "uuid": "6e5bbf8c-9e1c-4213-95da-0392202b6bab", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785587795, "uuid": "cfa58fe9-0698-4e6c-9957-f3d267bb2357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587795, "uuid": "6c4a1ec0-99e7-42a1-aba9-a296678d714c", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d98f9ae-8d45-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546341, "uuid": "68c078b9-2afd-4eea-8f19-bf7efa0322f6", "comment": "Malware payload (Mirai)", "value": "12f6fb6fb0df36cfd63b4918182a3301", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546341, "uuid": "05e0e043-359f-475a-91a1-8b7cbc24dec5", "comment": "Malware payload (Mirai)", "value": "049ec70afdef0fa35e253e84c5323fae581db3b1159cc69f9ccd5cfc51536a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546341, "uuid": "1add0be5-c43e-42f4-9e40-a8d175fdd2e9", "comment": "Malware payload (Mirai)", "value": "17b52127f3cd77f8dfc067ac87e0eb720109126f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546341, "uuid": "6fc49ada-b4a0-43be-8b00-e2047d188cdb", "comment": "Malware payload (Mirai)", "value": "48e1148266bffced691ac19b433f34430b09b02b701a4692acc4cbbf5f1118ed457a3c92c64c1ae3d42b499c88144b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546341, "uuid": "13d6749c-7067-4fca-8dac-0749f20091d5", "value": "T16E836BC2B747D0F0F9160635217BEB364673E13E0069DA82D769DC32ED12641EB6A3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546341, "uuid": "36caa952-f2b3-4219-8238-f601aa6cec38", "value": "1536:dIEpuaRPFkawuFxDMHRTLzjRBbE3kcE4+LDVyfDlyOCBZ:dwaFkawyxDM9LzjbE3tEnfwAOCBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546341, "uuid": "2a8b9e9e-a535-463a-9995-1e7eeed54e9d", "value": 83632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546341, "uuid": "b92980d0-a3bf-4f84-ac8e-896b3d3e38a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546341, "uuid": "0c13676d-9b4d-4da2-ac25-be5ec7f2ef83", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f727a7d-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785573161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573161, "uuid": "1a909693-bf13-4a5e-8830-51162a2fcac0", "comment": "Malware payload", "value": "e02df86348f718395bcbbe0d3c07817d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573161, "uuid": "76b8fbb9-e553-428e-a056-666433165e9d", "comment": "Malware payload", "value": "06255040122047ea6c1e6eae703d31c793f295aed1dede8c4f03372656223a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573161, "uuid": "8fb2dc32-09e0-409d-8438-baa339fe364f", "comment": "Malware payload", "value": "2f0b04807974b8f48a966346e3e33fd662e1a31a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573161, "uuid": "0c967d9e-6519-4b54-9085-64bf864aa0d4", "comment": "Malware payload", "value": "216423f09b74ce9e46acda82482e532d4fb5447d5c4bb10324c55712edbf08a43325f0d35252620dfe06c9ebdc0d5a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573161, "uuid": "bdbf9190-15b6-4f8b-aea5-98b4bf42925b", "value": "T1C7D523AAFCF60670E837C3F6949335FDB01A77898A658C073ACD9B105D5252C6C3A279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573161, "uuid": "0fadb604-0f81-48ab-8c30-85a27214ec10", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573161, "uuid": "0bb231a7-114b-4321-b195-90f7655a485b", "value": "49152:0+J9uW4J2yBanwdxWkGwBN5ZB42YQX/gdyd6tQTM0pYVB8CcUOUq:0+JsbCnsx/pBNpHX/HPTNCV1HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573161, "uuid": "9bd708a9-241f-4839-9e8e-2003e4e3d04d", "value": 2941440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573161, "uuid": "72255a70-7c20-423d-9fcf-ded7a922af8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573161, "uuid": "868706ac-567f-4cee-adf5-65e70a517a53", "value": "SecuriteInfo.com.Win64.Evo-gen.22741381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8776b7ce-8dff-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785626405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785626405, "uuid": "2b387e61-84e0-4610-9602-4fd348d03b70", "comment": "Malware payload (NanoCore)", "value": "ae5b3e0e621abf17d9f80f51638897cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785626405, "uuid": "f5fee2d7-17c2-422b-830c-eba665202368", "comment": "Malware payload (NanoCore)", "value": "0628a7d09dd681ab6e1d0c904f8c7f2d3fb48183a4a57a7cfeaf4350b01406aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785626405, "uuid": "c7b3b606-43a9-4e76-b93e-37d24c3941bd", "comment": "Malware payload (NanoCore)", "value": "c67acc0f58d6f97f0fb07bf54a995cb7268d126b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785626405, "uuid": "729cb185-4824-484c-9836-ad09152db0bf", "comment": "Malware payload (NanoCore)", "value": "5df4b4fce0528a787202d5317845b55ce756f23f8dfe62f8949bf5d972a5cebe52d0fc67ca5df7cb7cdfce7be508d8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785626405, "uuid": "85717464-8495-4cae-ac2c-34ab7905998e", "value": "T19014BF567BA88A2FE2DE8579611212128378C2E39DC3F3DE18D421B78F667E50B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785626405, "uuid": "c09a6d5a-b59e-4885-afc2-c7beb68c3049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785626405, "uuid": "d1e3233d-2525-4860-b93e-cb5ee5113fcd", "value": "6144:MLV6Bta6dtJmakIM5rG9lT9E6CvvHPfI2x5y:MLV6BtpmkEGrBfCvPPfIW5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785626405, "uuid": "e4cc115c-b32b-49d9-b0de-76cf1b2afd40", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785626405, "uuid": "cbcfc578-3e01-4c6d-9373-6af0d96f4a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785626405, "uuid": "b4564d5d-5071-4268-8f91-8d905600f228", "value": "AE5B3E0E621ABF17D9F80F51638897CB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474ff87d-8d43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785545552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545552, "uuid": "2c59537e-de8c-4c9f-bc32-43e3d91f3212", "comment": "Malware payload (Efimer)", "value": "da217013547b09f4b6d27d40a2643f65", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545552, "uuid": "3a490694-0692-403c-a119-018cee73caa9", "comment": "Malware payload (Efimer)", "value": "08e678b14630558ba49781753227f1adc0534ea1d27ecf2b1c26a9eea89e23bb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545552, "uuid": "0a0cc668-2d75-470f-8e4f-79e2304f8f0e", "comment": "Malware payload (Efimer)", "value": "f765764e06b3357f6e87f82df42a5bfe4848f44a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545552, "uuid": "9ebdab37-bb35-4d47-b1d8-32d60333b283", "comment": "Malware payload (Efimer)", "value": "d5b0065ce9a16e5d5fe8f7d6a9c39323f80ea803fda72be27b07612f2dc170868773bb0c3df4916009e7275f819276b1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545552, "uuid": "7995da2d-40b8-49f0-a6a6-f25297a780a3", "value": "T175E633080FD11698F673423DEDD15258FB66B8B64BB2C6CF474047696F235B08E3A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545552, "uuid": "411d5a81-f801-486a-9f84-ecf33f0f1184", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545552, "uuid": "1477ca47-2b8c-4c16-a90a-b4c2572a0b70", "value": "393216:cEVhe/VqQUAE8obrGHDBVhXMCHWUjzcuI3/PGTAI:c0e/R5EprMhXMb8wH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545552, "uuid": "815c0939-6f4d-453b-b401-ee0d576a8168", "value": 14289589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545552, "uuid": "a7a2ca82-9cbf-412f-812e-c17d42a615a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545552, "uuid": "65590fc6-5d64-4466-bf9c-664e7f769de3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bb2dd7-8de7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785616144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616144, "uuid": "6990b068-cf95-4073-94f8-c8a335cd545d", "comment": "Malware payload (Mirai)", "value": "cedf796d5d506deb3c58c4a0423b6ab8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616144, "uuid": "f3a5d0c3-9b5e-4369-995b-aa729212a06a", "comment": "Malware payload (Mirai)", "value": "08f4bc922426317108b3f100f5d0ada10aaed45aad8613e181fefd087ca304e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616144, "uuid": "eed1d69d-cfbf-4478-b58d-070e78de70a0", "comment": "Malware payload (Mirai)", "value": "75f0d9ca3415ba2b6529406e5609754be6214fbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616144, "uuid": "585ed821-a359-43b8-a77b-e703ead1430f", "comment": "Malware payload (Mirai)", "value": "0119b9e19928a8630d48fc5fdccf9699647406dfaef857ed0f1ebb9d78fe2977bd95106fb749cfe29e142924beae699d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616144, "uuid": "693a930d-4410-4b9e-b425-ee37f33a3e91", "value": "T18A530237C94BD194E1B038317DB88A6BD7B713B0E95E4426180857D890F2DCA23965F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616144, "uuid": "573da4c2-0408-4a4d-86fc-16c43f6ef5a6", "value": "1536:x87uGSO2G20agV4nLzQQYCi9fQD5YaGMut:xMuW2G23XnLsQYMNY4ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785616144, "uuid": "1804a011-b62c-468d-8a3d-36b868e4dbcf", "value": 66200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785616144, "uuid": "def932cf-b04d-44cb-b04e-6ea909582263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616144, "uuid": "1d5ed226-2680-411f-a525-e91dc994b9df", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e000824a-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566853, "uuid": "e036b82f-0b34-4dd2-99c4-b584cbdd60b0", "comment": "Malware payload (Mirai)", "value": "cebf1fdb7f2d89cb4fd1b52b10e0c205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566853, "uuid": "9acc3588-9484-4507-aea3-a7e659ba42be", "comment": "Malware payload (Mirai)", "value": "0b06c6a43376dfb3c30f888726116b0ebdd15b6312bae4a33556fe9e32bb3ba1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566853, "uuid": "6d08c918-cc1d-4ff0-9555-404f64ba3709", "comment": "Malware payload (Mirai)", "value": "93e8af70ed9134b2744fa7985b700c96ffc40971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566853, "uuid": "a4a4e3b3-4bb5-41e7-928e-d6765e486eda", "comment": "Malware payload (Mirai)", "value": "6e2abbf9ad894bb2c3d1558b30745acdd9c1a3897b4579d321e1b988374cbf467fc98a3acf265a72bcbb425a80806044", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566853, "uuid": "a826acad-6bff-4120-8b65-c4df371a7d65", "value": "T17BF34A0ABCC054FEC489C2744AAEB536ED31B45E5135B6AB2BC06E323D8EE717E5D640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566853, "uuid": "ced7ccc0-aa32-4ddd-9d52-516feef6e834", "value": "3072:DGWz//Pp6ldbBRLJJHNKAuEUFhaC11i79ML8fZN9Amkn7:Bz//Pp6kqCuT6Jn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566853, "uuid": "5b94838c-c614-438c-ab03-d866b64ceb79", "value": 165144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566853, "uuid": "2e544390-a94e-4cb9-8982-90eed647e003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566853, "uuid": "378fc607-3c39-421e-90cc-86bb1680472f", "value": "zero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12191d79-8de4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614612, "uuid": "ea627c06-f12f-4666-9d74-de2c7e41153e", "comment": "Malware payload (Mirai)", "value": "dd900ca1ec30e191abb893fa6ec2f952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614612, "uuid": "4a0aae6e-2aea-454c-bfab-37b71fe19919", "comment": "Malware payload (Mirai)", "value": "0c64f553a8ef087241465d40916b586bbaee3a0d2d443dec59c77ea931cdefaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614612, "uuid": "3a928536-edc8-443f-bc79-fb67a8069d5c", "comment": "Malware payload (Mirai)", "value": "9914ff6e89420159f372b63092c848243e63d486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614612, "uuid": "39516d78-287c-4980-8d03-42090e0b2a77", "comment": "Malware payload (Mirai)", "value": "f80ff2bd70eaa51e9fcf96ecffadde7343d6442f838e79cfdd09b350e08d52923162da62bbc8be1bad1adbc41abd12d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614612, "uuid": "c050c092-4857-4475-9916-7b083a395c35", "value": "T19C736DC6A683D4F0E8520571207BFB335673E63D006DEE83D779A936EC12641A66B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614612, "uuid": "ac8d8577-c1b6-43d5-9fef-a3529d3852db", "value": "1536:HEbr/QrdqjFK+YnwFDaCzoOZjleb3JdWx4HV1TI5K1fjvXX:kbrIJUK+WwFD/MOLeb3Jd+47skl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614612, "uuid": "cacb0bf4-d9e6-4e73-82f3-cfae4cd9e337", "value": 75344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614612, "uuid": "d0634452-7169-4e2a-85ae-2243cd601626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614612, "uuid": "b7b31537-033f-4efe-819f-548ac0215b3f", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5cbe4e-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545263, "uuid": "83f1bfe7-6e5b-424b-bd4a-6c8ce375481c", "comment": "Malware payload (Mirai)", "value": "46277063a198c1a7b60b1d9da0439b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545263, "uuid": "a50f6905-ee57-4185-89a6-17b20a088636", "comment": "Malware payload (Mirai)", "value": "0c81a033bfeae78241b0df416132c92652abaacb23d01562a2a9acd5aab37f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545263, "uuid": "1ed6b623-5eb8-4fe8-bc53-304a39b9873c", "comment": "Malware payload (Mirai)", "value": "0f35f97d95b24afc4ef38fc0507aa6b751d6cba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545263, "uuid": "aa7f3c25-f488-4056-8f9b-72879d522835", "comment": "Malware payload (Mirai)", "value": "d8a7304ad8ef0648e15b1204047228714d6fb131f8d8a146e35f038de8700ad725ab13039aef94b25cf40f3ac33ede35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545263, "uuid": "f52a15dd-232c-4344-babe-86b071badc97", "value": "T1BE431893FD92469BC5C027B6B76F568933A267A5C2DF3323C8140B113BCA94F4E67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545263, "uuid": "126909d4-a531-4e95-9f97-6d100fc372cb", "value": "1536:PtwV7y6/F57DttbqE1CvEHNelefNKJBCZ:lwV7yEF57OX9l2Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545263, "uuid": "c751c7fe-ba87-4448-a2f9-563ee53c372b", "value": 56892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545263, "uuid": "ec153d66-5e7a-4195-a541-0cbba476de75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545263, "uuid": "02f14e50-be77-4ddc-8578-d5aa527b0241", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edf0969-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621720, "uuid": "c0330511-4c42-41a4-a73a-557d1855171a", "comment": "Malware payload", "value": "1b160927b16bc0bb7a2e9bb2df56ae44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621720, "uuid": "abc9de4a-c283-4f63-92fb-01183f96c096", "comment": "Malware payload", "value": "0cc73c8e590c072028d09704addb87feed20184b1b7345a7cc46cc283eb25f89", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621720, "uuid": "0d60534f-21c2-4bf2-858e-abfb8f6a2f59", "comment": "Malware payload", "value": "3383bbcc1fa93e220a5f04fc385a425f4adf1de1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621720, "uuid": "fc5381fd-b53c-4a5f-b735-652017fe8563", "comment": "Malware payload", "value": "9c969a5da4305f4dd37b7af99336e76301cb00a0e890311a7b6ead942832901b54bcfe866d2cb76e62281ccc910abc00", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621720, "uuid": "15d6d5b5-1b00-4870-80a6-a88b644f6053", "value": "T1E3F08BED949640323F0D543771194C552602082F24B95BDD224E99635E0CFA8234EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621720, "uuid": "d1862c47-b35b-490a-a3a2-98c9c2ec21f2", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQkgTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsZgBYXmYRYCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621720, "uuid": "45fd64bf-c739-4679-aa5a-c8439c0d96a4", "value": 528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621720, "uuid": "e36977e3-b2cb-4fa9-8413-b3630e737408", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621720, "uuid": "35eb0f02-df2d-47ab-bee5-b3aa81d1e7ab", "value": "sensi_fb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ff2870-8de6-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785615712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615712, "uuid": "c864625a-e121-401d-be19-67de9a308514", "comment": "Malware payload (SalatStealer)", "value": "c85212d823d9412cb8eeec70e5145947", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615712, "uuid": "320762a7-ce7c-4625-adc7-f75c7e1ba8d9", "comment": "Malware payload (SalatStealer)", "value": "0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615712, "uuid": "dbc0fb19-3e57-459b-957c-95a2c18e2b99", "comment": "Malware payload (SalatStealer)", "value": "e728a6a5c5b29ea0e1355639a1ee577edf2eb443", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615712, "uuid": "9c1ffbb4-41d9-4ad9-a2d9-6c8633b083c8", "comment": "Malware payload (SalatStealer)", "value": "6218677708b4c5bd8ee68c95d41e5a06b571f0b44da89e21406c8363099dffe85c912de6390e8f99b720a4b39eccd7db", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615712, "uuid": "2b39a6ed-d4fb-4b24-ba6f-47218ef0a5e7", "value": "T17F2733DBB811018ECCB283BD8CC435F0D9E94929C29028FA0D397F9CB55979A5CE6D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615712, "uuid": "8a46a7b0-d76a-43fc-a886-dc0fa99171d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615712, "uuid": "15403fef-ec2f-4e9f-8dea-2ad73f747c3f", "value": "393216:8ARzkO93kHxQMc4lfl8UxgmSJEB/3NOg7KEl8KFkbSRAyHxyYMKNAVUzXj:DzbUHx7l9vSJkVJFkmRyYMcAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785615712, "uuid": "41ca19db-e4e3-49c7-b1e5-a73247276a33", "value": 21547520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785615712, "uuid": "a884945f-1170-498e-bc76-f3fc09009275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615712, "uuid": "cbc8aafd-fa65-48f5-805c-008c76aa0f3b", "value": "KRX Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670ad090-8d7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785569657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569657, "uuid": "a75eaa84-2d95-448e-8175-2aefb32d33da", "comment": "Malware payload", "value": "5511d09d0c41a1857dcafe70408d9af8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569657, "uuid": "555f7506-ecfc-436e-8be1-62813c349b07", "comment": "Malware payload", "value": "0eb01e1c8c5b5d5da9fc75e8b0ac3f221675813289640979f8e7d98a46d3e4f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569657, "uuid": "337503b2-d47b-4c2f-a90a-6ff9e891c1f1", "comment": "Malware payload", "value": "16bd3be05ec45dcce44e76263feae1ded386fc13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569657, "uuid": "a2f8bc79-d940-4a85-92d6-19b29b8b2ba2", "comment": "Malware payload", "value": "e8618e7c2f8dd8a60f3d32b1775cc2eaecd209c9e573551451bded8e0e183500ea9c9de1024a0241eed9221ba497b5d2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569657, "uuid": "64bd04e0-302c-47ed-83d1-9278879a4254", "value": "T151236C512A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADD910962D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569657, "uuid": "14407ed6-11f6-4c7f-b81a-c222725fb262", "value": "768:eJFWzZx529GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:8kzRcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785569657, "uuid": "b35389df-9040-4173-8764-48c9e12c6bea", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785569657, "uuid": "adb32111-3200-4637-9184-d43d54fd8ca7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569657, "uuid": "f81e86a9-d9f1-44a1-b79d-66fa9fb8d646", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057a6465-8e03-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785627905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627905, "uuid": "af04697a-4100-4ecb-b5b4-bc39775dae6e", "comment": "Malware payload (NanoCore)", "value": "1a5e935a2545bde844f7aa04d6bce296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627905, "uuid": "7829da97-2cfe-4e22-8e8d-fa548039b4cd", "comment": "Malware payload (NanoCore)", "value": "0ec1ed0daf72e7f3b2a9afb44d8e2de77b97b126788e54e0cb948cc176de91ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627905, "uuid": "9a72008e-d020-4f24-8270-7d044af94f1f", "comment": "Malware payload (NanoCore)", "value": "31943eb5d52b7f2af3f21db0a2d078899274033b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627905, "uuid": "a1dc3623-ff8b-41d9-8613-c9b25098e86c", "comment": "Malware payload (NanoCore)", "value": "ee8a5a2659f9e907265e8387263e401fa38b7d836fa37eec76d75b271596ef89cf3b2a2519460411a38d134afa38c2a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627905, "uuid": "4b700a79-4288-432c-9809-9f7eabd6997d", "value": "T1E614CF6677A8492FE2DE867D601212529379C2E39CC3F3EE58D854B38F227E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627905, "uuid": "4121ad94-5db0-42f0-913e-63f497fbddce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627905, "uuid": "c61738fb-e93c-409e-ae29-38a7978edb95", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIAHwKNdlIhtRSE8KaDtyvLGVQd:MLV6Bta6dtJmakIM5zTw37ax4L24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785627905, "uuid": "b019d379-98fd-43a7-b791-cca9b5d08e2d", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785627905, "uuid": "e10ebb63-3800-4f30-838e-94fe1ecc51b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627905, "uuid": "7f8821e5-6030-4899-a545-03f85bc2257b", "value": "1a5e935a2545bde844f7aa04d6bce296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb507a3-8e01-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785627196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627196, "uuid": "78f308c7-9666-44b1-9515-98403dbfb010", "comment": "Malware payload (RustyStealer)", "value": "3b37fec109ca8e946266eb1bdf8ac1cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabubaRAT", "colour": "#A48FF5", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627196, "uuid": "397672c9-3068-42be-b704-8b3e7ce81e63", "comment": "Malware payload (RustyStealer)", "value": "0f0fd4870160fab8ca35512ecef8425e8c0e733f7a771109598e8efa36fc42e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabubaRAT", "colour": "#A48FF5", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627196, "uuid": "3b1fbe32-3998-4e22-aaf2-67b4af302964", "comment": "Malware payload (RustyStealer)", "value": "0c1e615682656ef0567acd7a9dc4a1336cd67831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabubaRAT", "colour": "#A48FF5", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785627196, "uuid": "7e6c91fe-c625-424e-8637-2cfa44ce5bb7", "comment": "Malware payload (RustyStealer)", "value": "ed2dd0147e95d433e6f8ae77322392b45ae310b5af1ec5af0091c5385a3b6e0276bf346ce525bacc42c79c5e2280168f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabubaRAT", "colour": "#A48FF5", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627196, "uuid": "fd8a4ebe-6aa3-4cfd-94c3-2fe36f8fd0d6", "value": "T17CA65B43F6A291ECC16AC074835A6233FB72B84907217AEB57D486313F52FE06A7D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627196, "uuid": "03bcfb82-cb1a-41d1-9239-5069fd525e19", "value": "246a347f07eeee769d4ff08b3997a170", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627196, "uuid": "1efc9ebe-4332-427b-ba35-9e33003c747c", "value": "98304:YHKJElk0e+uXuzE9/c3m9u9CNJ4H3Fdyr0g3FMzCFoDC2rA/95Bn+:USMcNI42zCCDCWA/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785627196, "uuid": "fa4339ab-f379-47bd-a817-62bf8f5cf8c5", "value": 9956864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785627196, "uuid": "fe0a0c56-e706-4611-bb88-8cfe7ed048dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785627196, "uuid": "1fc87350-0220-4789-b130-964fa826e3f8", "value": "nvidia-runtimer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f228c2-8db8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785596017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596017, "uuid": "68c1070c-6708-4af9-b300-7dbbbfdc241f", "comment": "Malware payload", "value": "a27a6841affb6c8f0d016370a2262dcb", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Valyria", "colour": "#8CBFC3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596017, "uuid": "c6a6a480-5a94-4042-9f16-e991988e3c8a", "comment": "Malware payload", "value": "1109f814cc1af300e85891fe792789960e7b0d6b593fbc9c2f37e3e62593b224", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Valyria", "colour": "#8CBFC3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596017, "uuid": "0dd89c5e-2537-41cb-92bc-597811057b5e", "comment": "Malware payload", "value": "ac8cc92babced4998f64ed9951dce6b01ff8b91e", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Valyria", "colour": "#8CBFC3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596017, "uuid": "18a7a432-b999-476a-bba8-609866330e5a", "comment": "Malware payload", "value": "581462132c579c5630214e774eda5bc050c3cb5efd7a5fdb759f7190c2b88232cd28f0b476ef2684bc3b6b9d375f58b7", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Valyria", "colour": "#8CBFC3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596017, "uuid": "3c423bc0-cf84-463b-a04e-6d1b1efaf6f2", "value": "T156562331AA521C6ECAA04376705E3D266FBC7653838CDAD6B9DC51423B97FC08A7B04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596017, "uuid": "11eeed14-b45e-43b8-9809-ecdbddabb74d", "value": "49152:A556BZd/0C8CyDV4kG19G2pG2dxdKcPCL1Q9AWQpGSzo5Mh/cEqrKIzvwCEuPHcT:lEuim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785596017, "uuid": "aca4bdcf-ddf7-4d06-968f-1914fcfe7f64", "value": 6371328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785596017, "uuid": "6f75f44d-09f8-48bc-902b-cac33c3e6750", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596017, "uuid": "c3780f2a-86c4-4da2-906c-266880185399", "value": "Env-rxeueydygnzn-61266.Ofcl.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af264b5-8d3e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785543491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543491, "uuid": "253699f4-161c-4e38-8595-32a01f402ff8", "comment": "Malware payload (Stealc)", "value": "9c1bee9ed7cc87bf6a874b71fea8e178", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543491, "uuid": "253d1d03-967a-4f1b-b320-ffa27be4b1e9", "comment": "Malware payload (Stealc)", "value": "11621978916ef99d1c24cc4c7355d5a05d862dc9769b23f6685a21910d334726", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543491, "uuid": "ae0e6eaa-c597-4b53-a62c-9340967fad00", "comment": "Malware payload (Stealc)", "value": "5260b728d1027219cd355b9ded2110897923d00c", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543491, "uuid": "81890b89-2de5-4d05-ad7a-3da7cfdd41d2", "comment": "Malware payload (Stealc)", "value": "151438335252883627458224cdcf431848636bcc9fefc3829b03a176b73db293e02d15f35637b44470eb22d142501931", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543491, "uuid": "6e2308dc-79eb-4866-8224-bffdd305eb12", "value": "T117A5235386E78C5AE4266734CEE245978732BDA5C668ABDF13E03E8E1F724C1B430752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543491, "uuid": "616f631a-8d6b-4c5a-b2f1-c17f9df3bf99", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543491, "uuid": "0a0a17ad-c9ad-46a7-b1e2-3fe38608cd31", "value": "49152:ojYejNFHEFG95gGupygLmV51WPvpLINbmFTtOCYop:ojYeRCA5gGupyh5WvpLIN6TtOCRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785543491, "uuid": "702a0406-771d-4bdd-a382-16543abb950a", "value": 2152960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785543491, "uuid": "37e1deb6-5af6-4e77-8b3e-72ca02a866f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543491, "uuid": "a83de278-14a1-421b-a598-3b8282da571f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad05a0a-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785566496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566496, "uuid": "cab1663a-9b09-4e61-a68d-5f5d04b881c7", "comment": "Malware payload", "value": "ea9851639f03accc476fc45b8b48f916", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566496, "uuid": "541fc610-6e09-44dd-b0b9-13265d62f8a9", "comment": "Malware payload", "value": "118e079af013020b3d6edc11a3abded489a56fe5935ec6fef24fba706baed47a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566496, "uuid": "5e91e66f-e1ab-40e0-a393-ad015b1a693b", "comment": "Malware payload", "value": "df833b0480e0ba59508e6130b4ca58ce8e3865e3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566496, "uuid": "3c26b584-8e82-4899-a2bc-81e0f9ce88f5", "comment": "Malware payload", "value": "adafeb15bafe496f3ca93856ef5f67abef22f997e257e2ebfcba50a22cbc6c3f7b4ed2137934cc5840ca8ffbe774b004", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566496, "uuid": "dfe27c70-d327-4122-aad9-f01defd26cfe", "value": "T138236D651A857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566496, "uuid": "6196cadc-3824-4f10-83a7-9189cb52593c", "value": "768:/sXRWNGxVG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:/Alx1cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566496, "uuid": "29be3734-85b2-4fec-8101-7aed43cceac3", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566496, "uuid": "e5d58461-ba4b-4b99-bbc0-f61c53896d1a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566496, "uuid": "22bbf2fd-9aee-4cfd-ba08-396786543a0e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f2599-8dc8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785602797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602797, "uuid": "0c6245d4-d401-4163-853d-af6c4ac6f452", "comment": "Malware payload", "value": "3988b8672a2233bfed72f95eaddd3142", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602797, "uuid": "a52a9c94-6f1a-4a36-9a91-350408d07011", "comment": "Malware payload", "value": "11f0f5b941e46c270da2705545255105008325a28dd26dac5669128c9651135a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602797, "uuid": "df54dec5-2760-479a-b1d7-d19d1c5e9d85", "comment": "Malware payload", "value": "a638d52a2f51672fad40fd55664e8a2f36783c1c", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602797, "uuid": "cfb744db-c48b-46e7-839c-362d81400d3f", "comment": "Malware payload", "value": "53c55ef66befdca72533ff6cfe808a943857aec66658ff319837dd0d6f5fe278f2edfef943abd71035af9dd71bb695a7", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602797, "uuid": "ac51f829-0984-4a4e-a541-17f096c9c27e", "value": "T196144B5BD4D540EDEC1AC638899AE237A4B2FC5A1936BA4F2BA0DF151B50B30B71DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602797, "uuid": "0a8fa6d9-ac4f-47c0-a567-2457d8f90b81", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602797, "uuid": "82afe981-e95e-4c63-9a49-7124b165ef34", "value": "3072:PcktfAkaT19iAPkAMf89JFqTvurOX/yrfjqbplmYhle5L73k7g9/c:SD5M09JFqTma/y7ub3e5fkg9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785602797, "uuid": "329f6a66-3b5a-40d7-89da-20c00ed15c60", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785602797, "uuid": "a7185274-9390-482b-bf0d-2510c204f2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602797, "uuid": "bbf45d6e-23f0-4047-bd4e-b77092f334ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0a1a2a-8d44-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546046, "uuid": "e8b3e14b-50c2-4dcd-8fa6-9876ba54de11", "comment": "Malware payload (Mirai)", "value": "fcfdcbde7e0414492d82a7b084cdf7f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546046, "uuid": "ea0ea6cc-28b9-4a45-a16b-abda97a4dad2", "comment": "Malware payload (Mirai)", "value": "12ee92d529a704272662846f7752c077141070067246a4a9028309cee67583d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546046, "uuid": "b6d14753-940f-4896-8a70-58dd105826f3", "comment": "Malware payload (Mirai)", "value": "7b5d6035d0927e3d0c1882621a8e7406f7a910d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546046, "uuid": "3c0351b5-2a50-488d-9908-6632ea6273c8", "comment": "Malware payload (Mirai)", "value": "4a8f0abff93bd8e0dbe8903c2d68956102b26f28b1eaeb07c2b1867f290d791fd86f948117c0cb85fea7446138efa7b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546046, "uuid": "8fd87f82-9bb1-4528-969c-24b4850ed76a", "value": "T118D34B06B71D0943E2633EF43B3F27E193DF9A8124E4E740251FAA8A9271D325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546046, "uuid": "42bbe7d3-8dd2-4693-873c-36a9d5357f2c", "value": "1536:n4ODLHU7xnVw3JomQhgH0HFksumWTzcdGn/DD4TOuwOpvA/bNfYBvOdddmS1ebsi:4k+xVXmZHn/DkT7m/HQEspp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546046, "uuid": "dfabefbf-faef-4878-89bb-a28847fd0e4b", "value": 141180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546046, "uuid": "97866bd3-4f23-4952-a7ba-bb26876e9184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546046, "uuid": "0216902d-2b1c-4ac2-8e00-16180d7704b3", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe14d66c-8d4a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785548865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548865, "uuid": "16276f86-e10a-4816-857f-53863a022d2f", "comment": "Malware payload (Mirai)", "value": "4e9e80314352b15291281aecf037068f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548865, "uuid": "d059c0fb-074b-4114-b5a7-e6e6d22174c5", "comment": "Malware payload (Mirai)", "value": "137696672595176cb5fe237834f9de9194d25e5d9b6e0e3ed9e78daa84b0bc94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548865, "uuid": "f341b5ab-7d98-421c-8b72-a1bce48876d4", "comment": "Malware payload (Mirai)", "value": "da640f173e8cb6c6cee6a73584ff8710179d0f59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548865, "uuid": "1fd24402-dfd6-45be-a085-c2d1f4e4cdde", "comment": "Malware payload (Mirai)", "value": "89ed35fc1b882bb25d80469112753213d2ab4a1f646d00faa5ae5a4296bb6a8780d2197d98e7eda51ea797daefed9b06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548865, "uuid": "4b50f29e-d718-4116-aa24-1459e5f120b2", "value": "T11E142B05E6404B53C0D327BAF7CB434A73239B54A7EB73059628ABB43BC679E5F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548865, "uuid": "b1745529-8748-424f-b3ae-7e64e6557f70", "value": "3072:enBrwO2vLsNGwJ3eTaEy+CC3KpWTF2E7I15uFxGHrM/RW6KQejQZGRuM:Kw1okwJuTaEy+CC6c85ujgrM/RrKoGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785548865, "uuid": "802f3a15-a187-4b4c-a2c8-0a4888a48984", "value": 194083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785548865, "uuid": "21fab0e1-b37b-4d94-8937-56d79a6cf8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548865, "uuid": "7368a90e-33d8-4ae2-9953-417af6511541", "value": "137696672595176cb5fe237834f9de9194d25e5d9b6e0e3ed9e78daa84b0bc94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bc0c26-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545014, "uuid": "cbac99c0-46dc-4ce7-a7c7-88d5771a071c", "comment": "Malware payload (Mirai)", "value": "15d50f94b9a03b3e5576e3f9a8f6bdba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545014, "uuid": "d60cf0dc-7e46-4a72-a163-1409fbd165d1", "comment": "Malware payload (Mirai)", "value": "1460d31f0473b71fddf08c397d9cdbad8986b1bef2addbd9e7b9ceeb301280da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545014, "uuid": "4db41b79-2d86-4f19-b662-e6061bd858d0", "comment": "Malware payload (Mirai)", "value": "1206c81451c75be5b494d29ec72f9ceec7f71573", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545014, "uuid": "08e435f3-7630-481f-8146-cb5d731b7d3c", "comment": "Malware payload (Mirai)", "value": "93de4794d178b2919ba974096f160f2733f7d70da9fe348f637fb17834da05e38054076268b18f2d1e4a7940c2ed546d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545014, "uuid": "1a04be8e-decd-424f-b452-cbf3e37cabb8", "value": "T1EC13F1734919DEB6DCB1DD71EAE516C3802A27FC14FA31331D100638B96649FA8EC56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545014, "uuid": "03eaf239-829b-40a8-8428-cd0e829493a4", "value": "768:VUpYuVm+KmSuB/x/fsN/cIJZkrxjurJvPcXjaYf6Ys3UozC:qDgmjxH/IJsurJvP4fQzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545014, "uuid": "2cc04fcf-5f67-45bf-ba3b-5eeafe60585d", "value": 41484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545014, "uuid": "0996f3d4-ac69-4fe9-9085-987414c827bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545014, "uuid": "7d73a46f-e31f-4858-a931-830c49bcad8f", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33ee2b7-8d65-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785560443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560443, "uuid": "f217213f-bea2-4c37-83cb-50d26c9f585d", "comment": "Malware payload", "value": "57007950791e9e4a09fb09cc0cf6ac15", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560443, "uuid": "5b76999a-1d48-4198-912d-4f570d532145", "comment": "Malware payload", "value": "1590f5bc877168396a099a8726b2922c2f5fc4116c047719fca6a315ca33ba2a", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560443, "uuid": "e2b5fe7a-b19b-4118-9934-98b8e1ccb5c7", "comment": "Malware payload", "value": "b1f47e7bea3efea9cdb1217ba1ebd2b9e796cb36", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560443, "uuid": "ed24b98c-1c80-40ae-b3f3-d3b3bb715c34", "comment": "Malware payload", "value": "187ce33ed036fce579ce9f9c4fa4e2303c9a740ec34ffd2c07f7fbc289075755f04270e5a1f3d0466cc4e55b47a2f487", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560443, "uuid": "6a0b5612-e13e-464a-bc7b-06503a05473c", "value": "T10FD4021AF7E664D8D1F7897488A20A63FB763D3347405A6F03D08B796F236916D1AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560443, "uuid": "37acf2c2-e760-48c7-b73d-911c86f3b742", "value": "36dab651ebd71b404011f23a733060ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560443, "uuid": "9038d303-00fb-42af-8bec-16aa6096b51d", "value": "12288:HIG1vysVKa9g5fHW+G4qkkCg8MieaI0KoUZdem8kL3eadYmq5jgJ:tysVKa95LL83IDZTP3kmq6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560443, "uuid": "8633fb37-1fa3-4df5-b29d-f56c9412aa4d", "value": 609656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560443, "uuid": "ace650d9-077b-4fca-81c8-d4eb1f4b36b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560443, "uuid": "4a81ff00-2327-4ab0-a9e3-2f529af58ccc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba81078-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785613930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613930, "uuid": "21bda369-dc1d-409d-9b4d-cd3d493eeb4e", "comment": "Malware payload (Mirai)", "value": "34dbed6925028cad2a7f9ec3eb967769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613930, "uuid": "384510b6-670d-4dee-8d1e-794beeb1bde2", "comment": "Malware payload (Mirai)", "value": "18866d5151d7654f2aa300f33ce2ee45c534079b7522bc4cc5e0a7395341402d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613930, "uuid": "d6e701b7-a064-4dbc-a4de-ac7c7743c3c0", "comment": "Malware payload (Mirai)", "value": "88773aaf1fbc3e2849012e466b54422286427d1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613930, "uuid": "7882bb2e-d6ec-4c6a-be04-affb0233753a", "comment": "Malware payload (Mirai)", "value": "3d42e6a11cd64ea7537835f251989e1373cb0381959d90ab3706127d5e37f32b093d77f55e391c3744b57f4463bc1632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613930, "uuid": "e187197d-84a5-4751-945d-0f20da290da5", "value": "T17F13F16C1611C4FEDEB866B686900B202EA44FF29D0BCD1558C5B349DD0799E3BEB7C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613930, "uuid": "10704cf7-cdfb-4ecf-882d-5b47c4ab5526", "value": "768:LpXgvCXGRkgvn4Sq4Q98eegxwbfYYVHQb7l4x2Lk7/WFNH+JgGlzDpbuR1JV:eC2RkA4Szjee9fHQb72xn/WFxqVJuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613930, "uuid": "29e14a12-a537-4853-8db8-d619777254df", "value": 42288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613930, "uuid": "63ef17e6-6e1e-4d92-a306-5656a10bc71d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613930, "uuid": "e7615d3a-7000-4382-9219-8881dcec48a1", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a110e648-8d73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785566318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566318, "uuid": "a97c286e-8329-46dd-ba8c-58612d236231", "comment": "Malware payload", "value": "d730f6644006d4ff76247bde4aa79607", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566318, "uuid": "f01b9e29-6727-4abe-bd64-3ff5e4730a6b", "comment": "Malware payload", "value": "197361c0875eaab203eb450f11c0eef71910d251cd26eccc6f8d32a1f80e9c30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566318, "uuid": "3578bea1-fbcf-4a08-8532-485150894225", "comment": "Malware payload", "value": "f7560eda0ba94079ed9ae74bf339ed7001fce030", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566318, "uuid": "ebcf0f1d-0fd7-473f-932e-cf3f19636533", "comment": "Malware payload", "value": "9ae354766ce62736d0120e780791991e96e8a88e354a99105a90e61c5e97507f07e764b431d377bc327d79db4d3fc313", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566318, "uuid": "a6840f6d-57ea-4368-957f-5b2f25625433", "value": "T1BDC27D966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566318, "uuid": "fa0875a1-eade-45a8-bf31-d939ab9ae335", "value": "768:f8vCB+25j6es8Rdx9FYpMSUpi+20qUpi+20YQX:f8l25Jdnd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566318, "uuid": "03b90466-4722-46ed-abcb-46a9d1ab8bcb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566318, "uuid": "873fd25e-ee3d-44f5-a417-f23b4ae05ec1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566318, "uuid": "e114df1f-e778-4811-a9e4-a190be3e0897", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7de99c3-8d78-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785568477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568477, "uuid": "7122846e-0b83-428d-bf13-c446a04efb56", "comment": "Malware payload (Mirai)", "value": "186a185ed50aa372bdbe6ebf96209003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568477, "uuid": "232cc8f5-4efa-4b8b-a2e4-da9d5bf06a7c", "comment": "Malware payload (Mirai)", "value": "1bc2394cde5cd416a52d99fececd943bd25ef72e7eebb1ce10995f16001976dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568477, "uuid": "cb198e1d-c85c-4432-90e7-4e922712f6e9", "comment": "Malware payload (Mirai)", "value": "eaa295b04a3a6272f70780eca5d5ac756fd3fe4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568477, "uuid": "109ecda6-c50b-44a0-90d5-020add26e510", "comment": "Malware payload (Mirai)", "value": "d83e62622fc98b915b0a5969db163eb25cb8ffcbb1c56dc11c217516a58c1c01b99645715a6078f8bb7c7ad97f2976c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568477, "uuid": "c658149e-299d-4f86-97df-12edaab3c5a4", "value": "T159043A45FC519B13C1C712BBFBAE428D372A17B8D3EE31029D215F25378A95B0E3A642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568477, "uuid": "923d108c-8b5f-4af6-bd80-06e9f40bdfeb", "value": "3072:DYm94Ob8n3tzsYsiE8umANALICGwETeXo9JtHnT:0mOObC9nDumANNCGwk59JlnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785568477, "uuid": "39247274-eecc-4ebf-b3d3-b9d2387444e6", "value": 186432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785568477, "uuid": "0777f783-d8ed-4c63-bb15-463f586b2eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568477, "uuid": "5dccd301-a1ca-47cd-a87f-c3913b3e8918", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aa0977-8d7f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785571485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571485, "uuid": "0872f4f1-9ee3-4589-a3d0-f679f76f0567", "comment": "Malware payload", "value": "f5c0c6dad1456be1d6bf2abe02678024", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571485, "uuid": "3b721953-2d0d-4965-ac77-d494456619af", "comment": "Malware payload", "value": "1e10951a60bcbfb3fb2cc9656a62d286c80959b6856ea7ef33dd9bf0f9235271", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571485, "uuid": "cc4902d3-e1d0-4f59-ae40-497aac714538", "comment": "Malware payload", "value": "f904988f163409161369f90c865dcef770fe3fed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571485, "uuid": "8403f9bf-c10d-4f17-8b0d-0f7761a0ecac", "comment": "Malware payload", "value": "5520da03e1b5eb2e4d65c6ea543305a29c19f75d656c32334e19a68cc8012a5d2836882846ed34427ea3d9b3a9eb37e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571485, "uuid": "b1129ced-847d-42ab-ad1a-e08bcbee1507", "value": "T197C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571485, "uuid": "70213695-7c0c-42e7-957a-512d63c6b6a0", "value": "768:e8vCB+25j6es8R69FYpMSUpi+20qUpi+20YQX:e8l25Jsd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785571485, "uuid": "bdc7c109-4ec0-4701-95c2-a2cc310ef7f4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785571485, "uuid": "ce64dfab-26a9-4bc6-8329-29d2f70650bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571485, "uuid": "522a7ab1-d5cd-4df0-9eb4-ce16a83045e3", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de8a794-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785573104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573104, "uuid": "49c93df2-da22-4ca1-ab19-154b9ab7576a", "comment": "Malware payload (Mirai)", "value": "804e474a2c35a348cd5f67d4182bc3d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573104, "uuid": "8eaa31d3-ab5a-410d-bee3-706aac7893e6", "comment": "Malware payload (Mirai)", "value": "1fbce250c4754a6ade5ab191b8274e77b59e501bbb0e7a20a578c182f11b94f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573104, "uuid": "9fbef222-85c5-4555-8963-b73572d67ee0", "comment": "Malware payload (Mirai)", "value": "c3d04e595285d6b9e6389c7d30ee60e201358133", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573104, "uuid": "93c19069-722f-4e0b-a9cc-1ebcdc7bf3b3", "comment": "Malware payload (Mirai)", "value": "cfdbdd9a212310c919429b16d44fe58812f44b835e375078a74610881743780691953d8caf7e4291f75ebaee71ecdaa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573104, "uuid": "1f735c0e-e2a8-412f-89e6-efc3a698a3d2", "value": "T119837F2631346A17D0E1E6BA01F74B12B2D21BC96359D38FBEB30D9F5E153502A2ADF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573104, "uuid": "423d7058-dad7-4eed-a88f-81a40f6b2789", "value": "1536:bS3uZ6y69IwngO3P4WkWIbbOSBqZ/LLpqbSz9R/N1IHkqMZfiV09bdUJEOwK:bS+4yA/4IqyOKIcoXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573104, "uuid": "a21d8747-b93d-4cae-999e-d06dd3f27ec7", "value": 86092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573104, "uuid": "1e157fd2-260d-4c6d-8624-c5e500b6c850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573104, "uuid": "f040ac97-ea32-4040-88ff-417f2783eb09", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c838c7d-8d72-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785565881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785565881, "uuid": "6b384dcd-ecef-4228-a523-6941dddc5366", "comment": "Malware payload (Mirai)", "value": "da1c6911ad794205c1e4471d9ca9278d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785565881, "uuid": "32ad15a6-4755-43d2-a3e4-205cb21f269e", "comment": "Malware payload (Mirai)", "value": "2018a012f34bde9a99f020af92575c4242ae5aa6626771e44f2f404cb99f8ca9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785565881, "uuid": "10e98de4-9d92-4808-af2a-79bf36a8f858", "comment": "Malware payload (Mirai)", "value": "da5644bb4606b95ed98e372fc28d6482cb97c7fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785565881, "uuid": "66d42b03-6d7b-4e5f-961e-acd103c10da4", "comment": "Malware payload (Mirai)", "value": "27af2056de188ef974bf684842d434b2dde5902be94db3e6b8a92982c3d2f01a870dd4e73a4d323ed248598048e3786d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785565881, "uuid": "4880cb02-d149-4422-aa99-67f42168e299", "value": "T1C9737B03B5D100FDC19BC0748A8FE916FA32BC5906247A6F3B987F652F36E621B5A351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785565881, "uuid": "a43b1cc3-853b-41b3-b9c9-34711fff41de", "value": "1536:VWAJVmd7IoZoQpf1vhmhxX48unZXPmSF9Hq115XVb/hayXD6tQyN9pUvypknsUr:VWALi35N5+xIzRSapknZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785565881, "uuid": "b1577a89-1966-4d91-b0b0-d391e5c99240", "value": 80144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785565881, "uuid": "62dd68e8-d11e-498b-ac42-371ee1aed925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785565881, "uuid": "e832a995-4939-4315-bea7-10c0c6a9fc6b", "value": "xmr_miner_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e948b524-8d79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785569016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569016, "uuid": "3274446d-bab1-49ba-8e28-6d55a04148eb", "comment": "Malware payload (Mirai)", "value": "6a18e840fe152250d2b58c520c9ee10a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569016, "uuid": "217dc45a-cf38-49ca-a904-4f2a94f607f4", "comment": "Malware payload (Mirai)", "value": "20bded87ace74d15289a8ad9fc0387cafe251e384802adf5701f9415ed3a69aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569016, "uuid": "5e62539d-362b-42d4-b9b8-86383e47c164", "comment": "Malware payload (Mirai)", "value": "0adb77448c280e57c32e0b770469e8ddd1e08b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569016, "uuid": "8074ff63-663a-46dd-8d75-dac1bb0fc3d0", "comment": "Malware payload (Mirai)", "value": "ea94fc4c4bac81d7ed183945b74487c98fd4cb39b8c2e7bc7dc7b70418cb1dbf33263dfba8badc142f0b5381136ec3dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569016, "uuid": "e034069b-bb92-4b16-8a86-73e7d082c239", "value": "T17C8302B19C855EA7E088B5338817CB5D33757D1B2D333C7138BA5A87ADE488EC4B8816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569016, "uuid": "441efbb8-d9ef-41d6-8341-43055985d6a8", "value": "1536:TqKeeHA3tmUAFNFZtINMnzCLHxajfqoCv7T0LcubMWcELEPAInMNw7SQrZ:TreeHA3tv0Zt7nzCLH8jfqjjnubBL2A+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785569016, "uuid": "006a37d9-c85c-4bb1-b5dc-6dbca7ba5806", "value": 81196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785569016, "uuid": "fd539860-7e4a-4b10-a376-5d920663d991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569016, "uuid": "ffc77c69-86fa-4b97-8caf-b65aa24c6ba5", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889902bf-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785613951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613951, "uuid": "cc480a58-c277-440e-8d5d-77d30aa491cb", "comment": "Malware payload (Mirai)", "value": "7238cce787240aa77259df779fffdca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613951, "uuid": "2ebd4536-23cc-4fe1-a0c6-509573014cc1", "comment": "Malware payload (Mirai)", "value": "214c00d6763e2573ef5db558cb209bf2aa2968ca6618f9edcbc9ca1ec55c000f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613951, "uuid": "cfe3e19e-414b-4508-be73-c0ee5f2fbd92", "comment": "Malware payload (Mirai)", "value": "2b848adf4b2dff997b78ccfb6b8b026bcc730942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613951, "uuid": "f5c70312-4380-4523-9611-c0a924c347af", "comment": "Malware payload (Mirai)", "value": "71b5689f0a9c653990ab1406f63b68b6b944104aec06b493eb4cd7c3adc4d37c7ceffbf0349fc57c0d8f03aca0ac8da3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613951, "uuid": "0e05597f-551d-47b8-beec-87aa0f0d71b7", "value": "T110932956F8814A21D5D116BAFA1E128E331317BCE2DE7212DD286F2077CB96F0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613951, "uuid": "cee99d8b-58de-41a2-8a7e-9c3eac978235", "value": "1536:ZIn3DR7MSgzwGljwWvQiBl7eWYVD5V61aHU+bZVA8Uxi3vufLup7NlYV17f:yR7MXt/vdBB1UDb61aHXvufLuphlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613951, "uuid": "a55d2d73-8006-4f93-9e1b-2565c6b19209", "value": 92760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613951, "uuid": "47ac77be-40b0-46cd-9edf-08223c24d02c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613951, "uuid": "797cec04-a890-4fbf-b619-0d43b6f0ce32", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0ed3a4-8dbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785599059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599059, "uuid": "567dfaaa-d6c4-4c84-85dc-cf7cdbb366d7", "comment": "Malware payload (ConnectWise)", "value": "63b7edc9bec5b43b3f012abf34e6c8f7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599059, "uuid": "55da7653-6857-452d-aea5-108caa7beb2d", "comment": "Malware payload (ConnectWise)", "value": "226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599059, "uuid": "34dee98e-6754-4423-a64b-7a6ee233a9db", "comment": "Malware payload (ConnectWise)", "value": "28af9a5bcfa86426fd4f77313bdb3ce1033410bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599059, "uuid": "c0ae7b1f-a6ea-4bf8-bf48-1377f1fc01d2", "comment": "Malware payload (ConnectWise)", "value": "56315010a9ffd82e6d2cece480ffd9af41991660882d6dce64dbca5a904cd7e8f8eb830a45ddf1d3baf4c6b97ddb60c3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599059, "uuid": "4130c735-d4ca-4aab-b33b-7d281bb35c97", "value": "T126647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599059, "uuid": "4e8fad5f-af81-4e1a-b12a-c866d2d0372a", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599059, "uuid": "5af29cbf-1143-4a27-8b0d-51f7e746042b", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785599059, "uuid": "d180cebb-eff3-4715-bc92-7fa195c470c1", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785599059, "uuid": "ad69e5f7-fe31-4000-9b74-0d1fc68c1edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599059, "uuid": "c8accd78-31dd-4674-bd76-1e0995435a8e", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29feea27-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544644, "uuid": "c76ed2b1-aa07-4d55-9582-33bda9834a76", "comment": "Malware payload (Mirai)", "value": "b934f609340b5bfdb98e3ec8469b50b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544644, "uuid": "ed31cc5b-7d3c-41d5-9fc9-3cb0e1abd406", "comment": "Malware payload (Mirai)", "value": "25ac6e121f01285a41d461ca3f5a38b14a7c8148219ccbe270fe52d90c2f104b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544644, "uuid": "8b66b665-ba52-4d1d-b2e0-45a68c4c3ac7", "comment": "Malware payload (Mirai)", "value": "48dc9391f1d900fa0de4cdbef2ae385a36ef512d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544644, "uuid": "9623302e-2577-417f-9966-41e1811d7008", "comment": "Malware payload (Mirai)", "value": "bfb0856693bc0da79d0420f3ddbd6943a4bc19127affdc34e74778529862409f6fbd235a811ce80ddd375cd277e1fac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544644, "uuid": "04a227c6-6348-4c13-8e46-88abf6c62a6a", "value": "T1AD13F138E507089FE9D591B91B68A3330E1407A2F94BFC51E2A8D17BAB845777863DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544644, "uuid": "00644307-055c-4c7f-9cf8-f3334c5a4f9d", "value": "768:EJH/2hEQv3U7JTuzqzgxoehGqe/aJNtdZ6JRmC8DSbmjidlF2IJgGlzDpbuR1JO:E1ed3U7ibx3h+gNScCvbXd32IVJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544644, "uuid": "d7fa81e5-567d-474d-92ac-b2f7298e6b6e", "value": 43976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544644, "uuid": "099ebe34-4fb8-40e6-baea-231161d446b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544644, "uuid": "a82b49eb-f569-48a1-8606-f8492a169077", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916e7cb8-8d75-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785567151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567151, "uuid": "eaeeb525-4541-4824-be27-9590eb3d3b81", "comment": "Malware payload (Efimer)", "value": "14b1eb938f22e162ec0c25c6d867fc1c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567151, "uuid": "dab118f4-ff4b-4a19-9e33-fd80e93be48f", "comment": "Malware payload (Efimer)", "value": "266ee21a6c9f3408e472b4f146db4d1c6e5b0775bd04bae92862023d6c1e95f8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567151, "uuid": "c4cb59cf-4edc-4d4a-ae47-5c06eeb30fe1", "comment": "Malware payload (Efimer)", "value": "f21f5abbf5874367e49b97177b4d0256f6d5ec20", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567151, "uuid": "805ba135-8255-4227-9757-0aee0fa3f89d", "comment": "Malware payload (Efimer)", "value": "97c09227dbb35b0c410da675a1b5ff49fde5eddc13194452b101d7bf13469d048df3550e20d08c01f6723c64e36f7046", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567151, "uuid": "b8ed6ea2-a19c-4c76-9aab-b8cd2d105c92", "value": "T1D9E63318AFE413AEE6E35139EFE20946E665B8744771CA9F17A8C2552D072F0CD3CB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567151, "uuid": "f196b4db-7b38-4ed0-9efc-7b68d86ca226", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567151, "uuid": "caf87eaf-4eb5-45d6-bc32-aae1d0bb3f8c", "value": "393216:ffXPRUmFrJMJa0bKmUxNgVb0XMCHWUjLcuI3/PGTAI:fffXFNM4ZIV0XMb8oH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785567151, "uuid": "946aae1a-f7e6-40ec-a8d4-1b471b9232d8", "value": 14313081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785567151, "uuid": "feeff67c-d356-47b3-8b79-6cc77e90e2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567151, "uuid": "06863566-7eb3-4160-8dfd-4eed8c6a0343", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf19a948-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545323, "uuid": "c87037c4-749b-4c50-a87b-0e875b1d4c9e", "comment": "Malware payload (Mirai)", "value": "7b281cd49bc86224d55a5ac372118c27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545323, "uuid": "fd8d12da-5cd2-488c-b5c4-a0f5ae8d43c3", "comment": "Malware payload (Mirai)", "value": "266fe39ccb648475dc6706898a5c990818f85821c63ceb73e85aed90de29da53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545323, "uuid": "2d2fe1cb-251a-4500-9a41-8e91725c8b40", "comment": "Malware payload (Mirai)", "value": "f061f514a4a6d2a383db96e6d62da922be922e39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545323, "uuid": "d179c58f-7bf3-497b-b2c3-a65fdad49ff1", "comment": "Malware payload (Mirai)", "value": "02f926ada8d0076a954e0b6958d47a71c76b704901810d45ba9dedcfaff15195241f8c764ebdd1e95e5fbe0ea0bb35c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545323, "uuid": "ab79d94b-e075-4044-baa1-5dd26edeb40e", "value": "T1F1E34A1BB5C1C0FDC8D9C2B84BAAE227DE72B4295134B21E27D86E271F5DE205F6D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545323, "uuid": "e123f37d-93f5-4242-9abb-5a686dd01b77", "value": "3072:ZPZ0mPs2gFvTBr1d8Y+seZaU04BzJVMQq7FuTSE7:AuL/0yDTSE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545323, "uuid": "4887d77a-0e48-438a-9b5c-455bdfa0466c", "value": 143944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545323, "uuid": "e7752146-aff0-4b6a-a850-878b045ebf97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545323, "uuid": "a2e36210-58d2-40f9-b447-bbc3574a133a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698f803e-8d57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785554199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554199, "uuid": "1197ce4d-93a1-41ff-ad69-54a344f047f5", "comment": "Malware payload", "value": "53b7d64e827f66ef11fc6f14963e7681", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554199, "uuid": "e7d1fb01-4f94-4047-b859-711d711b4293", "comment": "Malware payload", "value": "2804f625bda3a9b17c21df3bda03807ba0dc74c4c7c3333f59a5c18c7497858b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554199, "uuid": "1156eb79-0026-4c0a-8051-4d67d0b9e0ba", "comment": "Malware payload", "value": "7e6cb6f7263da1a97b8efabe4b46a6642e5eb840", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554199, "uuid": "c62ed963-8bb4-4da4-a92c-f717a04a3591", "comment": "Malware payload", "value": "f57b0f45e522df6f8483ca2292d0e0b33dc07e64e1f0038b038818f4d832aef8b6249050cbe61738f75263eee1a2ecbd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554199, "uuid": "3d78a3b6-f8f0-4693-a5df-3931a59c6dca", "value": "T14AD522CEFDE27234E47AC3B7429375AEB029778442209D5E72C82B106D935287C7B769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554199, "uuid": "b1ed424e-47c4-4be5-a7a8-1be78f91b90e", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554199, "uuid": "554b3d72-bbc1-4ca3-9a97-27f2b79c1dec", "value": "49152:xCmWwcxavhd5l6PAb8dReRThheAj+CMsRboNP1V70GQtAzqFhDTKGBI4I6vma3X:xj2A5oGHhRor70GKJvDTu63X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785554199, "uuid": "6c01f23a-924f-4cc3-b890-2075d93c419c", "value": 3000832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785554199, "uuid": "de0e2a33-b105-4a5b-bd3f-f41cfcc664c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554199, "uuid": "8b098598-3e18-4ce3-9906-09264668e297", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb78379-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620456, "uuid": "e178072d-edff-4e78-b602-1e5d86bddae8", "comment": "Malware payload (Mirai)", "value": "6537c0ad92a5983a5bad92a63b549cec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620456, "uuid": "642b30e1-05a4-4416-966c-0953004ac191", "comment": "Malware payload (Mirai)", "value": "280b7fdd18503441074a64d25326fc93784e91f5dd6cd70dd3f687623a0cdb4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620456, "uuid": "85e3ee18-7f73-4a91-a0d6-c93586d8b94c", "comment": "Malware payload (Mirai)", "value": "39dd99efb98ac55c43d5e81151749aa36b667aaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620456, "uuid": "97ee92c2-9344-4108-af7b-72539c8e7739", "comment": "Malware payload (Mirai)", "value": "798b594e02db6ed2f24b9b195254c4155f2a79beab87976af781c0198ebd8c86f1331cc4229fcc569b9e9372675bec41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620456, "uuid": "df65b0f1-c901-496a-a18b-75a07f45c575", "value": "T164144C46EA414E13C4D7137AB6AF024A333297A4D3DB73069D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620456, "uuid": "f8621e0e-2fd3-427c-b7fd-1336fcc1506b", "value": "6144:by42CstaR/IvevpdNZaibRblc6ssNCttcu23b5M/9//kg:by4PstaRgW/NZaibRblc6s2Ylwu/93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620456, "uuid": "ae68c2ad-b2b6-4025-81dc-835c911a4fb6", "value": 201647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620456, "uuid": "5577f247-0e7b-4962-9920-a62123f52f6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620456, "uuid": "72997cec-3d74-4a08-b9ef-dc7672ecbb30", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f331d8-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620443, "uuid": "2d412222-3b88-45e9-a333-f462c1f4c6be", "comment": "Malware payload (Mirai)", "value": "12a05daf467342ea98e322bd667e7347", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620443, "uuid": "a1bf1c8a-bed0-4c61-9cfd-022a09971db0", "comment": "Malware payload (Mirai)", "value": "2d141e85099fc9934b7a89095533798f6ad09a95af78aa6b278872b5940dc48c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620443, "uuid": "5ba4b1b9-f53d-4218-963c-1d0300104c08", "comment": "Malware payload (Mirai)", "value": "0202fa1de11a9b296f60f581a33a270a9879efc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620443, "uuid": "f15ae79d-5f81-4e2d-9dee-bcb2c50365e0", "comment": "Malware payload (Mirai)", "value": "5c4142f5b8227e0d1f578a8d5cc10b94532bbfdfc8cf91efe2ff9cca1cc9322177ab1ff2cc14459f423506cb96ad9c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620443, "uuid": "1786ecfd-4e1b-426f-b2fe-c188a2517ab6", "value": "T12BE3F709BF610FF7E89FCC3705E91B0528CD556732A93B36B634D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620443, "uuid": "62a03c32-b943-4417-bee3-d549e261f9d4", "value": "3072:PwV6WWosd4Bi3u7KGzJtcMaeeGeVlJSn2qoyJi6ts1uYK3:PwIWWosd4Bi3u7KGzJtcMae10lJi2qbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620443, "uuid": "63b92367-daa5-4d3a-a408-e3bd593a2706", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620443, "uuid": "aa9d3332-57f6-40c7-9c27-1134df41f2fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620443, "uuid": "d2ca1bd0-bc0a-4de7-b4a4-1ca59a08c760", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8abf27-8d7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785570015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570015, "uuid": "f33a4a9d-9979-4e83-8785-7eca55d6b78d", "comment": "Malware payload (Mirai)", "value": "7af83ffb9f128dab09a7cf4717c63f1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570015, "uuid": "448400e2-ca12-452f-ae8d-1326f03a5565", "comment": "Malware payload (Mirai)", "value": "2d92d151af47fb2e7d569a5cbf5d3bac202add4a83807168469f1c2cc6e4cd0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570015, "uuid": "74ca9135-8b58-4400-b506-130276a1c8cc", "comment": "Malware payload (Mirai)", "value": "9f0e08936df7875c7587e3b15b86a91d97939547", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570015, "uuid": "d2e14a92-fed4-415c-b2e3-3718236bd06f", "comment": "Malware payload (Mirai)", "value": "d9d847bc38abd0f3555cd9fb87762d97d4762d3f94a01caca9201efd5ae4c28707d107e0b667c1fadaa7978db8d8bab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570015, "uuid": "467f7826-4af5-4632-b91e-cf5fa533e59e", "value": "T1A3145C16B98080FFC48AD1780BFEF936E931B0AD527CB15627D4EF262E4DD601B2DA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570015, "uuid": "51ba8a16-bff9-406f-8c0b-6c560f8ca1ff", "value": "3072:u8rwskV7wHWvINewzi9QksCG21aikLntZdANTS+u6a7tvtxJGa4xrSuyG/:uEwTV7w2vINCPend61ar2uu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785570015, "uuid": "8d118141-66ca-48b1-8613-a4f596ba5e55", "value": 199272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785570015, "uuid": "2a135e6b-4a53-47f8-846d-0c62b883f318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570015, "uuid": "8cbef5a3-5a31-4c0b-b879-01bfd4e729c8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c90801a-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620427, "uuid": "67eeb07e-3bcd-486b-b3fc-b56c9032d19d", "comment": "Malware payload (Mirai)", "value": "8cafc9c5fff1d0970b1cd7b0515944d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620427, "uuid": "8abe1e6d-f800-4563-95d4-1e28f0820c5b", "comment": "Malware payload (Mirai)", "value": "2ec2d660895fe85797fd0d22df7dbe2c30539fdd74c01584e74e85970b483b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620427, "uuid": "2ee386c5-1991-46b8-b8ec-e5474fdc48fe", "comment": "Malware payload (Mirai)", "value": "f6c8ba088abc645023208ac1e79fc2c43121145b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620427, "uuid": "891b2a93-1b7b-4e45-89a4-018da7751c2d", "comment": "Malware payload (Mirai)", "value": "904f06711832b30aeb64573c4e1aa7afb095b6edd28687f5b835b5dcf6e0da6ad6e277555ea35a22c4bddf4f68b9ead9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620427, "uuid": "5ac41e80-aa1c-400e-a9d1-2c1e218ca877", "value": "T10923E022EA77CFBCD075A6B16C61E3C0F6E5673B83524B5E34E411898A639502D10EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620427, "uuid": "5b87e28d-a419-4ae3-a2e4-fc9539c7071c", "value": "768:4DbdXXjWo86KJKMIw1tV+qi1YR79eZqsFcyo3UTCFSX/Lnd17cgq4hFx05O:4DbdUbR5Vw1up6xLGfFEx1o4jAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620427, "uuid": "ea4e72bf-6fc8-4771-8956-c8775306b32d", "value": 47604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620427, "uuid": "c4d0c66d-7da0-4a63-95ad-2e1df18c1b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620427, "uuid": "250f2747-3226-4271-815d-b9c9adb95bf5", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e941ab86-8d9a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785583190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785583190, "uuid": "3e9d7138-b730-4794-807a-e596138fe13d", "comment": "Malware payload (Mirai)", "value": "5b235ae12c53ca14a038db50e848fe37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785583190, "uuid": "1ca25a1b-48e4-4ad9-823d-8da462ff57b8", "comment": "Malware payload (Mirai)", "value": "2ff5f00dab4e7ec22c34adccfb2b817e393ec50dfd82846c160ab5bc271ca497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785583190, "uuid": "bf5d6e7f-efc0-424d-9a51-028fdaaa84ef", "comment": "Malware payload (Mirai)", "value": "bd2da741d51a8ec052cdde5d1916c062373eceb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785583190, "uuid": "ed6e4fdf-51ac-4d8a-b052-6352acbbc854", "comment": "Malware payload (Mirai)", "value": "327e9b576d1b8623ec2374958c95b031008afa90001efc1ecc6f59621c6dbe92857ff181dd74a1afbd14f54b03894189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785583190, "uuid": "e0af6380-d937-49e2-af9f-465d4e657920", "value": "T1C3143A56F8819F15D1C212BAFA2D524A37271778E3DF72029D109F74BB8B86B0F3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785583190, "uuid": "403c131a-b1e5-4770-9f25-fb2c7d4d5153", "value": "3072:p5IewGXhnvPJNddSv+JRUK3aM2f9Ca8y63P4r6Huhw7GOH/:rIewQhvhNd8v+JRxd2fAaH63Uhw7Ga/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785583190, "uuid": "458497de-e6fb-4a96-8f24-4b2ce6f52828", "value": 200732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785583190, "uuid": "23eeb873-38a9-40cb-99ff-80c170b6a5a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785583190, "uuid": "3db818f9-a01d-4338-a775-70b5fff8c215", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a9190c-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620414, "uuid": "c82ecf75-7626-43de-84c6-75ea35cfd94c", "comment": "Malware payload (Mirai)", "value": "1a2d0af10259dd2345e6d07c8f2c881e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620414, "uuid": "350098c1-263a-4607-9b8f-c3546ccf2c23", "comment": "Malware payload (Mirai)", "value": "30f45db7e5b98dd497b81f5cc7b86cb252c8113466e6ad7a5dbc436e8d65e4b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620414, "uuid": "f37e254f-0c4b-4f31-b1b3-a8c779d92ad4", "comment": "Malware payload (Mirai)", "value": "dcfe76067bf3bce05d00ecd8d251077e5c01fdad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620414, "uuid": "965232b6-bf4a-404e-a461-160924cc7405", "comment": "Malware payload (Mirai)", "value": "d2c7b22152c114879e157280ea95bde5120500ee68b4777e9c9f274e6ee0148da7a9cc583e9816cab7d53e6f52327f43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620414, "uuid": "4183290b-9542-4238-847f-1967272043c7", "value": "T16113F135C2D71D60F5FD66777DD2F34823B38C2617A9A493688EBF929643022A647EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620414, "uuid": "0ab4b85f-4a0b-4eb1-bd2d-4a0a38555d39", "value": "768:c6thCQNxcHigUFhLeRdW0Cu6ZhkCG/COuoxSpEglF0RhuA844uVcqgw09kN:xtMQNyF7W036ECG/LuoxSpEyQz4u+qg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620414, "uuid": "5a518392-cc73-4113-8aa2-5896875152d2", "value": 45244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620414, "uuid": "fe9e877b-3ee7-458c-b75e-d6298750ccbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620414, "uuid": "ce315c94-d76e-49ad-8751-0a7116d292db", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096721de-8deb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785617603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617603, "uuid": "c29ed856-c5b6-49f8-a731-728de637a4b8", "comment": "Malware payload", "value": "604f327e838ea5ae7b3d191e7a7ee3e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617603, "uuid": "e2557c63-5fe8-4878-97c7-fbf2f4583432", "comment": "Malware payload", "value": "3158f74f48ba552cf2aaba4295dc63a0e03836e8540c370b53a442694f0cb84a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617603, "uuid": "eb554323-86d1-4d8a-a613-4a5eb93699ff", "comment": "Malware payload", "value": "e4649c1b8b28c028cd099b1067a8877326aa6baf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617603, "uuid": "78092a57-73b8-40f5-a548-847fa543a263", "comment": "Malware payload", "value": "23c76c16771c241940a625d673d9554769993976b0f52a95a6c171ff8c942b622ec1a7a3538c7aebe71ec0c863f9fd78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617603, "uuid": "2ceb4fbe-9900-465c-9049-ffe60048c278", "value": "T16C235C5516857C24AA98C8361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617603, "uuid": "16c114f2-3608-4dc9-887c-e88b72dfad1e", "value": "768:vl+j9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:t+kcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785617603, "uuid": "8287fc64-fe3c-4140-99ab-c44e0653ff42", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785617603, "uuid": "531b04e9-b77c-4ba4-8a15-1f379b6cf0c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617603, "uuid": "cd956766-87ce-4b75-a3c2-8d7e1e13a67c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a421664-8d45-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546389, "uuid": "003cf0e4-e2c3-43c9-8562-598a8f87517f", "comment": "Malware payload (Mirai)", "value": "1cebe7426b151711990ff0f49d3f1206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546389, "uuid": "5195a8d4-3a35-4a27-857f-61b6f081f197", "comment": "Malware payload (Mirai)", "value": "318391f558f280af8e93bec63a3c85100fdf2a12343f6ac8b8ae9178f68a64ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546389, "uuid": "075f18ab-4c25-4e8f-b515-f51127e3fbbc", "comment": "Malware payload (Mirai)", "value": "9ecb3474c1096b107272fd3ec9a03b3544d03912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546389, "uuid": "4971318e-941f-4b9a-8037-5e24d195adef", "comment": "Malware payload (Mirai)", "value": "307a2cd7c23aac7c467d62ee9fdf9102717286431bf3b51e3335b2cef4a0fd2e37d415e67ee9ea6d1bb06967f8ca863c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546389, "uuid": "dc8eac42-4b9c-4955-9096-078ffd83d1e9", "value": "T1BD934922FD79193BC4C4A57722E34335F2F6478A24A88A1F7D610E8DBF2564022A77F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546389, "uuid": "e6d9b4f1-0e89-424c-bb3b-06e370b76003", "value": "1536:nh6LzKznyY0IXsJEkrD+n+x9p/uFlyOuut1Wo95rIp//+AtSOtWK:h6Szn+Y/WoPr8Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546389, "uuid": "72992802-579f-42d6-902c-93c2c23df0b9", "value": 97440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546389, "uuid": "53964c16-5f21-4938-a08e-3991b29ee59e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546389, "uuid": "2db0f38c-5959-4ce2-a114-35995c899258", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798f5c73-8de4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614785, "uuid": "267a7e12-d6cf-4e7e-af8c-b96cbcf6b646", "comment": "Malware payload (Mirai)", "value": "66dd0cc12baafb2cebc879de28f0b864", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614785, "uuid": "af0cc9b4-bcee-4b28-aeaf-af4ff24c2583", "comment": "Malware payload (Mirai)", "value": "33cc89f9b48508e891ba55037e290d802c428c610e7bcd326e8dfa21715d1e86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614785, "uuid": "4b89e7b1-6f24-4557-b19a-846e12b31de0", "comment": "Malware payload (Mirai)", "value": "98e7aaa0de1db4bdfd18a9fabccb205fcdc0c1d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614785, "uuid": "00078368-4cd5-4f59-a287-e60f5bf716ef", "comment": "Malware payload (Mirai)", "value": "a00131b6894b80a4a5e23bd46df69e25be75672b5bfb2c99b66d930b98d5d7cfd3ccbdba44e1af152bde3600c408bf0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614785, "uuid": "99cb6790-a9e7-4d4f-aea0-c0c931695773", "value": "T173933AD7F401CD7DF84AEBBB44530A06B631F3A219831F36636BB957BD351A45822E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614785, "uuid": "73d58bb5-53f0-42ab-ac8e-6ddf086521a3", "value": "1536:lq+/aZUx5d53xFuuejfwbtX+++8x+hhmGsWPYSGUOIfrDrErZrI6dOe1W+x/tpqP:lJv53v7ezitX++8hLYLUHjPq1HdOe/le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614785, "uuid": "c320a6fa-d38d-41f6-a412-5b320fa0e9ac", "value": 92028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614785, "uuid": "044d4e12-5eba-4e0a-a7ba-957390823949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614785, "uuid": "115afc51-b482-4523-840e-cfbcb1821d6d", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50af8f4f-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566613, "uuid": "1c1486db-11f1-4ae9-9240-75913f9ecd1f", "comment": "Malware payload (Mirai)", "value": "149f1405776aec07ddb74713c9f6888c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566613, "uuid": "1a513b70-844b-47cd-90c2-969d47392921", "comment": "Malware payload (Mirai)", "value": "33dbf30ad762a5cef726d71e95608e366424d46f07b828356b1e440e93f8747d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566613, "uuid": "4dfb3712-d907-45a0-a56f-27474b9a2306", "comment": "Malware payload (Mirai)", "value": "9db59cde176a7fd839880bdab35f4efbf4aa6d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566613, "uuid": "70cc077e-243e-46ad-97c4-3f7e55584b6d", "comment": "Malware payload (Mirai)", "value": "6cb41a569feae98e6eac7b32bbb84c8ed544cc9e8cbb5a28adc82384eb0f8a5a0cb0ad87d13bb6434bb41d1cfec0bece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566613, "uuid": "50b21536-8e57-4daf-a156-ebbcbf316f54", "value": "T1C2F32C86BC818B02C6E261F7FB1E428D372647ECD3E6B1139C196B29375B8570E37652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566613, "uuid": "4a80b2e5-6682-42fd-b626-088b198cf76b", "value": "3072:YKr2AxD7T+ALfNIsSoA4y+Oo08NX2j8QBfZp:Y7YD7pLVPlA4yNo9gQQBfZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566613, "uuid": "28886490-6c98-45ee-82df-62b4d0762e96", "value": 160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566613, "uuid": "a4deee3f-f453-491b-9ec9-4b2d8523ad40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566613, "uuid": "240b84d3-ad71-4443-9ae7-58755ef4ad72", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c07b18e-8dcc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785604535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785604535, "uuid": "29ebea71-0f16-4209-89ea-189fe0964d3b", "comment": "Malware payload (Mirai)", "value": "6487d35c1a83d4062d2e7796d00b190e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785604535, "uuid": "61ab8b0c-1234-475e-aee6-fc604c9cb96f", "comment": "Malware payload (Mirai)", "value": "36b289daf23e2fc9055c9ee724e672b700618f08ab408453ebe201480bdd5a34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785604535, "uuid": "fbeb7ac3-f11b-4832-9def-af09e1ca929e", "comment": "Malware payload (Mirai)", "value": "4921872b612ee2a4ca1e67c65021eefd0502c886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785604535, "uuid": "ced8b83d-6647-4696-b3d2-d6aacb5a970e", "comment": "Malware payload (Mirai)", "value": "724f181bff0988b49ee5e23c7243c9b6ba5e498d1305ebd378f46183a9ed98dfc2645537565f326ae0ff429ea2223604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785604535, "uuid": "66a7924e-2327-4729-a59a-e6d3171d506e", "value": "T104631A81A8D1EE52C6D96A76FA1E059E332253BCD3DF3303CD144A1527CE4995A3AB0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785604535, "uuid": "215a30b0-f2c0-49f0-aeb6-338832304695", "value": "1536:RwCFj8VbUFvb15xT7/OHmv8YQi9pefxy0QgDX:GEeg557/OHm0iLef4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785604535, "uuid": "9b552844-e16b-45dc-ade8-971ae16ced9c", "value": 67056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785604535, "uuid": "4883de01-36f4-4f1f-8392-543fb5018e12", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785604535, "uuid": "b1daf98f-15a8-4be0-be1d-64e51a58ba1d", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2fbfb0-8d6a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785562582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785562582, "uuid": "b8261105-5e13-4126-8a76-67d76bb57c15", "comment": "Malware payload", "value": "70fa517fa410fd44a9b755695d31587b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785562582, "uuid": "04dee695-b4c9-4315-9b0a-3971c00674aa", "comment": "Malware payload", "value": "36c6737221428d0bc4a535dd86d3c0190471882c01a1db264a769f2499177d24", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785562582, "uuid": "81830d78-a40f-4d9c-a28b-5bdf0ca39f52", "comment": "Malware payload", "value": "19015ff4910b6e7435f80b1f621fdfd95e4bb9ae", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785562582, "uuid": "7803f6d4-9ce5-4e3d-b9b9-3d7d25c28eb9", "comment": "Malware payload", "value": "ddad400b0b959aa1b51ac7da81524c9ee40896b066113b4d7c4d5eeeca1b63bc01799f15b46a4871c9176acc9faf5daf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785562582, "uuid": "061a9e58-3597-4b9e-aef1-f47077703447", "value": "T144D213F1F8ECA831369D453A779DA805A9DF7C2F0DA77D2014275A38421CB1EA119B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785562582, "uuid": "02950cf2-0603-4d05-8c18-fcad1be39ab1", "value": "384:6V4QiRUud3s153iDu7isrGcA4UADAZdhQuW5a:iiRUQs53iDlYUAkz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785562582, "uuid": "8b2f069c-eb4a-4eb6-8aeb-3e869f41e4f0", "value": 30815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785562582, "uuid": "c0bdf052-c093-4ebe-ba6f-54eb8ab70bf6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785562582, "uuid": "c4797bb9-a8d3-46a5-be73-c575a7f73f55", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe2b028-8d57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785554183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554183, "uuid": "67735f0a-9941-4a7c-b2c2-ff29d55aaa97", "comment": "Malware payload", "value": "3859c0331e6ee54c764d467c3557ce4a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554183, "uuid": "9419a557-a9ce-4dad-a353-d218c47eeb7a", "comment": "Malware payload", "value": "392a891929839c17887143fe1125f845763335821a61b83cf6a2a291d79b1885", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554183, "uuid": "73fab3e9-653f-4220-aaeb-3cea5d547fc2", "comment": "Malware payload", "value": "44a6f251a273f9f74f500183c235d06c52074dc5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554183, "uuid": "a18a30c6-25c8-474e-b44b-77dec7b22b29", "comment": "Malware payload", "value": "4898681a43e838c12b7c61746f4e693e479162df81cc14bfb24a75301fd9dca458edb312c30b524af7cb1a024552427d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554183, "uuid": "9a8c49c2-6842-479e-a576-b12dc90807e9", "value": "T1E5D52399B8B72AB4C47BC7B58F82E06D711C7B918B708D577ACC2D006D23958AC393B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554183, "uuid": "5b611347-bdc0-48ad-aeab-e11495d1de7c", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554183, "uuid": "b39b3ffb-8c69-443a-a431-345af72b6577", "value": "49152:73iOI/MWj+da1MDudnrWp4XmX0CjFlIP7PoE18a6teGeElCjPLO6rAvb:+OI/CdbudyX0WlZ4fzjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785554183, "uuid": "061d2bf6-0877-4b22-82ea-4640c650f80e", "value": 2966528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785554183, "uuid": "c1c33272-f1d0-483f-97e5-2260b057d52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554183, "uuid": "e44b789c-f866-43d3-9132-ff56d0dd1c1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fd7188-8dea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785617188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617188, "uuid": "d797661c-ce10-4516-9bf3-8dd9106a23b3", "comment": "Malware payload", "value": "ca05a058a7034540f9293484497055d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617188, "uuid": "1abe66df-42f2-440f-90d3-33e479ff29af", "comment": "Malware payload", "value": "396f7b1f5922dc332aad6107b4d5ab9e1ce71481a5d5b202ebc560099d8395c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617188, "uuid": "bf853f76-6873-49ac-b1de-2e0ec2169bc9", "comment": "Malware payload", "value": "23bcec2281982bbbefd38e234cf685dca9e24d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617188, "uuid": "98586e66-ae86-485d-b95a-88435c93cc1e", "comment": "Malware payload", "value": "2533e47c55f2838029f2b141971c77407ed9c3e60bb1c52daf16a393820ea3f3dfeb73705b91743e907143903be9b60d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617188, "uuid": "d5e51125-2f0c-464e-8df4-03af489b96d3", "value": "T1DA873351F1F804EDE5B625799176C38BEA01B09F87B283EB515002438F1BFD19A7AE78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617188, "uuid": "00fefd6b-4dcc-4868-b559-406c213df7ab", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617188, "uuid": "e2c5a2ee-1eb3-4725-8e7d-f990e3a73bef", "value": "786432:i+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLe1S1QtI1uAD+E3:YXGMK4XR3bLSCU/+6yPl8OiI1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785617188, "uuid": "45d8e341-d0a3-4567-bb0a-ac5c27f56745", "value": 37704700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785617188, "uuid": "11f71dec-d182-4a62-8b83-15044c46c741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617188, "uuid": "4548567e-1763-4edc-b1c7-ecefeafc3384", "value": "ObxodDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a2d983-8db0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785592599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592599, "uuid": "927cdca7-78be-486a-b101-f1d948a13af6", "comment": "Malware payload", "value": "c14c9fdac55cb1d624069eda206a4084", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592599, "uuid": "011872dd-db0b-43d1-a781-bd6dc6adac61", "comment": "Malware payload", "value": "3a6260c59e6a12e203d5063fac948b0026a0559680ade55cdde4742a4b11d8ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592599, "uuid": "4c709a33-d562-46ce-8a7b-4c8657b59a4b", "comment": "Malware payload", "value": "afddab6599f1b4516d4efe4ddd21f5ccd6fd160e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592599, "uuid": "c63b92a4-02e8-46eb-a852-4ddee9a75c5d", "comment": "Malware payload", "value": "a96c40f105818bff696385268a0129bd1ff06ab134590f7c513704fc5d9dd9424884abb722ada7f22b74366b1bc907dc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785592599, "uuid": "1a2aba35-3601-40b8-aae9-7a1d27109b31", "value": "T1C4236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785592599, "uuid": "a56d54af-3e38-49d9-a983-2439d01ac90f", "value": "768:8XRWNGxVv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:wlxqcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785592599, "uuid": "61f02463-6759-420f-8bd1-4efe9d2c1fa8", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785592599, "uuid": "452e42ee-3a7d-46a1-8cb2-430d17a31b40", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785592599, "uuid": "162743a7-f5bf-4273-a8d3-4b04818c6348", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c7c8bb-8da6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785587992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587992, "uuid": "11447006-a640-4f79-9b9a-f14e9e5054d7", "comment": "Malware payload", "value": "1b8fdad65f4d30411e7b4a33793ff535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587992, "uuid": "2a862ab9-cad8-46d8-8925-ac494be0afd8", "comment": "Malware payload", "value": "3bc2cb381934db49f3c396a46f35d2a404a65f4ffd7fc145df28276ec7303fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587992, "uuid": "6c482bbe-e199-4951-a86b-2814016f9725", "comment": "Malware payload", "value": "f91a8b1496b4ff7581af64e1a8c4de4804d567ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587992, "uuid": "60a1e826-0192-4afc-bb79-4fb00105ac4f", "comment": "Malware payload", "value": "144eaa88c3a56329b3c4efc81d6b7a221142903b85cf52c3690f755afceb301c80488df05856f4e90ceb1d7878928a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587992, "uuid": "077778e2-da38-4c21-81c3-f1375848c2bb", "value": "T16BE2F869FA584639CF1A8B3655679A40533C5919AC2FCB1439BF4C2EE8C63E703817C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587992, "uuid": "d5199653-726c-4cfa-9cc3-0ef6e191c1d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587992, "uuid": "420f0420-b07d-4afe-927c-ca6c571f72cf", "value": "384:oGnpRmo9h00KlteCIdI4lrHFoCwzINwAhqaHO7d+Go4drNjOAdkCMua2ubOLXE:rpRlL86snkuAhLO5ZrNjOMMuhuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785587992, "uuid": "23405918-0c9f-4f6e-abd6-8e7aeea3dab3", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785587992, "uuid": "5b6628e3-306c-4052-bab0-fa73df4b9703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587992, "uuid": "2337daf9-d876-4252-aef6-3db2effd9639", "value": "Rexil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05794b3-8d73-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566317, "uuid": "bc3447c2-8ffb-4785-96c2-566715e52748", "comment": "Malware payload (Mirai)", "value": "8121d8e9578b826763213bc5eb1763ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566317, "uuid": "15e1725f-a951-4bb1-ba0f-f4369737ee7f", "comment": "Malware payload (Mirai)", "value": "3c1927e48133f2fc8d432612b210de8488bdbc4bf9eb50fb165215f25f29f652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566317, "uuid": "25e82549-373d-47c6-830d-1d6c3c4bcf95", "comment": "Malware payload (Mirai)", "value": "c0aa6062397105581c9252e0dabeb254422705fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566317, "uuid": "990482a4-72d0-4eaa-b605-d793af74154a", "comment": "Malware payload (Mirai)", "value": "1f44637f7a0c51def89f6bae0962c82013efeef7d58eab4378880b0663d3bd543229af223081b8f3f036c3a056bd086a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566317, "uuid": "7b542268-ef17-4c8a-9a7a-754875c902cd", "value": "T1894301B0AB61BE7AED710E33ADD58745BFDB16BC856D20B114A9C12C57C3F0694B8C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566317, "uuid": "8b61184d-2303-44ce-939e-567c16255756", "value": "768:nNqYJGEnwRWEtzQapSMl8j0DhNCsUSgKh/jm1IGUnBUyGqVjmQT4OT2Ug3juwXSJ:nNqdoQzQapfRhETURwiUAVjm1O5Qm8LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566317, "uuid": "d9540aba-a6e6-42b3-9282-265157498a5d", "value": 59316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566317, "uuid": "b4ff3340-f3ef-4b8a-9cf7-a39a1c640858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566317, "uuid": "7f3c5c59-071c-42a2-b13a-29b2bf60adf7", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286409a1-8d43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545500, "uuid": "8393e086-ea51-4f6a-8093-07b7b4379c7b", "comment": "Malware payload (Mirai)", "value": "fe4f6b7bd2f874a430d041f35bf8c1e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545500, "uuid": "d4cc6daa-ea0b-46bd-b9a6-d399892ad30a", "comment": "Malware payload (Mirai)", "value": "3eb3fb3db28bc4963bf09b9c95da22d3955d642c18c2080bed9d93db7972dad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545500, "uuid": "61bae886-3ee5-413c-aab4-0634742dda87", "comment": "Malware payload (Mirai)", "value": "2cdb7d465bb009e967835c7637463a138c2a3301", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545500, "uuid": "2cb52d9e-3f1e-4c70-b7f7-f0349d4ed936", "comment": "Malware payload (Mirai)", "value": "6b14a7723c9126720f9c2f3255e65d59eab326a45192f99d812c34fc9691ef937c7e68fba71bbb5c91f5342b9589592c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545500, "uuid": "c5d2cfc1-af06-407c-b2d5-c057db402633", "value": "T14183AD33C93A0E68E84845B4B0B18FB65763E51580972EF7495AC67AD083EDCF58A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545500, "uuid": "9290540b-69fa-4f0c-b674-cd1b5f59c460", "value": "1536:Ngynxf8zTGhxM4agiRkKpP7WNhC+RCaVmnjHy7:Nxnx3hUTRLpCXC+RD6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545500, "uuid": "3234a205-0f75-4666-a0bb-f7931f3fc922", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545500, "uuid": "35b1de99-cfe1-43c9-bf10-e9a512c9e0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545500, "uuid": "88716c28-4618-473c-a4f5-8fe61ef9131c", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1025ec54-8d66-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1785560492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560492, "uuid": "009fa243-6fbe-4c04-a2d5-e6009113dc7c", "comment": "Malware payload (Amadey)", "value": "82617293c095f7170bea3d3384f8da2b", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560492, "uuid": "28d04f2c-15a2-4674-aa70-6c4560fc155b", "comment": "Malware payload (Amadey)", "value": "3fed685e1b41d37f28a2fbd69ee3755ab4797b5d9b60ca6d904b2c9529af12f8", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560492, "uuid": "880f21c0-5746-43de-a5cc-2387f44e64c4", "comment": "Malware payload (Amadey)", "value": "dc665280d55c2a5393282a7c207a9adfa65d0472", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560492, "uuid": "fbbe64f1-2ae0-49c6-8e24-edd9e56b19c0", "comment": "Malware payload (Amadey)", "value": "f009b1be685d2d5413346b90d13701747b393f4101bd7cc6833095c44d4b76a01183fc3e026c9e95f14d97473410e87b", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560492, "uuid": "79ec4ce1-a8d8-4f1d-a0bd-7ac9d1a712f1", "value": "T1E7641292A95D2384DDF4C3BA125996C6FE0E71AC31CFE71E81FE8F893328924DA11158", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560492, "uuid": "0b062491-b656-4620-9dc8-ab24742c1b78", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560492, "uuid": "666ef053-ac17-462b-90e5-570ec3db4193", "value": "6144:fP6xAenPCj853eYH4of9MWJRHlSlAy7kKLoLUoy6nr6KNQ:fP6x/nTOY1uWXHohsooy6nrZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560492, "uuid": "48360241-062e-44dd-a288-015badf1a951", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560492, "uuid": "756d7292-b10b-4cf9-b103-110f18a4d91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560492, "uuid": "7ae751c0-3c65-4828-8be6-b90032839a6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d739567c-8db1-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1785593038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593038, "uuid": "cd4eece5-a2a5-4453-b2d1-e6fbe21642a2", "comment": "Malware payload (GuLoader)", "value": "b2325402115a614f754dff02aaf3bd5c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593038, "uuid": "f75ee2de-36bf-4176-a1aa-34c5469eea63", "comment": "Malware payload (GuLoader)", "value": "3fefc18c14c88fa1eacf10d9628f91634026620239e944ffb433b3e65626996e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593038, "uuid": "887a0243-4b04-4678-8e37-5eea92181dc9", "comment": "Malware payload (GuLoader)", "value": "29bd1a02c628a407c0c4440583f784e01df476df", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593038, "uuid": "4c6b9d0c-56d2-4971-9cfe-d41cdc237427", "comment": "Malware payload (GuLoader)", "value": "4cd139b5ae78e7b3c26dcee64e3c1dd69b06fad8f35431ce7f5f52b8d3144bd5668027c9a27ff79cff57954137a7d80e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593038, "uuid": "c21fd61c-d0af-4194-a72a-054c123f0cc9", "value": "T1F3441720D9E40B3A0E5307EDBE515A55C4FDC6294622D0FCEADE071E60139ACDBBF269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593038, "uuid": "33d58cd1-90ee-4d04-8496-0392ffdff608", "value": "6144:eljSVVaUbAJW9CC6lvpVY0yWzZSn9/1GFZAArCZ:eieKC5pfktAZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785593038, "uuid": "cb8715a6-f320-4a16-88ab-73e4cd9d3152", "value": 276572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785593038, "uuid": "17bfaadd-4c01-431c-8f03-b49e454d37f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593038, "uuid": "24f008a3-e542-43a2-9133-12b59ce66ad6", "value": "RFQ_83760_56984.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b72e9bb-8dcb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785603917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785603917, "uuid": "f6b37de9-c312-44d9-be9e-668f0eda8d84", "comment": "Malware payload (Mirai)", "value": "dba134c40fb44800211b2eaf27611da0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785603917, "uuid": "01540419-7bae-4f9b-92b9-281af084f68a", "comment": "Malware payload (Mirai)", "value": "405ab54e2f2b5f8e2b865ec75e0547ee4aea3a6521402958c18a40b7e8ade432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785603917, "uuid": "563b2526-85a2-4482-9e6c-4e232bcce8c1", "comment": "Malware payload (Mirai)", "value": "c5d714962334518c92e4ddd4bebfb31f217e5372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785603917, "uuid": "90f9fc4c-2949-4724-900c-c0b39d17a6d3", "comment": "Malware payload (Mirai)", "value": "6610075c6c37649bd5a72c8b07061df69e5133984ef940ef5a1eee61081de1b48a2e18b99bffa57e6bcf81878c8ca883", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785603917, "uuid": "12903ebb-1a06-43d2-b777-7ecb776f3755", "value": "T107C44A55F880AF61C6C539B6F64D42AC73074BB9D3EB72069A144B343BDB86B0B3A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785603917, "uuid": "fda0bf48-bacd-4a80-a488-12961661caed", "value": "12288:+WFtt/OIgS0XDjqo58WeiF3Zfly8pLb/B:F3t/OTjqdg5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785603917, "uuid": "c9b166f1-51c3-43f1-a32a-1ae029100f4b", "value": 559368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785603917, "uuid": "e8a6f5f0-9174-44bc-a1a6-28080de50b53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785603917, "uuid": "4f3b7ae2-b1fe-4e15-8c40-9911f4eff668", "value": "xd.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ace7cf-8d46-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546925, "uuid": "a6022581-6dc0-4ae7-8c43-e52edd5824e4", "comment": "Malware payload (Mirai)", "value": "569072236d990b9dedbaaee0693acc86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546925, "uuid": "07cf3b32-06f2-4772-95b0-ee9fb6244a5f", "comment": "Malware payload (Mirai)", "value": "406a984d952108f1d06e42046a354b4c279ea58b691a211209501cd073c180e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546925, "uuid": "47a3e58a-c1c7-40f7-8e43-d219cde8c6aa", "comment": "Malware payload (Mirai)", "value": "87dfc02c2f3363d6dce2fcd41c8ec587af82aa08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546925, "uuid": "ec0d4a26-e7e5-4ded-bbfa-252e69a880ac", "comment": "Malware payload (Mirai)", "value": "7987f49f9c7768d432e9c0f5afdc276133066c575665802d229a774fc82969777f074c56e06b531a20224a1bb430b861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546925, "uuid": "7ac40be8-ec5e-4571-a204-e3c959e2ea7c", "value": "T1D8F319C7F900EAB6F809E3374853090AB130B7A244925A777257357FEC3E199157BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546925, "uuid": "7c50eb4e-266b-4fe3-810e-b9f94bfe9ee7", "value": "3072:aTrLgNLHffqiA8bySwH/JKC/fSUDdt01+ELrlVKjbiHLTrMnQej:mrsJCQbySm/Jt/f9DmBLr3LTwQej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546925, "uuid": "81364d51-d3fe-40a5-9918-20bfca27022f", "value": 165848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546925, "uuid": "21393aea-ebed-41b7-a652-e98cf1d13e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546925, "uuid": "732f105f-d975-4632-9c8d-0f4cd917e3c0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632f94b9-8dbe-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785598427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598427, "uuid": "dca57f55-0b59-42d6-9122-1802da389733", "comment": "Malware payload (Phorpiex)", "value": "b084c127f03f2d2b96dae95d2495ea8e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598427, "uuid": "a5885748-30f1-421b-924e-8fb9cc0132b3", "comment": "Malware payload (Phorpiex)", "value": "40a1831b2c77c3026e01b6eb0e9846dd3c909ced0f55cb396165d23d9e5926c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598427, "uuid": "3185a975-d24e-4144-8e31-8eecc1f95ad4", "comment": "Malware payload (Phorpiex)", "value": "a0816745f3159d06733ed351425ef25ba8ae2eb9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598427, "uuid": "a48da597-7a42-4c02-a936-4e02b1da99fe", "comment": "Malware payload (Phorpiex)", "value": "40a6db338f68628aab6a886cc386ce85f55010ebb42709f0dd239cbba3b71153d5d78fc39de0f0b20ab3c2ea598acd26", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598427, "uuid": "eb9b2cf8-ff19-4108-968d-359671cff5e3", "value": "T100824B0FB9424326D0E11070A276567BDA79A8B6378414DBF7E48AED0A6C6D1FC3216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598427, "uuid": "ebed4505-8c84-4382-a635-aa62cfb5fd28", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598427, "uuid": "f6f0cf72-b0e5-4c44-ad7d-d1af1638d888", "value": "384:CU6I8vVaF6OeYUQQlmLu94gXmc4lmxav8U9cpl:CUPvUQQt9k8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785598427, "uuid": "98fb4192-8dce-41c3-b6e6-d96faf48ff04", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785598427, "uuid": "0f2d03ea-8feb-4b7c-aed1-d8f8ea1e0799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598427, "uuid": "d3fe2449-29f8-44e4-a12a-3d8256da3c65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e7d9d9-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614115, "uuid": "36800f33-32ff-4384-bcb1-7e15da0b701e", "comment": "Malware payload (Mirai)", "value": "3b4bb4db740c1742639417b2eb5713a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614115, "uuid": "53203d75-c038-4e21-8152-70bad33d2b02", "comment": "Malware payload (Mirai)", "value": "40acd47d0acd2b1ef4d0ff434160c7da6232009deece35ea4b5bded0dd58aece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614115, "uuid": "9214c0de-99f4-4f65-8e22-c1fbbf18e551", "comment": "Malware payload (Mirai)", "value": "e3b70b7777a1ff3c17b20f9d34aee424543e406c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614115, "uuid": "715c168e-6c1d-4ae9-8440-fe8b3fa5f7f2", "comment": "Malware payload (Mirai)", "value": "dd6a82f4183fa026ffae0c83fb96227f4fab87080027a275153db6c9adc7d343127159f523f2f1a7605f4ea7fee06d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614115, "uuid": "d57c7524-e935-4e03-8141-ce62f654cf22", "value": "T12A03F1A1DEC26542FAF70A34309EF5E68299DC2D114091FAC66BD5DF8C5FB262A4C1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614115, "uuid": "ff47c35e-57a9-453d-847d-3e99e8345784", "value": "768:Mu//8y/9M5xmPrfeMCwM8IrqNC/tuaOc47htwzPj1fonbcuyD7UHQRj9/:MugxyT/+gC/p0hIr1Qnouy8Hy5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614115, "uuid": "4b2d13a2-3c27-4bbb-b603-e8cb3e3e394b", "value": 40556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614115, "uuid": "f5db6dff-c01e-43e7-a7e3-b976b7ee932b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614115, "uuid": "2b096942-6405-4919-a272-8f09902866a2", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1462d00c-8dbc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785597436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785597436, "uuid": "4062cc5d-6a1c-4039-887c-c6352861016f", "comment": "Malware payload", "value": "2427f8a083b23d7147bc15e4c2253816", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785597436, "uuid": "81d055e9-10ae-4489-8d2a-f9e3ea42a52f", "comment": "Malware payload", "value": "418c564fa3d768c01a5c392bfc9182e1506af3d99f6fe178402dec05ee97b2f2", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785597436, "uuid": "7331927a-db6d-49dc-9068-9c5ac79f35f0", "comment": "Malware payload", "value": "489884dac2ff4e6b3f011c7d404e46bc10bd9ee1", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785597436, "uuid": "63c29b74-abb8-4f28-93f1-0295a65e144a", "comment": "Malware payload", "value": "ae2c712b74f50015dcefcf2a1dc73c772040d88270b267d92159ed53aaaaf24c1340b943db0a663459766817c2dc19f8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785597436, "uuid": "4379d20d-483f-495e-8a83-ec6ea6f7f661", "value": "T162253A5AF36344FDC97AC170476B9372BA71F8251234AA3E1F85CB311F21E605A6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785597436, "uuid": "0f614182-5513-43fb-abe1-bdc45654d174", "value": "54bc0e132823d707ad4837a51b352db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785597436, "uuid": "cf1122ec-f775-4b1a-8aa4-f9f37e3e3cfc", "value": "12288:MPTEs31a8/S0ShxgNob3swQRcfIBa1Ohf5Ymwz2OmK:zHx0S4NoowFQBa1Ow2Om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785597436, "uuid": "fe5bd079-a2d3-407d-9d79-62f6536c9e2e", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785597436, "uuid": "b434e849-38d0-468f-b62d-347823d1cdd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785597436, "uuid": "0738ffd1-af77-4014-8531-83b172353e7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8dcbeb-8d4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785549691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549691, "uuid": "941be48b-864b-4350-9bbc-7be450fe1aa9", "comment": "Malware payload (Mirai)", "value": "549facb387e166f1bfecfd17adf33d54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549691, "uuid": "77ee9c8d-c3bd-41a5-ad0d-1b3e58a52dc8", "comment": "Malware payload (Mirai)", "value": "436f164de1640f910005be2aa5e9c0343abeca108d789273e7aa9703cd653b49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549691, "uuid": "1a9e1091-5f64-4642-bad3-29e4eaeda484", "comment": "Malware payload (Mirai)", "value": "b7f363ea1742be604a269658c49fc17909c9bc46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549691, "uuid": "97eed1f0-e35b-4494-996a-a71b199594fc", "comment": "Malware payload (Mirai)", "value": "d0709469dc6b5ecd66ec9debdff0b7440bfd269401ef8aeeb1a29452b63d5b5883f8df7a2db3133eff05b7f93ab6c3db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549691, "uuid": "a6eeca1f-80aa-4f15-9c2d-48bcf289f8fa", "value": "T1ACE31956F8819B11D5C151BEFF0E128E73131B7CE2DE72129D24AB707B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549691, "uuid": "0262c88c-5721-4ae1-8b3e-010a3bdcf4cd", "value": "3072:1QsfiGl6QbwSbhttz4jaC+tHweKNk66CO5jTPXEvUK9Q:1QaiZkwCttzaavtQxq66CO53XEv3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549691, "uuid": "a39c0829-dcac-4441-ac8c-c79d979c28c2", "value": 150132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549691, "uuid": "06e2e9e1-f448-4471-a685-cf1ca95a7107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549691, "uuid": "5be78ce5-b6c7-43d6-b500-1d5dff46bbe2", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900f8b44-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545244, "uuid": "8543d665-51ca-4960-9a96-2235dfb503a5", "comment": "Malware payload (Mirai)", "value": "ed46e4edf9b900e9234fcdda97f2754d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545244, "uuid": "9017306d-d3d0-4441-ac78-5972115294f1", "comment": "Malware payload (Mirai)", "value": "44cf9c9f306e313493ccba99e676ae31832aa566b237860434815ced14f4cf54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545244, "uuid": "d6a8268f-262c-499e-aa2b-4b9f5809adb1", "comment": "Malware payload (Mirai)", "value": "54ee7f0a94e9aaacd527ae7d82804dcc688d5c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545244, "uuid": "84d50ca2-5731-45ae-99e7-9a8d0a00dc17", "comment": "Malware payload (Mirai)", "value": "39bd6de08783b258f18696c9593b754272b29ec2c03fcaaf2dfb600e291677d21d201b0a3a6311a00b1b8ed74e06404a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545244, "uuid": "a31018af-99b1-484a-ad3f-3b8995f68a9f", "value": "T177B2D0B077418AF0E6F0843BEF36C7526B89C674E1F97C51263028A555E21B626BE1E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545244, "uuid": "9d933550-6e4e-4d4f-8fde-3c22caae37fc", "value": "768:GuryFciSNHH3vrUFGzNPVcM5AI/Ms3UozTF:GWyFAHH/rpDcMXJzTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545244, "uuid": "f6dbbc89-5302-49c4-a941-2a60c44c2fe6", "value": 24944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545244, "uuid": "f580ab56-05b2-421b-a946-940b8fbba2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545244, "uuid": "036c4094-6180-42e3-b08f-dffd96942a60", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61677d92-8d84-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785573513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573513, "uuid": "9e176fff-7c98-44c1-887f-1213c145f4b6", "comment": "Malware payload (Mirai)", "value": "03c8864f72de14def2f3115158477343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573513, "uuid": "20cd5410-a4e6-422f-bacf-d2e383926720", "comment": "Malware payload (Mirai)", "value": "4b00d95acf3f7769f75841ccf24b9e910bede240856d8d8087236d5ef97e69a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573513, "uuid": "6a08dc71-4cd4-445d-a262-47d74e0332d0", "comment": "Malware payload (Mirai)", "value": "9393ba6a37b25454886cd3b8efe8e84556afec49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573513, "uuid": "6ab7271f-4c51-4608-9df7-5478175cf598", "comment": "Malware payload (Mirai)", "value": "c17bdf0a06235049141f8524d7a1e5424bd58067de4900ce5e5e8cf7d67b90b2b7784ece9f18bfa356f2b5493f75e4c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573513, "uuid": "4f332a5c-cabd-4233-9ade-cc634f5f6084", "value": "T1B9E36C22CC656E9CE026ED30703C8BBA17239195854B9EBB286783758057DC9F856BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573513, "uuid": "7c1be660-795d-4a4d-a81e-262faa434815", "value": "3072:S7KuG3avwBxtShfLfvgDHolGuWMyvYiLWrg0fDPx:SZaavwBjShfLfvgElGuXoargwDPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573513, "uuid": "40336b0e-2413-4710-aa49-3f2c032212bc", "value": 148800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573513, "uuid": "a3c901a9-d8b0-49bd-b66d-f61888994b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573513, "uuid": "ce934ae7-b427-463d-9a57-9fb85295b0b6", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73eb0a99-8d57-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785554217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554217, "uuid": "ab632a0d-bcf1-47db-a49e-87087f303887", "comment": "Malware payload (CoinMiner)", "value": "11babc5c7dd1f8853b4c0b222bc91ae9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554217, "uuid": "732d7196-3576-4420-aa90-62ec77f04b01", "comment": "Malware payload (CoinMiner)", "value": "4c17b8c2d287de19641026b61af6567c2f08f65888fd7a620a919e83a2c08895", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554217, "uuid": "cb40ccea-1d89-4a4f-a095-9f9517f43bcd", "comment": "Malware payload (CoinMiner)", "value": "b85a2a863e9234de3aa1a3d8b12a6023b5561b16", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554217, "uuid": "77f830c4-d3cf-4723-88e3-377f098c863d", "comment": "Malware payload (CoinMiner)", "value": "c067c6966cd532d485d3776d4522d0608894a4b549cabdd96585fafd95f9a41b546e074814db400393d68b14c6f66f5d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554217, "uuid": "c40193aa-593a-475c-8712-b94df81f43a3", "value": "T1B53633A665D92836E487CBFCB282A07EB6BA77A5C9257D033FCC55098D1BE24153C3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554217, "uuid": "49badb0c-bb33-4662-be7d-80d3313bfeaa", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554217, "uuid": "d9199d53-5666-4ef1-b5a0-093085d5e216", "value": "98304:anvDBCTlzx2tA0+39rs0nIo/lMmleWJQcGEBwuUa/HDlcVdsJkRPHZor:cvDYb2tA0+zIIyO5JQc2a/DltkRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785554217, "uuid": "987b85af-16a2-4ca4-b455-92f6424ca7e5", "value": 5231104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785554217, "uuid": "f13017a3-4c6a-4645-9917-10de487b8f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554217, "uuid": "ac764cfa-6807-4395-9878-24fe5e98abcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5db156-8d76-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785567515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567515, "uuid": "e71a7fd3-4f93-47a1-b9db-e13dc9e36b32", "comment": "Malware payload (Mirai)", "value": "be2d8482fa051d2bad9cc96ff093854d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567515, "uuid": "fc4d0d12-9f35-4970-b205-f1c61a74747f", "comment": "Malware payload (Mirai)", "value": "4c1d2ab0457ac081d5f2b6335e4ab76d8ffbe03c6f03902968295fbd26106b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567515, "uuid": "c6d38f94-c471-4e18-963f-e2e2a9aa193b", "comment": "Malware payload (Mirai)", "value": "6732f90ae6b5b17b97c887b7ad1d157457826ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567515, "uuid": "3c5f713e-d1e6-4aea-9c4d-7e9d61efccc6", "comment": "Malware payload (Mirai)", "value": "8c8a78aad70d9b5bcb2c46a6349df3fd0ab1f13518b27113c6a004532e713a4834db05f421d8c1f441375d45f87b04f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567515, "uuid": "327197ae-9f15-4399-a42a-38490f595fe3", "value": "T1C224EA0AAFA21EBBD8BFDD33059907052CDC544B22A57B353674C928F50FA4B5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567515, "uuid": "e3a4e442-592d-4c50-acec-d8c1f4be2a44", "value": "3072:2xql6iCe5jKNnkGpb7DhQX+3NShet1VfC4GVD:2xqB+ZpbxQO3cheBfNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785567515, "uuid": "6b72b2a3-69ab-45b2-8eb7-1ecbeda9b6a5", "value": 210520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785567515, "uuid": "b90489c7-f178-4c25-8719-492be4d9569c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567515, "uuid": "fc3d5fb1-71ad-4449-a91a-593eb472466f", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9197aaed-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620409, "uuid": "f3f3f2d7-70f6-40b8-a443-2c6dd651b5fc", "comment": "Malware payload (Mirai)", "value": "4b31b737e840d1f0be0dba59c29dd022", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620409, "uuid": "57c373d0-cbff-4c3c-a2c6-fdb0cca71bd8", "comment": "Malware payload (Mirai)", "value": "4c6864fd34873241f7978b955a7a223c86da5da262741a023f96c14e3d380208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620409, "uuid": "81b452e8-3eee-4b4d-84b8-92db7d1be578", "comment": "Malware payload (Mirai)", "value": "e97410d80ee450af4ca4190f7375026dbb1346d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620409, "uuid": "ce1c6be0-723b-4e3a-bd67-8262e98410e1", "comment": "Malware payload (Mirai)", "value": "fc411c5a46d16641d13127a69d77cb988a7f5abb92c00d838ad65d75377c6dda9f6b1940daf24f5a8a036e7293502a4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620409, "uuid": "3f0785ab-6f1a-4ca4-be42-a896ab659e12", "value": "T108A3BF33E82A5C94C0850178F5E69E361B73F5C046571EF72AE9C6B6504BEA8F50ABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620409, "uuid": "3bb2c70a-12ad-4d26-8c67-c14fc71f2ded", "value": "1536:s/ix6FX25Jt6IIZb+eADzv7+1KSrhY7wxLQlCmvuV8S8WvU:sKx6RqyZb2zT+cS2oLQllM38M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620409, "uuid": "e313636a-615e-490e-90ec-03c172673e3e", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620409, "uuid": "f75661ad-a88c-4123-9679-a16d78662e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620409, "uuid": "7acdde95-3a9e-4a65-9e3d-bc4fabcb8075", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6677df1b-8d4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785549040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549040, "uuid": "6fa8576f-b977-48c1-bc80-51b4add91e26", "comment": "Malware payload", "value": "dc3138f5d95ffc71195125413c33ad3b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549040, "uuid": "fcd846ef-7dc8-4a0e-be40-0aeff471d65c", "comment": "Malware payload", "value": "4c7ac675d6469a808bdcc5feb6331e5771e7e221a357baf6a5617702076ffd6b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549040, "uuid": "dc5faf18-0c80-4ba0-8916-b9c66ba32864", "comment": "Malware payload", "value": "db8d98ea09e2af744bd106f8c44fa7619546ed1b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549040, "uuid": "2ab558ee-024b-4181-94d6-59923b7e57f4", "comment": "Malware payload", "value": "2f3e02fcaa9bdec6ca9707aefde796c3bdb497289dab60e183d07fa0353c89d9c366db839337d93b3eeadba9d169fb14", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549040, "uuid": "76940581-3d98-4494-92e5-2a2cff5ab031", "value": "T16F32F8DCFEE572A0F31303CE37AB292A122460D72008C5C5F98D9DE57F467998627A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549040, "uuid": "209f96c3-5c56-40ae-88ce-025edc79faed", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz25JYb5kq15HdtI74dthOO:sXX+/DV7k/325Wyqpt84dTOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549040, "uuid": "83fe6bdd-1078-4eea-acff-536ab223872a", "value": 11963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549040, "uuid": "938f0849-043b-4b26-aad5-d468c0ab6982", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549040, "uuid": "c7759821-ebee-4255-86bd-cf07288a15d3", "value": "don12089.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beedc739-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785547900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547900, "uuid": "37f85dbc-4aa5-40be-baed-ef04127ed286", "comment": "Malware payload", "value": "cff3a9e9ad28ef4ed30af09ad3d55586", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547900, "uuid": "13eda5ce-7bf9-4f69-8a22-5321a3e661cf", "comment": "Malware payload", "value": "4cef725a2fd962110be3b7ad4e01518a78d3bec24e7d078a5fbe1b35f38d9d2a", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547900, "uuid": "709e72f2-3f81-46f7-92b5-1d67089a9629", "comment": "Malware payload", "value": "a97365e84cc6c593aac2edf58dad704936177b38", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547900, "uuid": "a56c99f2-d614-44af-b976-c310dec53c22", "comment": "Malware payload", "value": "f8a439f41d56907eb82bf931b737487bec6c7eef0ee156dc05642c7d19a1c785f201f58eb14a15b6c571c9cfdd0d61d4", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547900, "uuid": "9d521e7f-7a20-4a53-9657-661d68b511d3", "value": "T15AD523CBB8B20938C47BC3B68F92F07EB01A77458B2A9D97769E6D408E134546C36771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547900, "uuid": "f47044fc-c51b-4fef-b1fe-fc83d9136246", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547900, "uuid": "6c3aabb8-4902-47f1-a4aa-f9467b62f952", "value": "49152:0VAQsnJFqw4RJiLf6MoeOBM6mC72zLIFg0n7SLKRwvxsjvX5ygafusWE:4sJFq94MP3mWg07SLKRwv8RyhfFWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547900, "uuid": "374a5463-96fb-463f-9e87-dba285206a9b", "value": 2953728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547900, "uuid": "5dd9835f-b258-4684-a782-8e02543f10c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547900, "uuid": "c07ac202-0594-47ed-9cf6-75f89a481093", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3e97ba-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620452, "uuid": "9a888488-ba1e-4432-a7e3-f78db852d242", "comment": "Malware payload (Mirai)", "value": "8eeb97ca60c4b1d6cd474c41068dccef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620452, "uuid": "77ba8f9a-d04d-4147-a2db-f536891dfdc3", "comment": "Malware payload (Mirai)", "value": "4cfafabca30db3ed06a64a8e59c41bc926509eb3931f72fa829e20ae26007f6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620452, "uuid": "9c3ed53d-a358-4b0d-a261-3895a6563f9d", "comment": "Malware payload (Mirai)", "value": "1fa9d24638633028947d47133850c0a0dfc44a1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620452, "uuid": "1ec9b4a6-41d7-444b-a55b-d296f1e12d44", "comment": "Malware payload (Mirai)", "value": "012f75df233f6b52468879cae864882b7ae4840e65bbdbb699c52743bec4bb352a46459e05f8a5b86259a2a5e73381ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620452, "uuid": "732fe5c3-9878-41f3-a2fb-706da15009d1", "value": "T194A36CD6F283D4F5EC2241303076FB379E72E5BA2129DD83D7A49663BC62A42D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620452, "uuid": "0a00470b-ed8d-4043-bade-b32bc82cd831", "value": "1536:romRqozBnO115B3k7myNqhwN3J03g4aKBtlgALf5SZ+Zw4Bu:0mDg3U7myNq+N3JyXVtXD5+4Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620452, "uuid": "4b208230-b702-4678-8162-7452a04ac5a1", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620452, "uuid": "dd8a59cf-4602-4e5c-952a-8c76f1c5b54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620452, "uuid": "571a8b06-fe1d-40e8-bc99-475667fa20c6", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be4c85a-8db9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785596160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596160, "uuid": "ab1c6dcb-46d1-4ce2-bd87-45c63e1ac613", "comment": "Malware payload", "value": "4eeffbcc914c35cd0f40c9cd565852cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DrvInst", "colour": "#4A0451", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596160, "uuid": "df91984f-6ec8-4b10-a18c-217083d4532a", "comment": "Malware payload", "value": "4d6b9a762f56774197e83539ac36761eeb9e1bc21c12f60f046034bd6a3925ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DrvInst", "colour": "#4A0451", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596160, "uuid": "004be0bc-704e-4bb8-bff3-d9d56f86c41f", "comment": "Malware payload", "value": "b4e5025a7dc93b8208bebd0b248447152a4ae185", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DrvInst", "colour": "#4A0451", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596160, "uuid": "3d91326a-1e7f-4c9e-8cdc-37def69bb5c1", "comment": "Malware payload", "value": "07a8fe98d84ffe1613a51ad40a19c6226fc5c972c5dd6a761e63a3a5e9dd7d32ec82e182c609e3a2b13618562e2107b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DrvInst", "colour": "#4A0451", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596160, "uuid": "f6c98f65-2541-4be7-8376-c680d4921c59", "value": "T10B062373326680A2D3FA8C354933BEF172FA03268F42AC7A5A9D9DD514115F5BA13E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596160, "uuid": "cf95c1aa-f31f-496f-b5d0-a088a25a3486", "value": "cdf6f8a38402458eaa6c129f313defe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596160, "uuid": "b0357f79-51d3-47ab-8b4d-e8ed6c6a4d63", "value": "98304:B+FXiCBTOFtelel1tvuvOebP8OAxXCXWXOSFAnJnh8KP2lL:W8FtEOebPRAxXiWXOSQndPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785596160, "uuid": "08d6be1f-7bed-46d2-9b4b-11c7f94d9bca", "value": 3783680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785596160, "uuid": "618e7774-6f49-4536-9946-4829a88788b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596160, "uuid": "64adc2f2-11ec-4e37-bdfa-84151e02881a", "value": "7.24.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74d6f5b-8de7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785616177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616177, "uuid": "4c015571-1173-4880-8053-5fc636148ce0", "comment": "Malware payload (Mirai)", "value": "62146556762546a81b7dc0d12429a09e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616177, "uuid": "0561a8e9-2388-4954-8ec2-049e027e8ff0", "comment": "Malware payload (Mirai)", "value": "4f26448bb73eb03aef09cee9c0ce535df001c08e957df4f3bd25d784eabb75b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616177, "uuid": "41eb7f06-8a5f-4e17-8a12-eb8238c553e8", "comment": "Malware payload (Mirai)", "value": "0a28fc53d167da230f3a5a238f3df7045eb3b371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616177, "uuid": "08c49d49-be5b-497b-a275-2eae824abc11", "comment": "Malware payload (Mirai)", "value": "9e084a3bd7635709b2ed0bb8d792593e26c2678623215b94912982c8fbc666207220ca3d2dfced898373b45f7581a4e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616177, "uuid": "8ade963e-1b00-4075-be6e-92c1a04da768", "value": "T1EFF34B46EA408A13C4D62779B6DF424633239B65D3EB33069928AFF43F8779E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616177, "uuid": "ef1a7cfb-7504-4623-b681-bf354148d0d5", "value": "3072:rXmri8YZo5aWBQf+oLfVqsOklM8QQkVN0rfKrhZM/95Uk:7mrOe5aWBQf+oLtnOkOQmNMfKrTM/9yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785616177, "uuid": "b3e96177-45e7-4e5f-9c69-d2957c79b896", "value": 172356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785616177, "uuid": "f055506b-220d-4efe-964e-7308a6a2b8c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616177, "uuid": "4bd0a0cf-00a9-4545-ac21-38fc696e97ca", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93799e6-8de4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614946, "uuid": "3d7f6be1-ec8b-428b-901e-f63a72effdce", "comment": "Malware payload (Mirai)", "value": "c50850457e38bb213d717ac5649df600", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614946, "uuid": "ec0ae74d-2b1d-4a82-b79e-e8e206da6c69", "comment": "Malware payload (Mirai)", "value": "4f3b5791691f90bdcef1dd449ad1e4819cc5c27deaf8e6b188a5919e218c7f69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614946, "uuid": "69f69156-288a-42bf-8433-cac55b8cd4ac", "comment": "Malware payload (Mirai)", "value": "16251780f9aa72c672cef8fed7de4c703131f0f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614946, "uuid": "c23fe324-9d5c-4fc9-b886-1eac3099d603", "comment": "Malware payload (Mirai)", "value": "e4197b642684b5b61d67be565b0167c50f550770d91140bb2cf42d82d3a10c675222fea645f1b7ffc2406ddbb832054c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614946, "uuid": "cb3587a9-4628-428f-8fb1-57170df5378a", "value": "T19313F29C68446DEBC9689DF9900F03F4139040C072D1EF7A8B328C5E1E335EBB95A539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614946, "uuid": "1c4e2b1f-d2ee-4a33-a2b1-edfe01e95dfd", "value": "768:VXveLIda5j1vbEHBIefytX3P3zJqy26XqjIQAW3nGYfwu5VmCnfaFd3KclJWe5:hve40tQH2eqN3/z8VqWAW2F+fGd3Kc15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614946, "uuid": "60497b36-b1fa-40f2-a923-dd7e9df9bc3a", "value": 43076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614946, "uuid": "ce32e1b6-300a-4c97-bb0f-801fb1acc4a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614946, "uuid": "1d648d90-f59c-423d-a649-b3300418756d", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e099de-8de0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785613029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613029, "uuid": "299568af-55bf-4da6-a9a1-bebf8972ff8f", "comment": "Malware payload", "value": "befee43060c7089285d421093d93752f", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613029, "uuid": "1e97ee10-cdac-4854-94f8-2cd68d2d7058", "comment": "Malware payload", "value": "50acfb7810e0efc90ae24b1c10dda449a253b0583372ccaec0845e8193b7c8db", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613029, "uuid": "a3b6201a-4604-471a-9f04-161f716f9f9a", "comment": "Malware payload", "value": "77a7067be03fc541bbc9156ac8fa377dd578b980", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613029, "uuid": "46c0bb2e-e6b1-46a0-8764-5e2569358d16", "comment": "Malware payload", "value": "8fb62e26eecc2b6cd35516df946318da49ed2a0c81d5e276dfd3b5ee24081e00a6a79642649225704f757cd628fcf09d", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613029, "uuid": "0df90a13-10ac-4816-8c59-05c7a8f8a335", "value": "T13AE533DD0965FC2BF7FF40FC74AE9E9DE28011169DE64A03B01D906B84870ABEB1925D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613029, "uuid": "edb0c3a4-9611-4903-a704-dd37efc881ba", "value": "35f3e5e1597ffec9c6b30622e5e4c0bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613029, "uuid": "ee72b2de-f00b-49dd-a113-5f46c0dfa1d6", "value": "49152:rkbzVRJf8JVOZ0zZkK++oQWdWFmfpyl8dJ0zl9A6mj6NwPdaP2RtbvEMjR6ZbHG3:rkbz9f8dwQugmfMxzl9z5NAaP2fsMWq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613029, "uuid": "8b6e321b-2613-4a66-95fe-a8d6946a4696", "value": 3312872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613029, "uuid": "7de56bff-9604-44b2-a541-3dbe3fbf18b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613029, "uuid": "fa72b770-f60e-4c84-bf05-ed2b8af8ef65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c316c5c-8d5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785556351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785556351, "uuid": "32388b1a-c083-4f01-a5ec-caa782f64913", "comment": "Malware payload (Efimer)", "value": "f431bab8484871c918874b91d60665ca", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785556351, "uuid": "125a5397-c6bd-454e-8f84-fedda501f85e", "comment": "Malware payload (Efimer)", "value": "514b8816af6639c6185f03cb2969e7855f1883b6d8a651c7e218269435795b9a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785556351, "uuid": "95dd2688-5c2f-4fb6-8cba-bf4793c450ea", "comment": "Malware payload (Efimer)", "value": "df2ca5aac70682ca84c50ca5eb02d55565a7ae16", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785556351, "uuid": "931a81bc-770a-438b-b6b2-4154f3011d59", "comment": "Malware payload (Efimer)", "value": "fcd054a479ad1461a77fe3873ff3737c27b23c28c10a7f153c1d50dd96fa1b57f2ee6aa32bb2c7509ae7f6a72c721f5d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785556351, "uuid": "dc2cafc0-cffd-4f9d-9d69-1cfb11c29d8a", "value": "T192E633081AD016EFE9B3817DFBD219C5E068BC314BB2C4CF47A856AA5F532D09C3E656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785556351, "uuid": "41668210-2ed5-40d7-9314-98bc49a07720", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785556351, "uuid": "396b642e-9310-413c-b92f-bdccb153fe7e", "value": "393216:Nmgc/5Sttlvdd77aUplxrXMCHWUjtcuI3/PGTAI:ggcQttpO4lXMb8aH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785556351, "uuid": "431e5620-0d1b-4345-b740-14cbeb8c1823", "value": 14313022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785556351, "uuid": "7e92b286-76ea-4c06-b5cd-886fb144e989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785556351, "uuid": "c5ca0d4c-339f-40eb-8f80-d4e65f67e826", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983adfe2-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620420, "uuid": "6ceb2989-8904-48b9-8a77-672be48dae47", "comment": "Malware payload (Mirai)", "value": "553572207700d96b13a460fbeb4c9b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620420, "uuid": "19d5418d-39e2-4f02-b5aa-d345449d4d43", "comment": "Malware payload (Mirai)", "value": "545b2a205332793068ed712fbb3d93fe3489b573f80f44bdaa8073b333ffada1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620420, "uuid": "c63166ac-d469-49a5-8632-b1483f9a69ee", "comment": "Malware payload (Mirai)", "value": "1ce2d58bb5e84a445ce3e71d2e6c3d11cfa80f3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620420, "uuid": "6ca01e24-aff0-4558-b5dc-45c376aef203", "comment": "Malware payload (Mirai)", "value": "53f34b410179830de07420ee772eca8640ec4cb1990add5d3b52ee8c40417134f6df40ce8c2a1bccc53414a73f3e94ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620420, "uuid": "d04500b8-e998-4cde-87be-ecad57876784", "value": "T151D3AEA7F74711D1C86302F407CB5BDD2E6322829F6B98E3BC6F653B597A0DA0502B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620420, "uuid": "ab892a67-a51a-4420-8d70-7e1448eebd18", "value": "3072:fn/EPB6z66/zTFKx9WxRnGJFun1gHeOq:f/eCtlrxYWOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620420, "uuid": "2022d5dc-8bcd-43e2-8d88-a10213ca0a73", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620420, "uuid": "f7aed1a8-ae56-44f0-9bfd-9e1511904112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620420, "uuid": "1b21be80-557c-436c-a8b8-bb9e28ab0410", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924a025e-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620410, "uuid": "96b30d0f-2cd9-4a2a-b534-92f6da27238c", "comment": "Malware payload (Mirai)", "value": "0a5a042451c8d027d0bae551c0be40e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620410, "uuid": "0066aa75-15ad-49e0-b8dd-f979fc120010", "comment": "Malware payload (Mirai)", "value": "54a4b6e51d65a8aa5a1c58c8611905e35b9351e9b290b001801fdc1b0b4d5815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620410, "uuid": "2ece610c-463a-4821-a9c9-4378972f25f8", "comment": "Malware payload (Mirai)", "value": "c2ab7cd362ce9f12c4f62f37cb52c9ed338e2e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620410, "uuid": "56911a65-024c-4c06-9712-b0d669d19162", "comment": "Malware payload (Mirai)", "value": "47972c5cae632b8e5fbf35475c3d3dc9c046897a97c6db31e759f92576c93d22184b0c6dc374db61fd04e1b5bc3dab4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620410, "uuid": "5ee48b5d-5db6-4e02-b219-1e01c5046d52", "value": "T1E5D2E0B554AABDF193B06430EF28860766E30278D5FC74403A81129B7C56C4E2BB9BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620410, "uuid": "ba00b736-4992-44bf-bd83-a2457e632fdb", "value": "768:R1B38fPHNGwHeqNul5I6YU0M3rMJLHzNnGOks3Uoz7N:R1aP3HeDBYU6JBGOBzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620410, "uuid": "e3e23d18-8996-476c-ab89-0113882a81af", "value": 30916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620410, "uuid": "75bc9ab8-f2c3-457f-845d-0711164b14f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620410, "uuid": "19435e1b-969a-42b5-8d61-891e26cc676f", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2f391b-8dc0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785599546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599546, "uuid": "a6458aea-f59f-4b44-807d-e6e7c379f535", "comment": "Malware payload", "value": "d9414b2d5e2276178d65319fe725b4ca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599546, "uuid": "1538d0b3-c60a-4065-9a8b-c170e0cb78ae", "comment": "Malware payload", "value": "54d60e0ea888bb8529aede75fa8b00e6b3973a6700f0b7b15634b910ca5b8664", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599546, "uuid": "1e8d1a6e-0111-48cd-a0dd-800f58446e15", "comment": "Malware payload", "value": "97e6465f196a8e3cd48325c3ce9a547241752faf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599546, "uuid": "4b2f4fef-60bd-4545-bdcc-6bf5a03e0cb6", "comment": "Malware payload", "value": "ae5341efa3a7a2b9d975d719090b5fdf02d6b01bccd3b4b0d86446682c762387cd675777c9278917b625a307d974779c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599546, "uuid": "51e41e06-fc58-4437-8411-61e9d85e10fd", "value": "T1EC236D6516857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599546, "uuid": "ffd9a219-0bd2-4352-8cfa-6bd79432f2e4", "value": "768:NXRWNGxVP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3lx+cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785599546, "uuid": "883788e3-ef44-470f-a0be-517e80865066", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785599546, "uuid": "134d6366-33bd-46f3-a917-621e5f99e5c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599546, "uuid": "03874a4d-59ad-4890-9bb8-ce3b44c9b665", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e26089-8d76-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785567499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567499, "uuid": "a12627f6-868f-4505-a4f9-7f2fc0f26ea9", "comment": "Malware payload (Mirai)", "value": "d3481c6a13d8f183471dff7567c878bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567499, "uuid": "eb3e1fd4-1956-4dfc-b7e0-0af27c57846b", "comment": "Malware payload (Mirai)", "value": "55492affef4baa3d258ef180e2974b1c78f264d8255b8b304410f3592402b517", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567499, "uuid": "dd7ef455-04d8-4719-8b12-4d350f948fb6", "comment": "Malware payload (Mirai)", "value": "e81590ee3bd28fa7433c6d33d9a72275f9913747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567499, "uuid": "470161be-8b1e-4ab5-9b7d-ba61c16bf2a2", "comment": "Malware payload (Mirai)", "value": "a66b1f4a412811e69ea696389fa75e9139d84d6f7cb0edd32ab957142a30fc3e826b2ff880c9e681cc5991123470dd70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567499, "uuid": "5f8222da-4329-4759-b117-31eb5f05d373", "value": "T13653F1DCEF6A3D2ACCD90479402E459B9A956092319E37FEF3755E4DFF24480A88187C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567499, "uuid": "de1199c9-e0a3-4ac6-85ac-68c69d433e1e", "value": "1536:idtBhLqScAOQeu6LzE/8Dw7yv2KtQF0/a0WA+h4:yrhLqHAOQe5PgaZuK88aIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785567499, "uuid": "e82c5ef8-0184-4fad-9ba7-c0c3bed5a10b", "value": 62040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785567499, "uuid": "08b895f0-6415-424b-963e-92480bdb517f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567499, "uuid": "d59ec4ee-ae76-41ea-852f-887a3097231a", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b1cd2d-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620473, "uuid": "6af999e6-2215-4392-ae36-00742d754190", "comment": "Malware payload (Mirai)", "value": "5f37f801431d27e51fb17c5f25edafce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620473, "uuid": "1f2cce34-36d3-478c-8a2d-1b8d9c75ea18", "comment": "Malware payload (Mirai)", "value": "555c76991ac30baf04c0036a7e83e188e2d299d6ddc1202a26793db022673757", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620473, "uuid": "6e0ea88d-5efb-4518-b358-23927a7e2d03", "comment": "Malware payload (Mirai)", "value": "aca4378e236912134c4c42bb31bd80fefdbff076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620473, "uuid": "226e2f1d-8f07-460a-8761-1219daddfc5f", "comment": "Malware payload (Mirai)", "value": "575fe0effa1df657aad39a1ba8a05c79d5fd8ab18c54fa082089ca05639accec8dd769625a37ab31b886caf55a990471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620473, "uuid": "b5c21271-800b-49b3-8716-8ce8767ad402", "value": "T1F9B34B03B9C28DFDC045C034437FBA36D925F0EE1639B29B27F5EE266D0EE610A19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620473, "uuid": "7c517fca-6d00-4588-a89f-f9e151dc9c9f", "value": "3072:vEWK3B33zFmdUXAeJ+4gJe71At+lLnuJTjtOEVQIGiIGe:vEWK3R3hm2XAeJ+4gJe77uxjpH4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620473, "uuid": "a5c5da9a-3397-436d-8eb9-c17231ecee9c", "value": 109968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620473, "uuid": "4be7fe37-1e84-46ca-9558-37c598f5a73c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620473, "uuid": "d6736c35-cf5f-483b-bfc3-a76a2da60468", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f36949-8d66-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785560532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560532, "uuid": "0219e016-204c-4779-8e54-063e38a8d858", "comment": "Malware payload (Mirai)", "value": "a6a418aef3e387af682765787eabe434", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560532, "uuid": "bbe69f53-a8c0-4d35-bf88-e744b23500f6", "comment": "Malware payload (Mirai)", "value": "55608b85cd93ce12aaddac2a9ba0737a0cca5581405a0b62a0b39dc825702212", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560532, "uuid": "8f4b5509-76d4-4e08-9d31-0f0d2d900416", "comment": "Malware payload (Mirai)", "value": "d0750a15b9a30be15fd5515bbfe027816c59cf86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560532, "uuid": "b89e7859-ddcd-41a3-a20c-fb15ad143684", "comment": "Malware payload (Mirai)", "value": "7221ab826e960f636f0e051a74adce7b64118a7fcfe519d8751a3c4fcfbb6c8f6d25fb2bf49790d4e6ed3789cd053f93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560532, "uuid": "2243383f-fbb5-48d7-96c9-f092ef78ea84", "value": "T1F1311A9B18181A391307CECEB3A27159B00C91FB299FCB949D580EEE87589CCB251BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560532, "uuid": "caa57f42-2ddd-4d6d-9446-c0952d62d03b", "value": "24:lZGtvBzCzfwNEKo8RYhYetqC4GvhBq4N2pQTQzB:Rf9KoyYhwl+uywB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560532, "uuid": "dab3d29a-f254-4dd8-90e7-d5e46577d003", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560532, "uuid": "c7759452-9061-4f3c-85be-ea9bc8ef8e50", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560532, "uuid": "a016cccf-bb19-484a-87c2-5c551611d612", "value": "55608b85cd93ce12aaddac2a9ba0737a0cca5581405a0b62a0b39dc825702212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc2432e-8d64-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785559947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559947, "uuid": "184f5044-e1df-4038-95d6-a0d8177e25c2", "comment": "Malware payload (Efimer)", "value": "33061ef427fc9e0221edf9c088665946", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559947, "uuid": "e7b47b02-51b7-447f-87f4-502368368000", "comment": "Malware payload (Efimer)", "value": "587fec092b6fb6fbbf3cead3a22061956d39ba949f65653f46ed60be8ffc704c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559947, "uuid": "22668524-c01f-4a34-ab69-9fc2b4072078", "comment": "Malware payload (Efimer)", "value": "508455f62cbb4040c574c467ad038714eaae40db", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559947, "uuid": "61745eb0-d233-4c93-861a-b35bca21202f", "comment": "Malware payload (Efimer)", "value": "3f4c009e9effd4a5bb85a25f8054656702885f19f22d8d5410203684b7f2603b895679b995a95c3628408c84bd2a6295", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559947, "uuid": "edc0d94c-b76e-4bbb-afa5-47da4b31a25b", "value": "T1D7E6334C76E101EEF9B3413CAAD252E1E696B8F44332C1DB4B7486922D232F11D7E667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559947, "uuid": "8501d10d-7a2c-481e-8e0d-e160738eabc9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559947, "uuid": "05baad5f-82f0-4b73-ac02-8f9fbe15fcb0", "value": "393216:eytzV9ox1RRjWtO8uZWOXMCHWUjdEcuI3/PGTAI:ezdBXMb8dRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785559947, "uuid": "e4baf87b-85d1-4fab-9590-184a7ea559b9", "value": 14321805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785559947, "uuid": "4b6cc8db-d3eb-42fe-b4a0-5b2e5371ec88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559947, "uuid": "6c6b7784-c462-4714-adb8-63fade494c92", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba140c6-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785573101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573101, "uuid": "06a89db5-5d16-404d-ae6d-fb51b4103f62", "comment": "Malware payload (Mirai)", "value": "c3dcd14aa6bbab2b28088bf37e344407", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573101, "uuid": "2288bdbe-bfd6-4356-8fef-7122a767dd93", "comment": "Malware payload (Mirai)", "value": "598d15bb4d509f84ee0657cd980238e6b38102508103523709789f3c76b730cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573101, "uuid": "c6ac5b9a-e776-4b62-89f1-c6ed01654915", "comment": "Malware payload (Mirai)", "value": "9e75287fac50d0337c6d58980bcef6c47ab0131e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573101, "uuid": "37210df9-ebde-4f08-9878-47a9d51204c7", "comment": "Malware payload (Mirai)", "value": "6eb0bc7541a213c1a0e55f67ea5b19ab3c01cfa49bba00a70093f35b1e4ddcf99347443519a65f0189013cb1496ac9d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573101, "uuid": "c2410e65-2f23-4970-ab6a-b42653cdacb7", "value": "T15A932886FC42971BC2C113BAB6BE5A4D3365A3F4C3CB32129D214B653AC951B4E37E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573101, "uuid": "38bef2f3-587d-46a1-9151-4db87931a504", "value": "1536:WS+wc7qgBEV7cxFOdwx+kHzu5sdkY4Ihla10rb9EJLkD:WS+wc7jdjx+kT6sdkYFcHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573101, "uuid": "ba93338f-5d12-4793-bf4b-87bc9615f989", "value": 90024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573101, "uuid": "809a40d0-678b-4473-95d6-20f19d5ff9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573101, "uuid": "9c80ec37-4d8e-432f-88a5-b0c166b3c524", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717b4e9a-8d49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785548200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548200, "uuid": "d2dd19b8-5fd1-4723-83b7-32942f928651", "comment": "Malware payload (Mirai)", "value": "b918a5e3f2867f1953d9eee625d0713d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548200, "uuid": "98cb07af-053d-4c58-b499-31fd736dc4a5", "comment": "Malware payload (Mirai)", "value": "59b08987027ffc89bf36cab40c252b784077ce810b606dd4cf411f2c727a66e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548200, "uuid": "c7cfffda-a83e-48dc-b734-a6cc84e0809b", "comment": "Malware payload (Mirai)", "value": "94332dfa9e8138d5ca4a50088efb049f6c3062a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548200, "uuid": "da38dd7a-295b-4e98-b78b-a96bbd831ee3", "comment": "Malware payload (Mirai)", "value": "bfba8bec6ac90daa5d0fe1003debdd6787bad2657c9d869860d98e7cf6e99101d3742bea88bc810472d815ceea925b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548200, "uuid": "25f28155-6a8d-4a02-a106-6945fed71309", "value": "T105C3F909AB614FFBE86FCD3746E90B0525CC551722A83F7A3574D828F64B64B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548200, "uuid": "0640dca9-f228-4c01-9acc-4de366af8739", "value": "1536:FtJ6cGVoxBFf+g6z3jLH514RXJMneY0+YdW0OKh56HposWZ5uRrKnr1FWLlykhgO:XJ6cGVoJ6TnMX6HbWCZuqlzUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785548200, "uuid": "4856758b-2b03-4d9b-8d7d-03e78448cbff", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785548200, "uuid": "ed3d2220-1208-4f10-a58a-8fe11374663d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548200, "uuid": "75baddf3-53e5-4410-b4c6-b24822476919", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbd814c-8dbf-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785599062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599062, "uuid": "0790f846-aca4-4656-ac22-9edb2c4bf413", "comment": "Malware payload (ConnectWise)", "value": "5fbf5f42ced3d876ae021839bcc00069", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599062, "uuid": "fb7f1162-d350-45e8-8ccb-ffcf347ee427", "comment": "Malware payload (ConnectWise)", "value": "5a49b31f84002a128f1cd0272619ae3aac4bc4b3065d567daee4300b6ac27a05", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599062, "uuid": "744a4fde-0bf9-45b6-aaf9-b0fb5f967a11", "comment": "Malware payload (ConnectWise)", "value": "c463b7913a6e7b03d9c6f9d98a070cd5b97fdd78", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599062, "uuid": "01e23df8-f32f-4126-928e-b1c9c3cd4d1f", "comment": "Malware payload (ConnectWise)", "value": "a75296654fb41f08ab9bd80c3e3e979f0c921cd329d7f21f6d6698e3ccb0d7c554d105dc01aefa6d81b212ec039fca84", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599062, "uuid": "c61d3a1d-4bc6-4540-bc10-8b204a5fd7af", "value": "T14146E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599062, "uuid": "11fc2823-477e-4912-9220-aafa1d1671f2", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599062, "uuid": "43d5caa4-8a92-43e5-8b30-22dde8c02b55", "value": "98304:yzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:yhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785599062, "uuid": "951ae32d-fdee-4f9d-8feb-298c62748e0f", "value": 5641488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785599062, "uuid": "52d1810a-18ae-4b95-81a8-343ebf9abfa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599062, "uuid": "f71ca518-4c54-44fd-94f1-107cb32fd0ea", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0240c8-8d45-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546390, "uuid": "914400a3-854e-436e-bb41-92605289e35f", "comment": "Malware payload (Mirai)", "value": "71b8f6861d497efd8ab16017560fcfb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546390, "uuid": "bffe42a4-b772-415f-a357-39aafaf75fd6", "comment": "Malware payload (Mirai)", "value": "5ac57ece78df250d7ced1a49a74b1084f7455d8559e50a8afc08439c5ac20f9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546390, "uuid": "d942d439-1361-4fdb-b09f-75722d4ec98e", "comment": "Malware payload (Mirai)", "value": "8562a9866dca2355f5bcfb8dcd56adc329d9a700", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546390, "uuid": "00a94fa0-3c69-4972-a6d2-d11c0e218cd7", "comment": "Malware payload (Mirai)", "value": "5785751604e13a638bdff2d1d62cd376fb88755ff788c97acbe3c9d616f2816e34649d9383984b56a020a950ba591ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546390, "uuid": "e69bf155-7156-4120-8225-f6edb6995850", "value": "T17B145BA9BA0F6C41F1C2D3F9DE8C83E13A1735E3C7778971781212EDDAA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546390, "uuid": "b18feaab-88c4-4a88-8cea-58013f2b85d2", "value": "3072:cpKuyvJ1bquJiwwRrTr3bidlS7JyGTiTpQ4MsHnoq:cQbvJZquJiwGr/3udI7JfWQ4xnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546390, "uuid": "332330fd-243c-43a5-a822-6fbe13c0eece", "value": 194544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546390, "uuid": "3e4311f2-ed1f-46e1-95a6-c120bf804e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546390, "uuid": "a42fdfe6-dcb1-4e0d-bb73-dcc4b5ff598b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cf00ae-8d7e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785570806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570806, "uuid": "93d445b6-1c65-4bfb-8342-05100e83e7ac", "comment": "Malware payload (Mirai)", "value": "6f397ff33cfc90037357cd6d91897c35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570806, "uuid": "1e9fa2ca-32f5-435a-aeec-3575339f3eda", "comment": "Malware payload (Mirai)", "value": "5b8346f5a691aec4fae4d92d1b7cac32f066fa829633c23cc66584714896e691", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570806, "uuid": "f0052b67-4f8c-465f-8799-5f5b682bc2ec", "comment": "Malware payload (Mirai)", "value": "2ac2a27b0d8d0b200af9694c286f9c50a57fac90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570806, "uuid": "cbbb3971-8f68-4d65-9034-5f0c623945f8", "comment": "Malware payload (Mirai)", "value": "64693be8a0d481295a312a289b31492dfed82feff69ab5f7ac87e44f2994d815b56d17e293a8bd92adff5c2efadad4e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570806, "uuid": "9360bdb9-975c-4bac-beec-b4e6060674a4", "value": "T1F0F33B05734C0447E2A71EF13A3F6BE597DFDAD131E4A245291F9B8A8171A322886FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570806, "uuid": "29bd05ca-9d85-48e5-a67a-f46aa59da828", "value": "3072:hnLbU1kRKSqgnLB8AMxB1Bq2KTWXzjyDSDw:hnLbdRKSqebMxrBq2KTwiDSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785570806, "uuid": "e639e523-61a0-4043-9468-f107d4cea894", "value": 162488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785570806, "uuid": "45868c90-d6b3-4ad7-99d0-f61f5359d3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570806, "uuid": "f307b0cc-782c-46b7-a27e-7c31c930efc7", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3800b63-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544848, "uuid": "c31a1760-2913-49ba-b6c1-7882cd4afedc", "comment": "Malware payload (Mirai)", "value": "520adc036a757a2f45d5ca75c21c09cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544848, "uuid": "66872580-c359-425e-8adf-aafb3a556d98", "comment": "Malware payload (Mirai)", "value": "5c9bc93846185fc378415ead23a05c91bc200d1b76f53166999637de7d21627d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544848, "uuid": "5470c3be-a106-4f2d-bc70-f1582fe2fd40", "comment": "Malware payload (Mirai)", "value": "6f221012508d684b00a7121e399ad5ab27c4c211", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544848, "uuid": "14db48d6-cd2e-42de-9a6c-9b2bd13b990e", "comment": "Malware payload (Mirai)", "value": "89e39f874045c798ad3f9118baf6fd01b1d06dfcb968548a8583428902d9797a21eabd19478b56a36770a2bb58d0a2db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544848, "uuid": "65e80309-5165-4a67-856d-fd4f6c51350e", "value": "T1D9935B13B9C480FCC849C13087AFB536D963F17E1279B29B73D4EA167E8DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544848, "uuid": "3203e0f4-d358-4d47-8dad-967a550c2007", "value": "1536:Ac50J45j1WS60TXxMsQa8v6ZyxAwuV1h1ss6fuf55nulEJHWI5:Rf5j1W0TXxZ8uyx4V1h1ss6fS5ncEI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544848, "uuid": "777910a6-b299-4b1f-a8de-95840c6a2dfd", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544848, "uuid": "19bf068c-fca5-46ab-a338-4b4f15006e32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544848, "uuid": "001325c2-2209-4e9c-b3dc-ec0cdd3a9f6e", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d9a82b-8d8e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785577950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577950, "uuid": "c4b1a01a-100f-4afc-a280-214fb7a40852", "comment": "Malware payload", "value": "01b36ea7c92a42f6850c2eb5f99f1959", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577950, "uuid": "f61e5ec9-a19e-437a-9d09-b0060758f4bd", "comment": "Malware payload", "value": "5e7928e464b8274c85179ed0d6b03668b19d6129a40e06a7309b15944d1fd071", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577950, "uuid": "025e5d40-433a-4953-8986-462bf6fcd9a4", "comment": "Malware payload", "value": "6c5059c9f55c22e5b50402ffca715d8e63742c48", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577950, "uuid": "6fc7dc30-1930-40ca-b383-cec1bcdb597c", "comment": "Malware payload", "value": "db4d6d362c9ca35b6c04d6e05be8126d153e035a920bc68174f61495c41ae9722c07e278bdbb7c0a10239e73b21ab6a4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577950, "uuid": "59081067-8c9d-45a0-a9b4-cdd827af96e9", "value": "T1C8E6338C9ED422EEE633503CEDE1166AD478B4A11732C6DB1BE483657E0B2E10C7A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577950, "uuid": "fca2685d-12c9-48b5-a3e5-2819585ae13c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577950, "uuid": "9ad46147-ad2b-4b24-8de6-1f7f928ab882", "value": "393216:aYo3wGwTq7bRHumiRfQkZ1K+DnVK2W+XMCHWUjgcuI3/PGTAI:aL3wA7bRHumiVXDVKSXMb81H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785577950, "uuid": "fece6b74-560f-494d-ad73-abf42dca2d8f", "value": 14294956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785577950, "uuid": "80bcf032-8323-46b7-a763-340026add512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577950, "uuid": "d6a049bd-919b-4808-8691-36463c0f4e53", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f35b65-8d63-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemoteX)", "timestamp": 1785559434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559434, "uuid": "ecd88021-ba6b-45ef-aaf7-7017a0557271", "comment": "Malware payload (RemoteX)", "value": "658cb87887c1aa843e39aea3aab26073", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559434, "uuid": "b76f746f-dd14-4108-8c4c-fbdfc1f645b6", "comment": "Malware payload (RemoteX)", "value": "5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559434, "uuid": "577fe830-efb7-4dfd-9a26-ff9b4b5d4020", "comment": "Malware payload (RemoteX)", "value": "dc223e5e27e3bcc1cc636aa2b9567540868cc6ef", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559434, "uuid": "89ad2082-6f00-45c5-8fc4-b3e7c3bf8675", "comment": "Malware payload (RemoteX)", "value": "7d7a8fda27af380ff288db5e848dc816a2fb6db9dc9e9b55eb93ec0abc29a6a118e11d1d7ecbb9cbb9c202a6edaa4b35", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559434, "uuid": "27327caa-02ca-4b99-88f1-930e76bb73d9", "value": "T1D1073333B389683EE07E1A395977A114583B7B516C178D0A96F4086CCF2A1B17E3B74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559434, "uuid": "89dee700-0749-4aa9-b40f-f9b43d546224", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559434, "uuid": "47985ae6-85c6-41ae-9825-b533e276b0c8", "value": "393216:YJSSRC8g954fV7n/YQ/toBGBUokPNXVu/QhDbzFbSx3TKBHfGM2a8Z:USSRtgHQFOBGBUxPDMQ5FbSCfGPdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785559434, "uuid": "1196744b-df22-4695-99b3-bd225cbb59a6", "value": 17833552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785559434, "uuid": "9c610858-4b8c-48d1-b546-de6163259c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559434, "uuid": "2e325538-5fa6-4b71-9266-cf62a4006443", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de06a5d9-8d86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785574581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574581, "uuid": "575f8ec6-a941-4d89-84cf-8f10ccd2c7b8", "comment": "Malware payload (Mirai)", "value": "dd06f167be5312df202b575aa10e60e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574581, "uuid": "7aa96815-8892-4ff3-abb7-e32796e6407c", "comment": "Malware payload (Mirai)", "value": "604d7806669366b3d39f41f0146c4ab61e91062c528534faa3151b45f5f643f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574581, "uuid": "2d46ed6a-23e2-41f1-bfae-f71f3d9be705", "comment": "Malware payload (Mirai)", "value": "909813b69124159231a332e2a5914c40c7517709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574581, "uuid": "eae9627b-983d-4c58-b94a-ff12faee8486", "comment": "Malware payload (Mirai)", "value": "6740810108b199b4b5bc85c431f3c710c29bd20aafee29d5dcbc1e022052dac8f9d6b205af50b2ef14d2ca1707472715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785574581, "uuid": "95e94647-7cd6-47a0-8ca7-0982c338313d", "value": "T19C4302C0EB6EF9F4EE4629BE3A951493BA7B6DB051953073C91D49081EBDDB310488C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785574581, "uuid": "523f6b41-2ce0-4818-9082-04a77c72cfbc", "value": "1536:iAEA0O0UTzZ+dywuQwzpLgP2cvwZ52gxe4JiwRrPILR:i388dywuD2P2cvwZ52gsA5wLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785574581, "uuid": "85c00f04-d5b8-40be-8c0c-4d6a2299eef5", "value": 55524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785574581, "uuid": "6e360384-4bf3-4ac6-9f30-992258b2a906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785574581, "uuid": "cb992056-890e-4d76-8673-95a85ffc0efe", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47ddebd-8db3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785593812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593812, "uuid": "ee6e3664-d343-4068-b91b-00d8f72813e2", "comment": "Malware payload (RustyStealer)", "value": "7fdad15d38c44af4039bd440ec83b6e0", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593812, "uuid": "3bedc0d8-6b4e-41d9-9034-acb92c2e853a", "comment": "Malware payload (RustyStealer)", "value": "6167be94c33b2a86f9820cbc1b901700cf5d690193213cb14f44687dd4ed4e18", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593812, "uuid": "b7256b52-a96b-4532-80c4-d5bd4c86d7b5", "comment": "Malware payload (RustyStealer)", "value": "4eb4232bee4b5502a1ded712ef3d45b5e553d240", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593812, "uuid": "655f93f3-9b0f-4c4b-9e8a-cf015b4cea44", "comment": "Malware payload (RustyStealer)", "value": "3a344f51be8796f1881b0533513802978f7d4d3c53a243383483ed6355624fce47f737932b80e695813efd1b5decdaf0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593812, "uuid": "3a6e112d-d925-4556-b01c-4cbde9675294", "value": "T1DA3619117A6B98BDD19AC4B483464A735E2274CB0B36B9FF01C452393F6ABF02F2D615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593812, "uuid": "ac921681-93a8-4d5f-8646-a76e33d1b5e5", "value": "160fbdb81ce4965fa57cff73b4673255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593812, "uuid": "50c59eca-1d47-4e2d-a8d7-db576420e01f", "value": "49152:Mu/ggdwof3JeNoooGcnPsrrdbWTsTBwr2yDgGuWFYVQYOOFekUHdw6trL7bS9gCl:+gdwofZedwsTB6+3W89gCJ+imlfmH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785593812, "uuid": "490bd980-71d5-474a-8560-6284bc1de4a7", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785593812, "uuid": "ebfb9e92-0dce-4015-9183-a5fa452a7739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593812, "uuid": "b26f7e16-3db0-42b3-9b2d-40f10baf34dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08864ac-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545326, "uuid": "819ec86c-3764-4d91-b868-d060c9a8ae8b", "comment": "Malware payload (Mirai)", "value": "cc96df5b97062ab0c07d7615fbc69af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545326, "uuid": "ffeb90dc-2edc-4b0a-b73c-48736d1e517a", "comment": "Malware payload (Mirai)", "value": "61719f2880a07b5387e3717b1bb747feb715b8fcc0da3d06a9aa401c2aee3c2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545326, "uuid": "7ca68961-c5c1-4382-9016-b4e8fa51007e", "comment": "Malware payload (Mirai)", "value": "7990fa762904d4822a5c313de9577dd35a2bd9bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545326, "uuid": "d7629e84-0726-48da-8d0c-b7cec55964c0", "comment": "Malware payload (Mirai)", "value": "5daf5f32d096678a6e173cf1513ca15b426ad7d920e945de7bd2f038aa46308b8df707236063b6cb6389af0d924d6638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545326, "uuid": "82edecdf-541f-4c1f-96e2-f8fd2b428de5", "value": "T1A48318C1BA4BC0F5D90748304067F33FCB32D6394061D66EEFAADE65EA73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545326, "uuid": "38e930a7-71d7-4c85-be03-d7e4e5ba5a49", "value": "1536:8l8IhK59kLMSb6kbzdWAc6HWiay3Tx9gorF6ShJ0l9:8/hU9ktbjdWnpwTx9dral9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545326, "uuid": "48646e58-5f7b-4202-ac65-ee9556a3f19a", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545326, "uuid": "91f932ad-ef03-4b3e-a40f-b5e3ca5298b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545326, "uuid": "50bad2b6-bc8c-40ce-92c5-101880b31be3", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dce0e6-8dd6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785608959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785608959, "uuid": "52edacfd-0010-4f6a-84e7-14702f0e288e", "comment": "Malware payload (Mirai)", "value": "214336aec86014f9a95d36f169f27696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785608959, "uuid": "caa22169-5b82-4f37-a917-6a4cf3523615", "comment": "Malware payload (Mirai)", "value": "61b3c3492c341bd8a613e01bd9dad388ea8ad691567ff5754528f8d52340b538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785608959, "uuid": "54427991-f1dc-4daf-a60c-f42d5eabb4d3", "comment": "Malware payload (Mirai)", "value": "15694c9adb383868847ea4dd69d9a7543f862ed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785608959, "uuid": "0ff3cf03-b51f-4c38-85df-39681ff71553", "comment": "Malware payload (Mirai)", "value": "902c6c1d10064b0b905df40667e2877f92a753fda44d7f6b0f70101bda06aa773b2cbbecd51f028d10a1260e7d53caea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785608959, "uuid": "9627e6fb-b048-499c-97c0-7e7fc0781f9b", "value": "T192355C5AF2B3B0BCD027D03047DFDBA2A835B47911216D7B36C49A352D61EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785608959, "uuid": "35d4f2f9-3516-46ca-b116-5200b005f9d3", "value": "24576:WyZrMasiqWqkjDNeL75GMKuPQrwwN/O604I:HlTsBWqkjDIFGMKuIkwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785608959, "uuid": "bc349317-1daa-4697-9b7d-707702e435ff", "value": 1135792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785608959, "uuid": "57d41ca1-2934-43a8-a7fc-5887e53334b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785608959, "uuid": "ab6b5c2f-742f-441f-a79c-db901b6afb67", "value": "61b3c3492c341bd8a613e01bd9dad388ea8ad691567ff5754528f8d52340b538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870d4f74-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785613949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613949, "uuid": "3f3282c7-e035-419c-a11a-39cffd2f1916", "comment": "Malware payload (Mirai)", "value": "5a50ec64d8d5d88df06ecee7ec345232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613949, "uuid": "9ba6e1ab-b389-40ae-aa32-e6f45471abda", "comment": "Malware payload (Mirai)", "value": "61be385ebdd59a6619c06b1c2f0841f16377b10785d4e8d3cecf8bff96382570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613949, "uuid": "8bf41b67-ab18-444a-ab1c-3287e3fd29a1", "comment": "Malware payload (Mirai)", "value": "e439f1d2b8e716fdb197ecc319a425eb7c71bdcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613949, "uuid": "0d06b8fb-279f-4a50-8186-b435fa1533c3", "comment": "Malware payload (Mirai)", "value": "3212180b3cccb7e75f04d8db4d35d7ff9068c243ad013584d6f960b2d997235ea14449c0137d28f1414e1a7f59c47e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613949, "uuid": "49b0c887-d452-46ce-b25c-990cc28da77a", "value": "T17DB3D90E6E219FBDF768823447B74B25A79923D63BE1C685D16CD6041F7024E282FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613949, "uuid": "71f6413b-592d-4ac4-87be-504b40b2c51f", "value": "1536:Gyk0zen8UGVd2GFXgFtb1cH1hEjRgOLkoUlpHoeKhoVdjqxpOZ:EkiOP9gNcQjRxLmltBVJqOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613949, "uuid": "93dc7ad4-08b4-446e-9064-4202151536ff", "value": 110204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613949, "uuid": "e9566b4f-50dc-4f38-9cae-6351d97ac541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613949, "uuid": "f39accf6-a4c8-4782-b5a0-c81836070b54", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a37b8b-8d4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785549153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549153, "uuid": "83436c92-8621-482b-aa8b-453a81950430", "comment": "Malware payload (Efimer)", "value": "9cc5822efd55adba42794e38c9926368", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549153, "uuid": "fff030e3-f037-4ad6-be19-f173ecf0be81", "comment": "Malware payload (Efimer)", "value": "628e33326d90400f5921db3d3d07d0b10779961a5ca5660a5689e65c0c6ef6c3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549153, "uuid": "3029de88-2e8b-4557-897a-5cc80cc824b6", "comment": "Malware payload (Efimer)", "value": "5d47b8ecb38fbbb6b5efb828fa2f8f5279972c03", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549153, "uuid": "36a408ad-c572-4fc3-9a06-42a56921be60", "comment": "Malware payload (Efimer)", "value": "770f0846e07f0b959a9af2afb290005def867f8bc21aa97250450222872615571d0b0a2a826d8fab45b756eb41cfc258", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549153, "uuid": "e9769563-95e0-459f-8fed-bd7093ae4378", "value": "T1F3E6338CEEF011EEEAB3913DEDE105A1E665B8762374C5DF061986A17E133E04C39B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549153, "uuid": "6cf357dc-c810-4ac2-9e2c-c6aaedb85183", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549153, "uuid": "07354fb7-0ec8-4327-8255-34bdcf1b7274", "value": "393216:gFVaEc5cy3pxMTfI7tiXMCHWUjEcuI3/PGTAI:g7TmBJiXMb8RH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549153, "uuid": "703a1aa4-99d8-421b-92ec-58c298a6490b", "value": 14313847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549153, "uuid": "e0e67969-ef81-4f73-a583-ded139cc5140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549153, "uuid": "51db68ae-393e-4e06-8dc0-f942ddab3e7d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9096e01-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785614033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614033, "uuid": "1f7d4268-0845-4577-8199-66c053b8dba4", "comment": "Malware payload", "value": "3493eb7c08fda4e4a9da10120706f5b7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614033, "uuid": "31f9a3e7-0473-41d1-a6c0-38e9b7c37704", "comment": "Malware payload", "value": "63b0ac72171150804e00d64c5ecb209b7347c68db5aa8a7f97c965abf5f5dad6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614033, "uuid": "04cdf835-ecda-44d3-8991-8e5b43447633", "comment": "Malware payload", "value": "4a2fd237aaa0bba208e2e277a36859710e8616ed", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614033, "uuid": "d30118cd-564f-449d-9ec0-f925e9dbdb3a", "comment": "Malware payload", "value": "536e62df29d4c11699c9afc22e948c65e1017c18b93945ccb941948f6dc081bfed7e96806f763e91d608c341b78301f3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614033, "uuid": "680d772b-538d-4d19-b5f9-267d819e0ac2", "value": "T1B14633AB472A3759D8916FB4478E55332FE04E728C4C5B8E3A5DCFE90D9D3B0540A8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614033, "uuid": "b5b79b39-7baa-4b56-be55-9ec617b5143e", "value": "c940abcc608de321832cfe40e6eca329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614033, "uuid": "3316d6e2-36f4-45ab-b74e-73e5560c0327", "value": "98304:1715UoPOjalZfn4HUwb98JuRlb9M1ewVDOYKJ2ntunGADSHMavmYQi3MG:171qoPlZfkJA+ZEewROX2tz63k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614033, "uuid": "1d731675-118d-424c-bb2d-12f2bab6ac60", "value": 5881616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614033, "uuid": "61a20064-4ea1-4833-b2b1-0d5d330d9840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614033, "uuid": "e05e75cd-1e82-4f30-803d-43dcff894887", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e07a792-8d7e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785570796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570796, "uuid": "0ac65a76-89e1-44df-b5b6-43c53bd87509", "comment": "Malware payload (Mirai)", "value": "de9857c5a0657040a78698e6257ae15d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570796, "uuid": "58dd6db4-9838-4cae-a894-226c03221c4f", "comment": "Malware payload (Mirai)", "value": "647aaf7e6621d2c6bea078aa0f3238892deea798aff553143310550a93400327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570796, "uuid": "aa9f07df-753c-4669-b1a4-66dd57cd5f4f", "comment": "Malware payload (Mirai)", "value": "0f40c45b8c765b87286bb4d5b68e8a6310183cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570796, "uuid": "90918e40-c3b9-4391-b3e2-737bcb68028e", "comment": "Malware payload (Mirai)", "value": "2f807ae24283a29f82f9cb2592d0ac1eae7f8ae2406d16e2599efc669d1b5aafe12bea433bf1f858d58684eed9847e3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570796, "uuid": "a2af2a82-dbad-4d15-bb09-289698fd5e72", "value": "T1D03302E0A0A1175BC7F52DF3069167C633F1890C6AA0ECDB4AE4ED5684920AB7B15CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570796, "uuid": "5924beef-3248-4263-a7cb-bcff074bd87b", "value": "1536:DWNRPrDox6Y4prwGOmiJ+2WkaVjOiFjYJxUdKub4u+qgw09t:DWXzDWVGFWVWXdOrOl4u+qgwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785570796, "uuid": "2735005c-8c96-4fca-a1c9-a618c43606df", "value": 55000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785570796, "uuid": "046760be-6973-41ce-bf1b-0bf923176dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570796, "uuid": "5023b7e8-31e9-4e9c-85c4-d0f49111d450", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1b5034-8de3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614363, "uuid": "4904f7a0-9508-475a-ae8e-b41eba694b66", "comment": "Malware payload (Mirai)", "value": "4703354b42f6693f6c59ff39b9ab1a28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614363, "uuid": "ed5714a1-d52c-46a4-9764-3f6cc1582355", "comment": "Malware payload (Mirai)", "value": "64843be906b31812bb1fdd9a4789d91d7ef041e4822a80a84b708bf718051453", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614363, "uuid": "11ef23eb-1c6f-4bc0-a50e-8814c2c9ee06", "comment": "Malware payload (Mirai)", "value": "a6a6689844fcfc99ce665a04d011b68b82f57e69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614363, "uuid": "95dc8f35-d1f4-46b3-9a39-68b6489a8c60", "comment": "Malware payload (Mirai)", "value": "65366f923e51e4ec249930fcc8f83a7fa1424619a55eb042739029d805ff0b8c52c8e0579ad1c287c664112f3c6d62dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614363, "uuid": "a1462cd3-e2fd-4ec0-b221-199a216c168f", "value": "T1BEB4C08663023D3FE0B3893A80EA4F17A736D784558327473169F9696913AF86F316C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614363, "uuid": "abd48e6f-cad9-41fc-8167-496e6b8196ed", "value": "12288:OMXhrdnYE1p2CluL+m6XAjR1JKMNB5VLhVB2:OSdYE+Flmin3V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614363, "uuid": "e8d3eec3-3185-497d-98ed-cb3fe38d3edd", "value": 509924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614363, "uuid": "33e44e3b-cbae-44a5-986b-6a1e67540b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614363, "uuid": "de7b799f-5037-4e7c-88cd-09e83311b1d8", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d386ae-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545246, "uuid": "543691c7-3d22-478f-9904-49c9e3c54127", "comment": "Malware payload (Mirai)", "value": "3eecabd8efd4499a6f3f3333092743ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545246, "uuid": "0d7a8efe-3d7d-47ec-97f9-ff31793a5967", "comment": "Malware payload (Mirai)", "value": "6493187665a905b9b197e0c31b25fbcd5c5b6e6bb0a5da8846aa46c441e406e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545246, "uuid": "e939b3e4-a35e-48d1-9b2e-83508a94b414", "comment": "Malware payload (Mirai)", "value": "5013cc9b4e723a2e0ae68d1b40931739b1710608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545246, "uuid": "cbc7e464-a730-411c-9b5c-75ae6273c90b", "comment": "Malware payload (Mirai)", "value": "855ce74497fd98ded5dd3548c4c5cc5a1bf457d1f531a784e343e7628f728f9e410013b56009f44dc300ba3f89ec2566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545246, "uuid": "3a9b1ea3-f0b1-4dd6-a758-dcffece3967a", "value": "T12143F143A165B82DE5A7BA362A3C1DF8D9A33841B309514F319AF77E46630053FE2F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545246, "uuid": "3ccb30e5-bc78-476a-95c5-40d0fd1a0835", "value": "1536:BhSJMeLONyVvtBXJx5SfpruJEHmREss65JfVqleIWkrR:B0OotBXjqr8SsjX3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545246, "uuid": "09a94932-2430-4a50-9199-fe8272f664cc", "value": 57580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545246, "uuid": "823277d2-89f7-41e6-8da9-59c49d94e569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545246, "uuid": "674c22dd-c161-420f-b6d3-6828c75bec7c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f323d7-8db4-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785594006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594006, "uuid": "fea1d1c7-b316-4748-944a-dc53df795207", "comment": "Malware payload (NanoCore)", "value": "35a6cc6e2b588f30f7fb9cf4638ee632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594006, "uuid": "d0d9bc1e-99da-46c7-82ba-844b990172c1", "comment": "Malware payload (NanoCore)", "value": "656a0518875d72b0cce6b288cb71d13cc0b6afc3e45cf9b578b9092a3f7da2bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594006, "uuid": "f6bf7ec1-5993-4a87-9e82-4b11fd36d9f6", "comment": "Malware payload (NanoCore)", "value": "8babc0a84bbb86bcdb697474595773bfb630869c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594006, "uuid": "2bb080f2-d20c-4bbf-8829-5a6c94b6d941", "comment": "Malware payload (NanoCore)", "value": "529fb23297af9d26a15fb433264f5d0e2820daa131c16473029b1e2003b03967e1d942a73329e77d01413084fdc5d03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594006, "uuid": "803f25d3-c096-4c93-8d80-6656c2ecabc9", "value": "T10214CF5677A84A2FE2DE867D612212169379C2E39CC3F3DE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594006, "uuid": "11617d49-3927-4c8a-bb62-21629a5dbc05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594006, "uuid": "3e475453-e4e0-4c23-86f6-04b64b866b98", "value": "6144:sLV6Bta6dtJmakIM5u6V2qhLyNPYTbEjc:sLV6BtpmkJM2uL4YT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785594006, "uuid": "6749bcc7-7d02-4b6a-8728-dc70258a2273", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785594006, "uuid": "3e073631-7964-474c-9b1b-ca6a70ffae43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594006, "uuid": "e4f0be21-9883-480e-a924-cffa59e1cfb4", "value": "35A6CC6E2B588F30F7FB9CF4638EE632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6191eb-8de5-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785615325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615325, "uuid": "1cf2fa5c-d7dd-4a4b-bf18-d1cc5ac46033", "comment": "Malware payload (WannaCry)", "value": "4eedba281d6273d442925536aa61b3df", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615325, "uuid": "d1ca2bd9-4cb4-48c9-9d3a-b2d5ac9058f1", "comment": "Malware payload (WannaCry)", "value": "656a5cf0c4ea3a166c813b24dc4bce8403afb4305504805d654764712caf5a96", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615325, "uuid": "67c52da5-8f2d-4741-a18b-bd3c19f7cd05", "comment": "Malware payload (WannaCry)", "value": "5961d2b84eced872ba81a0a270b0f7a49dddab7b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615325, "uuid": "02e9561f-2d75-41dd-b821-6ede4bad73eb", "comment": "Malware payload (WannaCry)", "value": "5bc751e011abf58b6174e1c3163072d21883ba05b191e9167325e91be1e80bb69033a0610b2e69fb62bd366d26005e3b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615325, "uuid": "45081ff9-4190-4384-9d38-2c8b41670133", "value": "T1D136235631A8C0B4C003557488BBCE12F6B67C2A17BA694FBF904E7E2F23795E715B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615325, "uuid": "f556caf2-158c-4ea8-9ce8-7ad47f612986", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615325, "uuid": "9a42b66d-a853-4188-a4da-a607ceb14f55", "value": "49152:jnsnpEjbcBVQej31INRx+TSqTdd1HkQo6SAA:DMpUoBhT1aRxcSUZk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785615325, "uuid": "6f30745e-5a97-4bc5-919b-76844604932e", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785615325, "uuid": "6fe44694-f4d1-408f-99b5-bf47e4deecd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615325, "uuid": "775ccbc5-29bd-44a0-a315-d8b265c3032b", "value": "656a5cf0c4ea3a166c813b24dc4bce8403afb4305504805d654764712caf5a96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25fa9df-8db0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785592600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592600, "uuid": "60bdc482-f01a-4c78-8645-0d240ace9216", "comment": "Malware payload", "value": "056124e5350c452e158dd93a0dea88a5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592600, "uuid": "eea6c815-45cd-4872-8042-f58d08fc9e80", "comment": "Malware payload", "value": "65873caf0e59b84aa71757a91cebad162c8d88c4f4a55b96affa10717118a0e3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592600, "uuid": "f3bbcba7-4568-4f3a-a6df-2226e399f86a", "comment": "Malware payload", "value": "3c0c60baf962582cd74883db301c75cf655e9269", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785592600, "uuid": "0534086c-6e70-4500-a262-d979c07fde62", "comment": "Malware payload", "value": "03725e1337c649a3652b5e20c5ce9bce20dac3ec43f74b2b4180679314a9e95cea006e1fc3bf8afd5022646a7c7d7053", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785592600, "uuid": "c3b0af5d-fffe-4353-9dda-9e103900fe01", "value": "T193236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785592600, "uuid": "ec2afeb2-6885-4487-9270-dfce63b6c02f", "value": "768:PXRWNGxV69GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:plxVcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785592600, "uuid": "dd9accba-bf99-4031-984e-1aad6047e9f2", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785592600, "uuid": "fd9fc029-a47c-467c-904b-87a8f7270a2a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785592600, "uuid": "fdffc9d7-6f0d-40eb-a5d1-965cc29f3157", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54afafc-8d65-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785560420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560420, "uuid": "5fd4eff9-6815-4128-9e8d-e55826140490", "comment": "Malware payload", "value": "5fdc33ee75e490d1539e33a55b296a92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560420, "uuid": "274273ba-99d1-4750-a75d-68a1d313d295", "comment": "Malware payload", "value": "67364728499da4cac3f3907de51ccb2f78b9baa403868e492e00b42f114f777f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560420, "uuid": "d7c5642f-3957-440f-b22f-9088ff850062", "comment": "Malware payload", "value": "5a2d5c93e26b9ed3548b9e33f4551e49f7a595db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560420, "uuid": "1c45a458-5ee9-4003-9161-0737cc234014", "comment": "Malware payload", "value": "dd7d83eda233039a5b21ad5fdc0fa6d92765369b861b89d9b5505515223e81dea853058ac4fb578c88b418498137504c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560420, "uuid": "23051efa-1af0-475c-a17c-1855547613b5", "value": "T10737CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560420, "uuid": "556d9e09-88fc-4176-ac1b-247218b64dc6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQd:cqYUQuVDt0TZES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560420, "uuid": "ab4f7496-7e38-42b6-a0a5-13b2a778216b", "value": 23396352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560420, "uuid": "3c451339-b7de-4e07-9810-3510e36d9e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560420, "uuid": "88e9bb54-7544-46d3-9777-d31001228679", "value": "67364728499da4cac3f3907de51ccb2f78b9baa403868e492e00b42f114f777f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ae29bc-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544819, "uuid": "0006cb99-1de8-41ec-94a0-e84b5bfa2a7f", "comment": "Malware payload (Mirai)", "value": "194f5735b6a66dfcbf29840c30f13025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544819, "uuid": "534ef1a1-ca6d-4eb4-a213-2d728ef2178f", "comment": "Malware payload (Mirai)", "value": "6764fb212852e563b0e5e32966f60d05e7e0277cd0e526b32d4c976647372578", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544819, "uuid": "7b249c8b-18a2-4ce3-a31a-ac32f10546fd", "comment": "Malware payload (Mirai)", "value": "b9d02433318fd36416006458ae135c3e0fafbf34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544819, "uuid": "fb145260-182e-424b-8062-a8877a34d5d4", "comment": "Malware payload (Mirai)", "value": "6d4c1ffc00cc6fa94d6aa283305b474c4f9430f54b9df9585a1e0d2a79c44c5a67714368accaf81567fa9014357e66e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544819, "uuid": "28f543b2-9042-4da7-b257-54e6429fd2e1", "value": "T1FE13E0ABD137EC32C477B6719B4E4390FF3A2882AA7196AB0D4D19FC090788ABD55704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544819, "uuid": "f12fd812-fd12-490e-851c-3a4f47da1d7b", "value": "768:dA1khiEVA0waLOirChqyXKe27OarICuNCr3BGkD/Nxx233AYx0Qb:dOEVJy0iB6eOzr9zckJxx2RTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544819, "uuid": "ba420266-64b7-4781-a433-fc42f7e155bb", "value": 42820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544819, "uuid": "59314499-d214-4e70-8a7a-02bccda949dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544819, "uuid": "9c8d4c65-0e7f-4925-8613-e39778cff19b", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a63316-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620422, "uuid": "0a03632f-e7ea-4b9c-8cbe-0a19a50fa2c2", "comment": "Malware payload (Mirai)", "value": "5cc8797bd4ab7b95dd49597c9beedb38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620422, "uuid": "29751f16-9147-41fb-8bf9-ae426eefcbb3", "comment": "Malware payload (Mirai)", "value": "6a00a3ee57c422c99756ab88a631e5109e8fb9c86a43c8788067fcc2e2557acf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620422, "uuid": "93f2628b-77ee-4f52-ac82-f5b08eaf4601", "comment": "Malware payload (Mirai)", "value": "9318092ce1ce8f5a9c35eab37b0aa2a4c56073fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620422, "uuid": "3bb04a11-fd71-48c8-9471-940d653b5547", "comment": "Malware payload (Mirai)", "value": "e978a42561bbd48baaf32cf22c26ecb46a1d644ca303943a37804fff0bb3b698ccd4fc37e5ab590f4a83e9b62e71feeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620422, "uuid": "b5cd4665-ff95-499b-b1e4-9c0cb1527740", "value": "T1F0C33CCAB802CE7DF90FD5B644634D0AB935A3A156C31F26625BFDD3AC321A4BC12D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620422, "uuid": "0f606e8e-77de-431e-93f6-f9fe0ee46865", "value": "3072:WNU2AOGhTCK2b1YUgBUqzh3H1NWxM/R/Lpo:wUTOGhTCK2lUFV3VNlR/Lpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620422, "uuid": "b5138e0d-5a05-4fec-b255-ea7476a0603c", "value": 118728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620422, "uuid": "4298077b-012b-4c65-8bc2-99ab3fed0cff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620422, "uuid": "50e7acbe-8aa7-4afc-95b6-c300ab9757c2", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8392888f-8dc8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785602776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602776, "uuid": "0df74ea6-8e37-484d-b0e1-d11b9539a476", "comment": "Malware payload (Mirai)", "value": "e623abf1eb0262289b6765648c3afe0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602776, "uuid": "48078e38-4a9d-4458-808e-95b0cb02b5cb", "comment": "Malware payload (Mirai)", "value": "6a4ea4856f3869b9c9fdde112be8cf1dfb03f7bb37b8cd64e974367aac64495b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602776, "uuid": "1b070a4f-d3dc-44d8-bbd9-4d19c6632486", "comment": "Malware payload (Mirai)", "value": "369291e550bcdfbebb58bc7ceacc84f2991090a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785602776, "uuid": "4190c5d3-1b49-4e7a-9e58-9b730ef08cc8", "comment": "Malware payload (Mirai)", "value": "02a70a446431ae715743ab23aae14361d6e917e007f8446b44afdc1d469d794e63ad36fa4c743a49ebf44d9e37aa5e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602776, "uuid": "6212aa42-3e32-46d8-bbd0-d9626dc18122", "value": "T11494E09AF7572E42C8C7867518C64146574DE59B33F393463B43AABB38293368F283C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602776, "uuid": "72c3c7a7-d1d9-434e-9035-4334a1748821", "value": "12288:kWziCjLXECA/WfkxbwWe648XDH8pLB/3:thW4kVw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785602776, "uuid": "af746062-dee1-4abc-849a-720e2fdc62be", "value": 412028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785602776, "uuid": "4e9c7f59-390f-4019-820d-787011bb5a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785602776, "uuid": "1e7a6887-e6d5-4de9-b5fb-f73c43c214b6", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea20b5cd-8d46-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785547114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547114, "uuid": "decaf181-039e-4c23-980b-199549c91e0e", "comment": "Malware payload (Mirai)", "value": "5a421ddb5ac8c7c312dbd021e5e06620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547114, "uuid": "b2b7e60e-9004-4542-80c4-323a1e300362", "comment": "Malware payload (Mirai)", "value": "6ae2d6cbbd86fc97aaf932ed79fb683e2d08abe278cd10d9a634d6be20f9946e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547114, "uuid": "3b8dbdae-b407-4022-9868-5eaf95f0eec1", "comment": "Malware payload (Mirai)", "value": "7e2b23096ed3853d077ed0d1a071114cbe6735e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547114, "uuid": "2fcf2ea2-ea6f-4631-ba94-1375e2e851af", "comment": "Malware payload (Mirai)", "value": "4f2d753c87121afb785bc9501a5d9bcda616ae13d9fb1da5a617913aecac440cfc21e506d76dd65d95e24324a04cc637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547114, "uuid": "6bae57c2-305e-4c5b-add2-f8e65274e22a", "value": "T1AA04E91AAF510EBBCCAFDE3701E90A0635CCA55722A43B353674D524F54BA4B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547114, "uuid": "eaccdc7d-b79f-4463-8a76-1fff587bd540", "value": "3072:hdaIa6aKWyE0fKasTT53cZnnxOMQHFL3HFN7g1asTLJ:DaiWhBhTT5sFnxOpN1cDTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547114, "uuid": "f0d64a77-7f16-40c2-9c72-a12770fc98f5", "value": 188496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547114, "uuid": "528d6fa9-74a2-4053-b6fd-62aa1017c702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547114, "uuid": "f5ba7fa8-a715-4df4-b7d2-f7f5de0cd361", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46ca496-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620467, "uuid": "c9e0faff-96ab-4c0d-9560-fc989da4bf20", "comment": "Malware payload (Mirai)", "value": "b55fc8d86c12d0884c70904c4d9b4636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620467, "uuid": "a715e99b-ee5f-4e79-a61d-13366c3253ce", "comment": "Malware payload (Mirai)", "value": "6b1dbf4c55cf3de6a9954f1ed4e7a7a5c7d08e2af684bfbe1f7c57f510d52bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620467, "uuid": "cdb1edb9-be47-49d4-a2cb-ba47a6687ddf", "comment": "Malware payload (Mirai)", "value": "23d0fd27451b43b14c0e8f26df375501022184ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620467, "uuid": "50c61392-5ee7-45a1-8244-7375bdb4c128", "comment": "Malware payload (Mirai)", "value": "fe4f060d5e3a8cd4e0d3dbf82dff7f65f7d8719846d28269067e548bfcc4c09fbe91677c9e0313b00781116a240a714e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620467, "uuid": "7624d032-03f7-4d99-b906-dbf4728b9fa2", "value": "T1DBB34BC0F98B81F5C40B8C3061A6F63FCE32D5A95271CAADFF969F32DA776019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620467, "uuid": "2f7a773b-6bc7-4933-984f-d645b2ab5407", "value": "3072:g8iN7p8KcnM5NcN4IV6OZzRxmzsrGegptWsRCGA:ct8VnMvcN1RdrQYPGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620467, "uuid": "584d3ac4-36bd-4b80-897e-066106d89fdb", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620467, "uuid": "e2193cc5-a999-47eb-973c-8494a7595f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620467, "uuid": "e6aed2c4-aa02-4497-b5d5-b1ae80ee9f72", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abdcaa9-8dda-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785610465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610465, "uuid": "091d6e58-9daf-49c0-ab3d-298e203b3481", "comment": "Malware payload (Mirai)", "value": "c067925844692af1c85b34af81016a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610465, "uuid": "e5ef1a09-ee0c-4fe9-bf1a-d7147b86f01b", "comment": "Malware payload (Mirai)", "value": "6b659aa475b4a9e6b12cca0a09ba66b207226ab904754c4f3080a91eda00f48f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610465, "uuid": "5f142a0f-f70d-4202-9655-effc803fcf5c", "comment": "Malware payload (Mirai)", "value": "12dbfe6d9acf7a528e437fe55e1920f859dfb185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610465, "uuid": "a81a9de3-a050-449e-bdb6-e5ef1b4f2104", "comment": "Malware payload (Mirai)", "value": "33577e9c40e3fc10253fd8d0f546b77a89db2b05c260931883423d7d558c1e346c68e8d8652dccc5acb1833f0506468f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610465, "uuid": "f09aa146-297b-479e-b778-9f9b1a2c978e", "value": "T168F45A82FF1C0563C9570DF0293E43E5F3217A9240F98239371E5B572622E76AAC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610465, "uuid": "60848eb9-2c39-4f16-8af9-cd77f16f9ed2", "value": "12288:ilnmKEVm7gNYIosWSjigaKpZcGuyIFhuI1EODpepTTS/Q03:mPEVm7gN2SRaKsFhhEfSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785610465, "uuid": "e620c24b-7426-4dbd-bfd9-5f31d5f2e4d4", "value": 726984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785610465, "uuid": "39d6b262-b8a4-41ac-be64-0ebaabe46432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610465, "uuid": "08f77115-e5af-4129-a2d9-00ebab93fdd1", "value": "xd.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73f15b2-8deb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785617976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617976, "uuid": "5c188ee2-7f23-466e-8c8b-72cc28d0b36b", "comment": "Malware payload (Mirai)", "value": "3cd8ca3330c7091d2eccddb62ec35f02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617976, "uuid": "4651b766-4ef4-431d-afc3-e68d097bae2f", "comment": "Malware payload (Mirai)", "value": "6b8feb51321989fdb320c51e40f7eb702d81f28ce622fe5e5b1714c18c7758cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617976, "uuid": "9fb09e90-07ea-4e83-abf3-297170d6cfcb", "comment": "Malware payload (Mirai)", "value": "e3b4ddc22e6e78fcb10de0597311f3953e2b30c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617976, "uuid": "72d64499-0b08-476e-9cb6-18a4164ca09b", "comment": "Malware payload (Mirai)", "value": "83ff5ddb216e181a194a75612d4f5b7bb364fc350c189633874a97ff051e7e6a1e6776b83d89af2dcafb7e5bf7b1aab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617976, "uuid": "19f8927e-d4bb-41cd-882e-3c2a04b4dd9b", "value": "T1A3737DC6A643D4F0E8520572207BFB335673E53D006DEE87D379A936EC12641A56B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617976, "uuid": "714b78f0-4071-45da-9be9-de7c2457bbee", "value": "1536:HEbr/QrdqjFK+Yn+FDaCfoO5jFee3JdWx4nV1TI5K1JDvUX4:kbrIJUK+W+FD/QOLee3Jd+4bskUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785617976, "uuid": "4f6f72f8-76cf-4aa0-955a-54a4935506b3", "value": 75344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785617976, "uuid": "d4e147fb-f0ac-427e-ad7a-92a227b739c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617976, "uuid": "bf987c16-ad6d-4ea7-bcb3-b2b7a4499d5e", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a883971-8e04-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785628396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628396, "uuid": "c24b0125-0acc-47ae-ac99-d27428178bd7", "comment": "Malware payload", "value": "eef744fd80a3520d1c67e6eb98f091bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628396, "uuid": "d0380dd2-4de9-42b8-8077-a929b29df159", "comment": "Malware payload", "value": "6bcd0a97bb8c444b66e686e2bceb32cccf4090f13b6b5ed778c0341e31fe9d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628396, "uuid": "62712274-8c72-4592-aa1d-18846b25586b", "comment": "Malware payload", "value": "548a5108fef4d712e6e8ca26223be5aade0bf89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628396, "uuid": "58e91ad6-8112-4710-a94a-b23f37dec20f", "comment": "Malware payload", "value": "14629934939e3c9f51c2c64f78aa50057377eb8ae6667a810444d47ffb610fbf9a2761820d42534b10a7f12806d0d2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628396, "uuid": "ecb7fe0e-1b81-4e48-97d4-931bc8ce2224", "value": "T1A6E52398BE9A7671E033C3F783A728FD711A37908B648D5E35896B106D13428BCBB355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628396, "uuid": "99a14663-b7ef-438a-8c16-792b02f0e622", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628396, "uuid": "1871bde4-5f83-44d3-b906-fc4246c8d0fd", "value": "49152:xAOZA9sAXMRPEGt60S+6lCUiGj40257NyyDhl5KrDZADcTZ:uOZAERdj6NgJheBHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785628396, "uuid": "e828dd0b-f718-430b-a4d3-5a7efdcbc522", "value": 3034112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785628396, "uuid": "f509abac-ab63-4350-8bb1-4604c470a34a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628396, "uuid": "3310e88c-aece-40fe-9c8f-1fd7da650170", "value": "SecuriteInfo.com.Win64.Evo-gen.36984827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef8f81f-8d46-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546746, "uuid": "0c9fce04-88f9-4264-9b8e-e1ad54b2c7a3", "comment": "Malware payload (Mirai)", "value": "3b0e2d866047ce737757a09121ceac63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546746, "uuid": "cc475ed2-05e3-40f9-9236-6a07d53ab800", "comment": "Malware payload (Mirai)", "value": "6d99352ccf8ef3dec20ee396418f4963722c0d65bdc88924a0eea9a42be7e49c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546746, "uuid": "83c3922d-fbcd-4404-9dc0-5e2d63f8a74b", "comment": "Malware payload (Mirai)", "value": "358544fa703944d6c5f0643146e96c3790233689", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546746, "uuid": "3f36d9c7-03d3-43c9-bf18-c4b869492119", "comment": "Malware payload (Mirai)", "value": "a75a64e6eeda692c618aad7cddbce3a212e265a2d3d2c9b835ec3e631b5208a91374be9742b3f33c951a47abd49d5c2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546746, "uuid": "12e13460-6402-4fda-bd75-4cdb03c62e9d", "value": "T196C30649FD41AF01D5D635FEFA4E028933531BACE3FE7202AA245B2127CAA5B0F76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546746, "uuid": "5d599051-a50a-4324-81b6-17e4054188aa", "value": "3072:8gf375D/g1qiv166MksagAwdTej/MkXEbKZSpUQN6T:8W7xhE1NDsagfdTej/jqKopUQN6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546746, "uuid": "d46845e6-529a-4eea-93f2-55091aa3f1ce", "value": 128740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546746, "uuid": "7a5dc0e1-c063-4a72-8b62-6b94dfa2692b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546746, "uuid": "8f140909-de67-415e-bb6d-0335445b55cc", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38346a3-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620439, "uuid": "cbfac1c3-fcdc-4a5e-a6c6-020d02860c35", "comment": "Malware payload (Mirai)", "value": "9af1e4eac4f44502a28fb1667d804ddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620439, "uuid": "d2f45d76-63ab-4e37-a05d-399754cd44da", "comment": "Malware payload (Mirai)", "value": "6e138ffa34da0acfe1b6dafab090c200fbe923dc921db38051f9c98fbd006a78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620439, "uuid": "90ec279c-f81a-4167-ab9c-b26e8da1ab73", "comment": "Malware payload (Mirai)", "value": "4e76b10083d2d05863027b509638c8d4535e77a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620439, "uuid": "40b06bff-0be5-4b21-93fd-e13c3407b4d6", "comment": "Malware payload (Mirai)", "value": "7fe4f3ccc647b1c2a57e158562c1115e68b3f6853b921a4c3c7356b2e94ffa539eb261673e6b1149304fd163130dd778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620439, "uuid": "88a3f7f0-df96-45c9-b91c-db693a33ff44", "value": "T127C31986F9824A22D5D713BEFA2E118E331317B8E3DE72229E205F2533C651B0DB7955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620439, "uuid": "24029bfa-3e2c-4dfc-ac95-cd32edee116f", "value": "3072:Z2Eb9hOFrBlkrxsp7TCamqZT1cRySRlrF9sRT:Z2ur0rBlIap7GamSMySRf9sRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620439, "uuid": "d6fa4f97-6cf3-43a6-a15f-704cb9a72c48", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620439, "uuid": "062cef37-cbaf-4ae9-ac58-163ad14a4584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620439, "uuid": "5cde9f67-de9e-41cc-aefc-babaa0aba2ac", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c763031e-8d64-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785559940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559940, "uuid": "a2f0e9c1-30a3-49e1-ae87-e5e326358202", "comment": "Malware payload (Mirai)", "value": "e21e8ff8a639f3f9ec970549b4323570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559940, "uuid": "f577ebe4-03f8-4458-8134-af619e6b520a", "comment": "Malware payload (Mirai)", "value": "6e1b2f2a044dc785e951028298cf68f1eb08683a1c606a20beb086f6d89da693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559940, "uuid": "2ab18a43-c4d8-4c30-a869-e60003a9db28", "comment": "Malware payload (Mirai)", "value": "6ba59ed3ff34fe1bb89e19953e5011074ba8d063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785559940, "uuid": "a5ae8c63-8024-46b3-9d2a-2c6172086d4c", "comment": "Malware payload (Mirai)", "value": "89dfe64781110e22641b90c7c56f2d36a2438dec77411348e160a26df9c088d31a6a808c5b3fe753c552990f8aae4f0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559940, "uuid": "596060bb-56f4-4561-aecc-7ef0a2770bfa", "value": "T1A1357D5AF2B370FCD067C030439FDB62A935F46902212E7B65C4DA352D66E601B29FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559940, "uuid": "96902dbb-53b9-4c35-877e-0aca02d07288", "value": "24576:kMtaH2XPYP+yj/GZIeFTtxlCAPwp+6z8f+f:Hg2yj/GZtTtxlZPwpfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785559940, "uuid": "1f5ae624-d0bf-4eb6-b685-5835e3043355", "value": 1106480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785559940, "uuid": "b11fd990-1993-4d1c-922e-6312ee24fe16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785559940, "uuid": "a3676f5e-5c61-466f-b910-99155fb25ca4", "value": "6e1b2f2a044dc785e951028298cf68f1eb08683a1c606a20beb086f6d89da693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fd9eb7-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785547882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547882, "uuid": "fa7c05c8-2de4-4228-82e2-46d11d4128bb", "comment": "Malware payload", "value": "8b86395d8a22cd2a2c1390152967eec5", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547882, "uuid": "9d27c052-0b22-4bdd-8c33-fac112898077", "comment": "Malware payload", "value": "6e67cde5f83e4a64ba7a626f46240979a840163e1595b7219ee850fac6826444", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547882, "uuid": "ab101823-7fe5-4bd2-a7b7-a8517780a3f2", "comment": "Malware payload", "value": "0f2610beb966308b2724d4e92b7d80a2a061a865", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547882, "uuid": "db02ff0b-a97c-4bc6-b21f-af7a32f1656e", "comment": "Malware payload", "value": "94d684b2d095a8d620e1fde04d9cc6cfbb5e7b96e958ef730d826ddb7b3f8ac6c157a84d763d07d17596466ba6c2c1b8", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547882, "uuid": "a7ca12d5-2ff9-4517-8952-6f573a22f333", "value": "T1B0D5235A7EF229B8C83BC7B24E92F87D716977818B718D4736CE69008D229446C3677C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547882, "uuid": "7ba795f7-b184-4e47-aa8a-d330bb2f6354", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547882, "uuid": "8f52147e-4515-42aa-b633-0b6c5e3ea6f4", "value": "49152:6Yt35eXglox8v8XZotRBHCa8hu7DKPBP3mIxMeHSZc+Ta0mhtLBm/iQr:6YhKMo4via8hmDKptad6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547882, "uuid": "0526ba3f-802f-423b-8350-ae57d000a0a1", "value": 2990080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547882, "uuid": "6e49622c-e1e4-460f-aa40-446c3dc575ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547882, "uuid": "f57c7a8a-0072-424b-85cf-b964126c70f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d4588d-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620418, "uuid": "7f141052-0c38-4318-8829-40cf5234933a", "comment": "Malware payload (Mirai)", "value": "e7371b1b4175ee5ca1d1603d76b15d72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620418, "uuid": "50c031c7-8adb-49f2-a7fb-deb43881837f", "comment": "Malware payload (Mirai)", "value": "6e98a699aa04d16173a136629aa5df6f2e690c9f1292e433d4ea3a96fc27453d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620418, "uuid": "4fd06c82-7860-4cf4-a285-ef317345d2ce", "comment": "Malware payload (Mirai)", "value": "c96bdf957663c2bde6b8d9e3f3670462b15dc20d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620418, "uuid": "f1037c4e-d7c4-4dd2-840c-a54f8ef60325", "comment": "Malware payload (Mirai)", "value": "c4904e212a89c5ead4eb3bb2d3da5f8ca522ed8008c474a358c291cd7b6d5a988677f58c6b893eaf716948684fcd87ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620418, "uuid": "ad907b38-87a6-4de5-9071-dde5c93632bf", "value": "T15F13F1B2D5AE5382E9E33B31427FB61E00B48E1EB651142365D5758E4B72B34087CDDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620418, "uuid": "e9edc205-24fe-48df-9a9f-0b9f5d94adec", "value": "768:0go9ysz9CKaZhk15GccJuKijzo4fFi6T8hjILZ3czoIxLqiXfzmnbcuyD7UoQRjs:0yshZavk1NbTjzTwzo1kqnouy8oyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620418, "uuid": "e68e81a0-977a-4043-800d-133f1f51ca9f", "value": 45104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620418, "uuid": "230c7c54-341e-474a-904a-23b7dd36b75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620418, "uuid": "477ab76e-351e-4f09-9f26-796412aa3c89", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32edaef9-8dab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785590185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785590185, "uuid": "bf042377-3579-44da-b00a-4d9063fdef2e", "comment": "Malware payload", "value": "f168e8702f7cb28c1a8bffea5d5d198c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785590185, "uuid": "17a37889-bf33-4dfc-b778-e426356fbc99", "comment": "Malware payload", "value": "6f842b9bec4ed47ed889950d78d61ee54a427c4f9106a65f41afdbe34ca1896a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785590185, "uuid": "903a5843-04ad-43a8-ac35-e69355b5fe16", "comment": "Malware payload", "value": "2384e3807e6bac57a67989542b72933c1ac34568", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785590185, "uuid": "6f0f9eb0-d630-45bb-8588-15f868b9ee78", "comment": "Malware payload", "value": "5abf7e0f6ccbb1245ef2c9158f0d0b34b09030874fbfbbf7b4ea3c49c5ec75d74a28a69359648ab1bd17b908f7a2df1b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785590185, "uuid": "39e377c5-3820-4ef5-8ea8-81ec60d5cd5a", "value": "T17B235C5516857C24AA98C8361C7E2F0CB9AD83E6324452EE7FCF3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785590185, "uuid": "54be5aa5-e29f-4f71-8e5a-9de1508c916d", "value": "768:Gl+p9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:c+icr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785590185, "uuid": "13a4002f-900f-4533-bf0e-1bc945ee3cda", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785590185, "uuid": "6d99ccf2-539f-4723-b245-a7c42a6235dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785590185, "uuid": "d748c788-fa5d-4b16-8531-dc17d32921d6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a66c59-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566782, "uuid": "aefe8093-5622-41a2-a942-46395bfa5895", "comment": "Malware payload (Mirai)", "value": "2645052b8f868075cba1b5bf8d73e8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566782, "uuid": "6907dfd9-b245-4d04-aa48-50a2dd713182", "comment": "Malware payload (Mirai)", "value": "7091c67e068925b6b3f73b6f7d191394c1aaa472d7e1b662cbef389e6cb7181c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566782, "uuid": "9ef21ca8-9a56-407a-8885-8827bbca2b0d", "comment": "Malware payload (Mirai)", "value": "38e7bcffd9dba74d2a509a48ddaebeb42c2c4d26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566782, "uuid": "2f445cf5-94bc-4323-a36c-86dc7aea52d9", "comment": "Malware payload (Mirai)", "value": "d910637269cb9ae28d60e7b0f88db63094f2f89a9908cfe3e27ef27ee972f15ef85f8ee6563b2dd27bab47c035caaa26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566782, "uuid": "a491e361-cf84-4c55-89ca-c181d994bb52", "value": "T14FF3AF27724F1460C89605F45AEF9BAE3B2315814EAF4AEB7C6D663EDB724CA11017F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566782, "uuid": "7f5c18df-be4b-4a50-be40-230b3ede6b22", "value": "3072:fU0NAlCtivSw1lmECZdI1gF2MRViqQY+ggtCMnxQVkAq:hNAlCtiKwfCU1gPV5cXCMnxbAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566782, "uuid": "3ee51028-a920-4e2d-8726-aef15d846667", "value": 165328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566782, "uuid": "ee703e75-c720-48ca-ade0-915e60fbad0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566782, "uuid": "684fecbf-3c64-46d9-a85b-e9de7d0ef063", "value": "zero.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64024a5-8ddb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785610995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610995, "uuid": "b8da2c5d-7ab9-47e4-9eb0-0ea63ee35927", "comment": "Malware payload", "value": "c7957271544fdb43ebc297693cf47570", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610995, "uuid": "d682806a-0c7e-4fa2-9951-0e4939411c4c", "comment": "Malware payload", "value": "70d43fac540653171e4820534be5e15cbd07d160cbeb564c0856d41f3207f7a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610995, "uuid": "4e73107d-629f-4690-aa23-270f1af41822", "comment": "Malware payload", "value": "44fbf294c60f9c750bb52ab957b457defe608abd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610995, "uuid": "25dda4a5-b4ff-4d1d-9d9f-a29293663f0e", "comment": "Malware payload", "value": "c79bb71f6c97837717e6415606df621668ebbc1ca2f4d05ec4871620acfc7b996ccac70dd5d51a9a22164f1e570a4d86", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610995, "uuid": "02ab3d55-7f29-4212-a0f6-fcda41545d7b", "value": "T199236C6516857C15AA99C4371C7E2F0CBDAD43E6320852DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610995, "uuid": "43a72e3a-e218-4707-b513-ed41d0d4ae4a", "value": "768:fcsr0a1ldZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Phycr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785610995, "uuid": "99df3c15-b11c-4659-abff-d16dd10f5b55", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785610995, "uuid": "59c41a18-d581-4528-8d32-a01913468c70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610995, "uuid": "c17b3785-1a7d-404a-80ac-d807a2caf8ac", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc8db0d-8de8-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785616428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616428, "uuid": "4d9a11a5-2891-4187-ba03-8a12d5155731", "comment": "Malware payload (SalatStealer)", "value": "cc709b7dbbdab599842ab059df4a379c", "object_relation": "md5", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616428, "uuid": "c811a46b-e7f9-4ad7-943c-f2a14b958390", "comment": "Malware payload (SalatStealer)", "value": "7458f3a8146a5f731699d68e1ac3d4f3d87525b020852b0bf8454fb44c1c77c6", "object_relation": "sha256", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616428, "uuid": "5a88b7b0-30f2-4c3d-b975-3c358ee09182", "comment": "Malware payload (SalatStealer)", "value": "82afcf65d159230d634a20dea703807f0f51efd0", "object_relation": "sha1", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616428, "uuid": "f7ef4e3e-066b-4cd7-a530-f488179dd2ce", "comment": "Malware payload (SalatStealer)", "value": "b7a1e923aa4ea4473531d54d697397fc8acfae28b674c82bf025186a66ad626971a77f14ce7c8e8f624169db3941e0ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616428, "uuid": "c29ef307-9ea8-4ba7-bbac-053eaad06011", "value": "T1B807331AAA7A5B2DC6E7087E19ED34B4E701B6B77C1476C4341C2A328EF8C9B5CC4635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616428, "uuid": "e96636b9-1b67-413e-bfd1-5c42f2f811af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616428, "uuid": "ff74d282-52cc-4bab-976e-32ba3395d64c", "value": "393216:aSmPFLktOFIEgcQXkoKbkXBF+8+ujG1uYh5F8NdiFl:aRNIEROHKoXBU+Glydin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785616428, "uuid": "9064abdf-e62b-4106-9241-c72d8a0bba44", "value": 17629696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785616428, "uuid": "d9bd6dcf-b76e-4a93-8215-39b06d8e5483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616428, "uuid": "786806e2-4f90-4fc5-87b7-b419171b40d3", "value": "Exodium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e908cd-8d66-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785560475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560475, "uuid": "26375d4f-790a-4cf0-b163-ea1534c1dd87", "comment": "Malware payload (CoinMiner)", "value": "dfd327c9ab4ef1909e47999ea09689d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560475, "uuid": "629cf596-542c-43b7-8415-3c7c3ef4f398", "comment": "Malware payload (CoinMiner)", "value": "751bd836037a38f9edf5e4dc20174c2b53ec843082c732d63742287633b5c615", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560475, "uuid": "ea7f09ea-4e31-4a2a-b458-edc10c37d03c", "comment": "Malware payload (CoinMiner)", "value": "8acc146c31800072fb3afcd436bb1479cf6aeed7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560475, "uuid": "d3886544-eb6d-48b7-a2a1-91bc9de48f51", "comment": "Malware payload (CoinMiner)", "value": "a2d81a74e5b205702c8de0833479b3e239db33a10045ecf472127065ff702abd22b80dff94b4eb53db16c4812a87f6ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560475, "uuid": "764eb066-a1af-48b4-9abb-e6f10353f10b", "value": "T12E4623BE2384335CC01E88745033FD89B5B6571E49ED95AEB1D3BAD07BAA824D902F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560475, "uuid": "bad204d3-95c9-4b32-8519-9d24ba384e25", "value": "fe509329c25618ef34bb20385a5ae79e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560475, "uuid": "a80c1f26-b606-48e5-be71-c9e26345d7c1", "value": "98304:aZIdtqI45SOuSQZFm6GNB2NmXv+22SYz2Cy551zH5VZKHMRnOJ0vJn88ZgGV:aZgtqIgYSZB2YHxYbOzzeMRna0vJ88qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560475, "uuid": "9cf0e7f9-b137-4ae2-a62d-d0a057781e11", "value": 5774336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560475, "uuid": "e70f8417-0566-4c31-b9e8-3cabdc273686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560475, "uuid": "3235e095-841d-488a-9bf5-0d8093f40979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919263b6-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545247, "uuid": "d435dc5f-b661-4d4f-9879-4866e4819ffd", "comment": "Malware payload (Mirai)", "value": "cd92a9854c12ebd0802c55b1583ba833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545247, "uuid": "331235fa-740e-470b-ad0d-7128eecb79a5", "comment": "Malware payload (Mirai)", "value": "7524f4985f445fa1bfeac4b889ae1c7d7de1e79d3c68a5f7768423852902c071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545247, "uuid": "b5521c2d-6216-4644-a019-5abb0ddd8a7a", "comment": "Malware payload (Mirai)", "value": "5d2c41bbed6aab7d3d3d95df26739ddcaffd52c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545247, "uuid": "d4048972-9099-44c1-a599-5b21a46d3f89", "comment": "Malware payload (Mirai)", "value": "50c261ab1c800b263f79eaeb22da29550998c5102659673098bfbdcd58e0b6be9d8ca4b06c95a40eaf6c7f92bb1283e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545247, "uuid": "3a176a7e-ded9-4035-be43-14ae6cb4eeed", "value": "T1B813F23AD589CBA8CA0D8171DBAA380724D4F018E939935D9EE81739CD9BF9D16302A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545247, "uuid": "136ad01a-1164-4560-aad3-90895d2bdb55", "value": "768:P6sry8pGtT5mZj3rJsLJCquQxFK7BnNs9SuneK4m27ssY8ZznbcuyD7UHQRj8:P6srMxubrSLsQxU/68BjZznouy8Hyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545247, "uuid": "a51c6d9a-a96a-4ef6-8029-e36717ffddcd", "value": 41812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545247, "uuid": "36380b34-52d6-4667-ada8-b6d16eeba1ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545247, "uuid": "91e7bc12-a462-479d-bd21-362e2c76692d", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98aebe82-8de5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785615267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615267, "uuid": "a494fddb-5005-49f8-9689-c6cba9813f96", "comment": "Malware payload (Mirai)", "value": "001e9d95e595c5b53d230bb644b7494e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615267, "uuid": "14cece32-0198-483d-97d1-e3c29117a4d7", "comment": "Malware payload (Mirai)", "value": "76a40843091ba46b5cd6f3fe5f3ad9c451614fbb53c6936837d980d7350a885c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615267, "uuid": "f067b66b-9002-460a-b394-0c099b724d28", "comment": "Malware payload (Mirai)", "value": "16ac1244fdb3d4197381ca82d2a6db0f03e63489", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785615267, "uuid": "18473047-2185-47b2-acc5-5b25d36f9b32", "comment": "Malware payload (Mirai)", "value": "b20c36edda49f9a9414b7fa1a631cdd11194368df2c1a3a1942ee0b40ed088b3e0c15f33bee461397802a4a834b70ff3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615267, "uuid": "10b270f1-d6a8-4e85-b9b0-cc72ec4ba70d", "value": "T1E4259D12B7F102A6D28087354662D7A0BA47A7A665E0430FDF608EDFEF562650EC4CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615267, "uuid": "06530aa2-e11a-45c9-98d3-2bda1b415612", "value": "12288:knjbCKSw8SUyr2m6Av/HMA6YHQsoVs51gPd+:SPowQm6kvMAJH1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785615267, "uuid": "14f93ce9-fc76-421f-93b6-36e2fc842cf1", "value": 1057472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785615267, "uuid": "24fbd335-236f-4f88-9d6e-d11afbd334ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785615267, "uuid": "8983ed20-2d3f-4e7e-90e8-9dba1c47846a", "value": "xd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daadc9e-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785573158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573158, "uuid": "86deb058-0d77-424e-a96d-4783f0418831", "comment": "Malware payload", "value": "cd74c87c6227f64782cc7b6bf227dd84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573158, "uuid": "9b893fdd-cf66-43d2-b452-adf136bc8f07", "comment": "Malware payload", "value": "76b47051e000721df4a6227e81066a890fe4e34ba742e98e13753ee4b6eab890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573158, "uuid": "6d9ecd94-113a-43f1-ab9e-10abd1ebb580", "comment": "Malware payload", "value": "eedc926d7a98d681c0e4d924f9eee6821c0be1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573158, "uuid": "62e2b117-5a4d-43ea-862f-e4a10b7862e9", "comment": "Malware payload", "value": "93e434c829794e09d943abb04c603f01d9a56ce8217c231e5d44b03141aed7f13abeaec9fc8171df4b951c4f47da3f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573158, "uuid": "1f9f4dea-1c52-41e9-91b2-22e5f05570c0", "value": "T137D5238DBDF21974C832C3B6DE92E06DB128BB910B718D973BCC26109E235995C36779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573158, "uuid": "645ddc23-64e6-4597-a0f9-827a16e3552a", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573158, "uuid": "4c754bd7-d174-492a-a0c9-b90c432d4d2e", "value": "49152:jYqCpWaH9yh8pXrkKZKRfAqBZPSBkNSdTMCZ54TigCrVsslXlydLyXdm5M+gaWNL:jYqakgMRfACNami9FJlsyNmCrzCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573158, "uuid": "bc78675b-da35-43c2-8775-3a34966e79e4", "value": 2995712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573158, "uuid": "50011f38-c506-401e-99fe-bc260f121779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573158, "uuid": "663a12dd-be03-4d48-ad26-848ffa4d577c", "value": "SecuriteInfo.com.Win64.Evo-gen.31554516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ef8a8e-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620421, "uuid": "2859ec36-340f-43ef-8ec8-edf68afe6344", "comment": "Malware payload (Mirai)", "value": "b27f761bf3cb892849d28c10c11f47e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620421, "uuid": "b134d916-90a7-41f7-9039-f120a500be31", "comment": "Malware payload (Mirai)", "value": "79ac225db5a8cd7814a89d361e61b2e1b323b7de5c0138f8291a0d72d2abc721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620421, "uuid": "8bfa278e-5f0f-4740-a60c-126907d53258", "comment": "Malware payload (Mirai)", "value": "41913382fafe1b4a5debd8356e9aef3e0377a50e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620421, "uuid": "6b821676-a6c8-40bf-892c-4849ac5ef53c", "comment": "Malware payload (Mirai)", "value": "8dc9f398ef29b6fb767140a3127690920c144f514c7cd0e82a00f6111b6c66b17ba8ed33f5073f7c96bbf0152d81731b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620421, "uuid": "ac1d2567-5c8e-44ce-80ae-adb7a6a93d35", "value": "T19B6301228A2211D2F4A4953784715A58EA0C6FFCF5BF7EB7230A1629C6D5CD2244E34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620421, "uuid": "2847150a-acdb-4185-ab11-ecc32fb676c4", "value": "1536:+LD9R0+8P/QAf5lBCPL0EeKufLkyJRZKaxyFZj:+P9RLoQAf5jNfLksx0Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620421, "uuid": "9fc1c641-b692-4537-b619-1ed084ac1ec7", "value": 72968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620421, "uuid": "d611a28e-c4b3-420e-bf26-673c380a67d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620421, "uuid": "98e97b56-5064-41ef-bfed-76bbf2fbbe1d", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ddaa4b-8deb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785617950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617950, "uuid": "06cc71f0-ec76-4d6d-a9b4-1ce79130ed28", "comment": "Malware payload (Mirai)", "value": "2762c333391f1acc502f1ff4d57af93e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617950, "uuid": "fc46f2fe-eb45-4c75-9028-4c9f27f10b8d", "comment": "Malware payload (Mirai)", "value": "79c61bbecf9ab72200c1f36a6006958396b93719fbbd14a02e4f2a0233646376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617950, "uuid": "b965b43e-f968-417f-bd36-bcd7d9f908eb", "comment": "Malware payload (Mirai)", "value": "515aa5d9d6c06cdcd41261a683c9b0f4dea7df07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617950, "uuid": "f9f122f1-a0e8-41f9-a191-8e1b6492e34a", "comment": "Malware payload (Mirai)", "value": "c79c6c7c469c77bb4018fa12a52ac694170359aa168aeae16bbfe23f1749b9bce8946e7d0fc29a4b89b3fce4091a4d6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617950, "uuid": "049d226a-dd3f-41f3-b426-fefa161489cb", "value": "T1C703E14AC164426AC69D017CDEEEDF8F0E2241AD6018EBA7055CC4BBD8A3F753D16A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617950, "uuid": "3822d8d0-17c1-4984-bf99-c8075122820f", "value": "768:2CaELaiyCuQjzljScd2w6gpa6nDrkg5KngDZdxxSs/DMvLnbcuyD7UGQRjD:4m/1rQBqvkg5Aqz/ZMDnouy8Gyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785617950, "uuid": "4ff4f95b-4556-417f-b2ac-3d2b55f3af93", "value": 38980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785617950, "uuid": "ef908f7b-ab0d-449a-8bec-db3e3e5c53c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617950, "uuid": "eab5690c-42c1-4fae-b8ab-32675ce22d1b", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d1ca52-8def-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785619337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785619337, "uuid": "8ae22ee1-edb6-4639-99f0-af6cee0eec31", "comment": "Malware payload", "value": "caacf1183fa10d1feca3705e61561eab", "object_relation": "md5", "Tag": [ { "name": "clipjacker", "colour": "#9ED9C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785619337, "uuid": "69683567-b2c1-490a-b03c-28354eb28dc7", "comment": "Malware payload", "value": "7a7ad4ae347a3f99f3773a113d9f70ecfa967100c96e8275bd1df833caee68d1", "object_relation": "sha256", "Tag": [ { "name": "clipjacker", "colour": "#9ED9C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785619337, "uuid": "ffd79ab0-747b-49ab-8275-e029ef1ddb2b", "comment": "Malware payload", "value": "953f73b8bd7d432827eab7f00b4a0335b9485315", "object_relation": "sha1", "Tag": [ { "name": "clipjacker", "colour": "#9ED9C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785619337, "uuid": "474616e7-d732-490f-9ec7-ebb38e1b95a0", "comment": "Malware payload", "value": "600543cc7daf5578f82d77b7c188c48d54b5cfcd81a0157f794f3246fff99eb5e4c844e6e96fb7b1906292aaabd0e1d6", "object_relation": "sha3-384", "Tag": [ { "name": "clipjacker", "colour": "#9ED9C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785619337, "uuid": "9ae50240-b091-4753-86f2-e4c9db805d43", "value": "T1D0085A0F3DE91613C99E16360C3D27FA03BDE54295A9A3935221EB6CE8DE1F978241D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785619337, "uuid": "2a103053-b46d-4244-a536-c708d7a4a8e6", "value": "58296c9611b6534d4a5f81a14eedb050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785619337, "uuid": "31673f35-697e-4b31-9b7e-9b6cb54d3029", "value": "786432:uIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII8:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785619337, "uuid": "17975e1f-6169-4025-b820-0de64f3313b5", "value": 81716160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785619337, "uuid": "37a72c33-c105-46b0-bce4-73c092905fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785619337, "uuid": "c880021a-fb36-4a9c-b37a-4a74c14ac809", "value": "silkebin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6dfd8a-8d44-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546156, "uuid": "922e31d8-f8bb-4d2e-bc5c-af1e9e5defb3", "comment": "Malware payload (Mirai)", "value": "82da44c556166c7aa7891ae40617f033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546156, "uuid": "d8a8e8c6-83fa-43ae-9bb6-aa3d2d875028", "comment": "Malware payload (Mirai)", "value": "7f697ed4ca05f453a3d6ec8d8bdfd6cb70453e992a6daf2e2d4b08cdef618115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546156, "uuid": "1928313d-9133-4dc2-9a31-4bd934fc2b26", "comment": "Malware payload (Mirai)", "value": "eefd8b4cff61eab7fee8a3c6490f7da06c018ad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546156, "uuid": "a9b0262a-dd40-46e0-89fa-06408b257e35", "comment": "Malware payload (Mirai)", "value": "ccd7d53859c1946ab34347f68f8e81125f6f276baf4281e789fc554349833092097cb8e908b3f03eaa7c277eb0c45de7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546156, "uuid": "b14f9475-dc0a-40db-9332-e60f6a883f2e", "value": "T1E3A348D7F401DDBDF84ADB7B4453090AB131E3A20A831F36626BB967E8751981933F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546156, "uuid": "d66433e6-28b9-4f01-b026-169c5f4387f0", "value": "3072:P+7JJsnct9P+PIMOe6pn3tuCZCg9EvVnC:P+7gct9wOXn3tDZuvVnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546156, "uuid": "652dbf27-d14c-44e8-9b91-348e32a02e69", "value": 99752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546156, "uuid": "9d188666-3eff-443d-b5bd-6704ac7f5e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546156, "uuid": "5470b73e-21cb-4174-b2b2-8e40ee3b7d56", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e923358-8ddd-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785611733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611733, "uuid": "aef877e1-5f32-4bf4-b84f-26a81d7f2672", "comment": "Malware payload (WannaCry)", "value": "c3f59fc053ff6ade13667c98d808b9ba", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611733, "uuid": "5669f122-0160-4f56-af2b-32561471d349", "comment": "Malware payload (WannaCry)", "value": "7fb8b06a9ac3c0c6b475948d1b981586cea76a2fc53f57c54163352fd90f0c63", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611733, "uuid": "0e0d048e-e546-4fd4-822b-ad033f181d7e", "comment": "Malware payload (WannaCry)", "value": "b86596258e715a1e6847a2e67f4346fe15eb1712", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611733, "uuid": "4e341825-860d-4115-af3e-5b355814b18d", "comment": "Malware payload (WannaCry)", "value": "ec7387364dbe71ecbc14dad1364cca578f8a1dc4efce66737812fe72925a5a1db73d841ed45fca38e9d3eebe299b48cc", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611733, "uuid": "bd137977-74f5-4394-92ba-91ba73abd893", "value": "T15A36AE05A2E82B64E6F35FB221778710477A7E45896B935E1660A04F0C33F5CDEB2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611733, "uuid": "1f5a6714-2206-48d7-bf07-a87b66293dd0", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611733, "uuid": "800ebe9c-f4a2-49c0-8579-546681d1beee", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0Xk+8:jnXnAQqMSPbcBVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785611733, "uuid": "a921391f-9556-4109-9592-7d7ce7a6dc22", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785611733, "uuid": "ef7d3fd9-600b-442e-968f-2e81644cab0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611733, "uuid": "ad403d29-d2f3-453e-8125-665d7e1dd459", "value": "7fb8b06a9ac3c0c6b475948d1b981586cea76a2fc53f57c54163352fd90f0c63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69401261-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621630, "uuid": "0e7758db-1d86-4740-9c59-16c46e5a71b3", "comment": "Malware payload", "value": "e25993cce8dfeeb018aa9858eb1f9c66", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621630, "uuid": "d3d9a8ee-b1e0-496f-9d83-0054799d7564", "comment": "Malware payload", "value": "813ecca5f5f3db59b5a1ff6979669d50347295cd4dbc8c7a233d1c0c8e6a35c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621630, "uuid": "d1651681-7845-452e-a487-c5b3add5a0c2", "comment": "Malware payload", "value": "d89621a685865afce8ac0a5e6b6f00de56718fe8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621630, "uuid": "fb5ef44d-1859-4501-83e3-6fca059e43c5", "comment": "Malware payload", "value": "5dc0b3ca4614a29a162a53bdf2261d19f7f0075c9285e490125d01611104f76b71a17b01c425b296f47eaa77a184cb77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621630, "uuid": "a0559596-cd7c-4d7c-86bc-248da71b9c63", "value": "T1C1F08BED949640323F0D583771194C556642182F24B95BDD224E99635E0CFA8234EF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621630, "uuid": "60e800ed-2678-4f62-b8ae-7789b5596185", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQQTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VstBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621630, "uuid": "1b1176e0-84ad-446c-90c1-521d5b88530f", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621630, "uuid": "737be909-aa0c-4942-8119-c0f3130740cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621630, "uuid": "78275634-9c55-40b9-8e63-823b7f0a4aa2", "value": "sensi_hk.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcfaf31-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545137, "uuid": "c22905e1-8855-4de8-affb-e47f9d1e50f0", "comment": "Malware payload (Mirai)", "value": "6f9badf65aad0509f29d3524bcb30c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545137, "uuid": "93087b35-34c3-4f36-82d5-c7976aee59ff", "comment": "Malware payload (Mirai)", "value": "815fc69701ef8b1a35dc60bc6ea683fad70c176c26df68c2b65832510ce7bcc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545137, "uuid": "d24f2a4d-8393-4587-8025-d1d348fe89d4", "comment": "Malware payload (Mirai)", "value": "f7b6ee92e60db8a4c47fd7c9d8340daf2021bc07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545137, "uuid": "6be040d0-8faf-48f3-9656-527d09a71192", "comment": "Malware payload (Mirai)", "value": "436433456bddb26f83fcd31693778f8e517a55281c6e90d964be193350a23bfc87d2258226590301ff886c0301bb2440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545137, "uuid": "715124e8-2fce-441e-a564-868ef6b3b966", "value": "T187130274D2FCACF1C538593C9E1AE18285ABA7FCD95B245306A910C161C790BFFB8687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545137, "uuid": "1588e1fb-34d5-457e-b0c7-5e3e281a364b", "value": "768:iganv+60ZMMxOUXkNPdIgLwV8GNcYH7Xb10r/ddUMDoVsnYCBwn1+9q3UEL5f:bav+6xMYUWZmNcA1ed/8WnfenNLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545137, "uuid": "03e77ce6-d7ec-48ba-9d2a-179d71170cf1", "value": 44572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545137, "uuid": "be38f0f7-0c8d-42c3-9268-20404af78918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545137, "uuid": "b5572ad8-dacf-47c5-b545-5f8db7d27dfc", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f266f83e-8de4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614988, "uuid": "d28ad673-d983-44e3-aed0-de1e4c7ac713", "comment": "Malware payload (Mirai)", "value": "465be1b6af5c66e8af3b589c7ceb7037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614988, "uuid": "ba7ce047-a1bd-4ebe-8ba2-905eb349debf", "comment": "Malware payload (Mirai)", "value": "81828eebb0a9e8efee21ebf9bc22be81bdad4a433f33c8017ef7ce79efa550e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614988, "uuid": "8405fdd6-dea5-48c9-ad01-a82c61e8aefe", "comment": "Malware payload (Mirai)", "value": "6471f6a31ea00198bba3ebae10e3d9bd65526c61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614988, "uuid": "54d97fe7-ba63-4bdb-97b4-39e091691ca3", "comment": "Malware payload (Mirai)", "value": "14dca18f7ca9ec6dc097696cf74225e587c97428aac4040c4c05178b8776a9d82653d2268667aafa426b49a6d654128e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614988, "uuid": "9508c5d1-13e8-4a4b-bce3-efb5c1bec648", "value": "T1C3B3F70AEF610FFBE86FCD370AE9074535CC551722A83B7A7534D828F54A24B1AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614988, "uuid": "44165f20-e0da-46e8-95c3-4cac811ed805", "value": "1536:CJJgtWkaFdUCYblTyJucxNrNrPUliWQVgRRpqtTRaqVhoZrVfrTFlSdW+jh0fpOg:gJgtWkaFSCpucukdaqzonaJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614988, "uuid": "4b1b4852-1b7c-42fc-9281-67aa804ac287", "value": 110204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614988, "uuid": "f68c3242-c982-44d8-81f8-93cc0c428695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614988, "uuid": "8fe25e05-04ae-4301-abff-a505e9927dad", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6289c79c-8dc1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785599714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599714, "uuid": "d76e4be1-8688-46e9-b137-7fa2309b4c3b", "comment": "Malware payload", "value": "fac95d25a87a7e7b68f6d9c19cfcbe41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599714, "uuid": "a48cfc75-3d36-48a9-a760-853bc41f11ff", "comment": "Malware payload", "value": "8186935ad2781d4fdd71959ca1011da3c4a0510b1fa73670c5fd3f116e6990c2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599714, "uuid": "bd4293ae-181d-41e6-a507-5cd55ae90c13", "comment": "Malware payload", "value": "72a539fa34cc1742b05abd03a246690792ce8c61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785599714, "uuid": "fc457983-6781-42b3-8e22-6a570b413658", "comment": "Malware payload", "value": "f6cd631cfb30aed1bcffd8d276f2456f5cdc95ce0b03320da356406990b0c1958298e8ec0a9c936f0ac490d6f964683b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599714, "uuid": "12cd0bc0-2921-4920-bd06-c95e2631a66c", "value": "T1AD236C651A857C149A98C4371D7E2F0CB9AD43E6320852DE7FCB3CF28C8AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599714, "uuid": "25cfccea-8c24-4233-af2a-9a402f1658af", "value": "768:VVEJVIhtMz79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:bEJ2M4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785599714, "uuid": "997b287d-2bd2-412d-9462-4eda364a3a85", "value": 50079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785599714, "uuid": "750a5b1c-6ae6-4c6d-b43e-39ed8d35d7df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785599714, "uuid": "2ad0d33a-414f-4ef1-853f-5e4b52e89f21", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41528b5-8d86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785574591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574591, "uuid": "6b67a643-37fb-42a0-a4b5-5713f3cffa8c", "comment": "Malware payload (Mirai)", "value": "e5932470b31080a3cc2651c30795194c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574591, "uuid": "bdc23811-bdf1-492f-b5fc-700ab5a094e4", "comment": "Malware payload (Mirai)", "value": "84147f58f6ca5a69582fb1eaacb6ba54c4c2748c5565643d34a5dd34d75b3767", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574591, "uuid": "6bd448d3-1e0b-4763-8b4c-4d267cfe7830", "comment": "Malware payload (Mirai)", "value": "28cb8b4857611b53a7ed2f1db430120184277b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785574591, "uuid": "145931c5-09f1-4bc8-8ffc-b5c83ea0a393", "comment": "Malware payload (Mirai)", "value": "c3e4ada0ebebdf8cb9fcddd3bd30c14e0a96627f6ceb4005a3dfa3614971635e88872c35be5b64a7b12256b238b45a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785574591, "uuid": "98f6e1d0-66e6-4a1d-afae-704c92788aac", "value": "T1E7D30689BC814B01D5D636FAFE0E124933534BB8E3F9B102DE145B2E278AD5B0B37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785574591, "uuid": "63f0b90b-dfb0-46a3-b9ac-75f5397d9063", "value": "3072:DIj7hP4n10S8zTrRb5h9X8CdhazRkf9+/AaaXlZNT:DIeWT7h9M8haFkf9SWlZNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785574591, "uuid": "3e43ba9c-3c8e-4042-8735-21e5957f32bd", "value": 142600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785574591, "uuid": "5a7b62f9-c0b4-46f0-9587-2251e4304e42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785574591, "uuid": "cf619df7-0eea-4559-94d0-7e4f2b5dea4a", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc3e7f3-8de4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614655, "uuid": "7d22d745-9c41-456a-984a-81418091c4f8", "comment": "Malware payload (Mirai)", "value": "8a4171d7096f52d5b4ee1cdb3ad27460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614655, "uuid": "dcac1333-5abd-428d-b5aa-0b83d63fb09f", "comment": "Malware payload (Mirai)", "value": "85260127615d0beec655f314afcbadeab0c4dbdfe1f79ed607b4915b826f1c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614655, "uuid": "798a8ec2-87d2-45d7-9641-35991fa4ca29", "comment": "Malware payload (Mirai)", "value": "e50c6c6e4058b826db0fc136cbfac34ec95d218e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614655, "uuid": "1b38bc78-5986-409f-829c-c33d6f351b6d", "comment": "Malware payload (Mirai)", "value": "666675f670a304e3a3ba09216e1d5e497ce3f421a07ddf0924f0cb7c06531f76bd43dbbe990486e9438081fcfd0f7887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614655, "uuid": "b3aed4c9-6eb7-460f-8660-79e984d74ead", "value": "T151739D63C9361D64D44848B4B0A09E365763E51291872FFBA9AAC33EC047EDCF65A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614655, "uuid": "26baa9ba-6ca7-4027-88ac-acb189e727f8", "value": "1536:B72vxZN4Dr4tXrBfyKGbRwsoAI6OlKCr79qr6Jyg/:BCvxa49rx1G7hwKqEc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614655, "uuid": "be7c9ac1-2336-401f-be6a-679b0772f56c", "value": 75580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614655, "uuid": "5bf0fe47-a7ef-468f-8532-4e4d74a1e3b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614655, "uuid": "bd67cf6e-8d05-4531-b2b4-46baacee85d0", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c542a51-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785613931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613931, "uuid": "3e2f7708-2540-4e83-911b-4f116fd8ef07", "comment": "Malware payload (Mirai)", "value": "7c8ac41bbc29447fae7a3364478facc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613931, "uuid": "c9f6f1f5-7002-40ce-a1da-86ef1761eab4", "comment": "Malware payload (Mirai)", "value": "8671f3cb4dc40a879d17eb12758e5ce5c5613d5dc1bebd89318358023d20718b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613931, "uuid": "f203f528-a142-464c-a8a3-3ecd8bc62807", "comment": "Malware payload (Mirai)", "value": "11b03b40b1a2339b94296bbb73bf9a9fbf73240c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613931, "uuid": "044223c7-4eee-4ed7-ac8d-0ece4ee34ad7", "comment": "Malware payload (Mirai)", "value": "798ba7a32594f578fec29c5572657a17c78fa7ab24ef538886c58c90ee62886b6252bb1e9007f5da125c6fceb5f9612d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613931, "uuid": "248c5191-9a99-4d86-981e-cf2ed30ccbcc", "value": "T1B813F1318388ECD6ED526E7DDA29494374C116EEE4AF347323990A6C56D4C069FA920B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613931, "uuid": "73f5e78b-20e4-4a66-b1a6-12fde72238b7", "value": "768:1ijrQ/0InHZqOxWxB7FuA59zq4yeAuo19ao6+qx2H9q3UELQw:YjrQ3nHrPHOoYRLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613931, "uuid": "1dd301c9-ae2f-4377-af0f-8734febea649", "value": 43328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613931, "uuid": "67e3f50a-1789-4b96-bbf4-50e845e5108c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613931, "uuid": "504a9d8a-ec2c-4ca7-bb99-93262b1dbc31", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5c6eba-8ddc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785611488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611488, "uuid": "7ac861ab-6d1d-4aa9-a801-df1fc03f3ddd", "comment": "Malware payload (Mirai)", "value": "9d7d3f2588c02acf9b67f5d7d25afe88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611488, "uuid": "62c89b9e-9712-4a05-8733-c0f78e1cebff", "comment": "Malware payload (Mirai)", "value": "86de77a8053d472cb0062e4b1e224119fa3e3d1495d3d0acef4f502d77284ada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611488, "uuid": "a559f1f3-ff45-4a56-a2d9-3c7d6bcfd4d1", "comment": "Malware payload (Mirai)", "value": "aac8a8365c5dd03db2c03d65f258bd128a7e48dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611488, "uuid": "6fb4340c-606f-4583-9edd-d2843195b6c5", "comment": "Malware payload (Mirai)", "value": "66448265f83a0418f396915cbd2325a60b639d3f7e53b99f2f1722fc5d2f4704ef550b35fbd63f5c207d5d036808ddde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611488, "uuid": "d3641389-9ba7-431b-93eb-9998f8ee4d1a", "value": "T1C4B4DF63F6B05ED1C4020A741CFAD2340755F39213D26A51E7FEC9242C8B6767E9EBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611488, "uuid": "3f39bf0d-ff11-40bc-9048-116a671f68eb", "value": "12288:a1xdxi74SaKs6Z6ot38pzwe36iHmJD/G/Y8pBP/C:mfx+rZT34ziiG1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785611488, "uuid": "8a54efd9-f243-4ae5-8bdf-3021ce025dad", "value": 529072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785611488, "uuid": "28e178d5-a985-41d3-9107-52105fdf7178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611488, "uuid": "90af5197-043b-4c9e-9f8d-c1f5af4af577", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f39f4fe-8d75-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566959, "uuid": "75a3d664-6b69-4c5d-953c-d02725523e41", "comment": "Malware payload (Mirai)", "value": "7394276b6d0cbece9c16214d9f13fa35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566959, "uuid": "ef58aff4-56c3-4570-abb2-596d9b4074dd", "comment": "Malware payload (Mirai)", "value": "876fb6f7344673b9d619bc60e68d7cd61b2e2cdeb4b65aa61e1f83b57df92315", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566959, "uuid": "c6a488c1-6997-4856-ba43-b2d4db7d3882", "comment": "Malware payload (Mirai)", "value": "c51efd8a3b1dcc95b78b14d20dd35a97ad75683c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566959, "uuid": "937dd487-a8a9-41d2-a602-2540e2f131ba", "comment": "Malware payload (Mirai)", "value": "4c789de1dccc84b7412166b839bda1e95199bac514edc7d574bb8776c2b88b9a7f8bc5d3738088f930fd6c5dd2159b36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566959, "uuid": "b259c065-cdea-4658-b49a-e96e0aa504a4", "value": "T1E93409066F710EFBE8ABCD3712E90B0124CCA54B22A43B757674D918F54E64B4AE3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566959, "uuid": "84af7f26-d6fa-43ea-80a6-6fb9818dbdeb", "value": "6144:WrbLIE19h8oCHS+jZi9a1WtLxN19yE3MN:9YbIZi9a1WBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566959, "uuid": "7cc35dc1-5747-4062-bbe9-85b6271bae84", "value": 250508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566959, "uuid": "a96b866b-64d6-4764-a253-8363f960bd63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566959, "uuid": "d35cc290-e47a-4bbc-90bb-3ae5ea45d413", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5262ac3e-8d49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785548147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548147, "uuid": "6e2b1040-66bf-4102-9db5-ca0f417e367a", "comment": "Malware payload (Mirai)", "value": "a0ab467f7fc994500b6bae22ed3ad5aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548147, "uuid": "2a5ea2a5-a318-44a9-baca-eec6a661d4fa", "comment": "Malware payload (Mirai)", "value": "8799a504a33507c9aa0e7e56990c564e3a73c9f5ae352704a635495ae620f547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548147, "uuid": "77dd1f0c-c186-4788-a9dc-233b9bd7c83c", "comment": "Malware payload (Mirai)", "value": "35e014ba0c1b9079ffa4320521bbb9d6227b334a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548147, "uuid": "73f3daa8-973c-4609-89d3-0ccd97c9c76f", "comment": "Malware payload (Mirai)", "value": "3330ea68a4cd6c117aa18e6e37a4ed4cd022bdf254cfd1aa6246650d52f70d1d345f8d82e00eccafb5ac4bfe36df4a47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548147, "uuid": "ea2f04df-6fa0-45d3-8be9-67a0f700fc4c", "value": "T10513F1AFCA08FAB7CC2C0D7E82E55F695944B4C062DD5FB55314C84CB22A8BD989D43B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548147, "uuid": "2accab38-e22c-49de-8fbe-f995811ccddd", "value": "768:q9e/q30uxUxrhg4cy4tUhP2Dh0TvVNCZrroAHhwu1PkbWi:I2drhnJYUpuh0hN0Cu16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785548147, "uuid": "b0aa132a-b4db-41b4-9f43-18a14c34ea7c", "value": 44864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785548147, "uuid": "c5b83ba8-be3c-4266-b12c-d0f74fb5e8da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548147, "uuid": "ea6bf624-a0cb-4681-a365-13e0f472755f", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e546a2c-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785545134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545134, "uuid": "6e65806b-8e37-49d4-a7db-f7645cf4cdf9", "comment": "Malware payload", "value": "d71bc1ea9445fa7fe103a6d1d111ac35", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545134, "uuid": "f787a138-b3ef-4cb3-90de-8e68ad27fa0e", "comment": "Malware payload", "value": "88846e7c0ddb5563fbba2056644aa06f629450bb805cc518c3eb2d3b66e9668e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545134, "uuid": "27e47c93-f9cf-45ce-8b04-2f72e8b4d604", "comment": "Malware payload", "value": "992d536a8cb795b708d7cef73bb55768e1541f26", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545134, "uuid": "86f2ce5d-2e5d-4637-b2c8-bb669d14f73d", "comment": "Malware payload", "value": "ef9ad85a511ac492deee64bd9e7d3ec1dbbec02fabcb66c1739f92a381a5af20e58abd47bbc19dca055cdca85bce8b7f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545134, "uuid": "e22a1da3-998d-4a05-80df-28db39d99c11", "value": "T149C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545134, "uuid": "2c990ec1-257f-4c11-9661-acdd91eb2ec2", "value": "768:j8vCB+25j6es8RtE9FYpMSUpi+20qUpi+20YQX:j8l25Jtid2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545134, "uuid": "756f3bb1-3cef-4af1-899d-c2db6b672769", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545134, "uuid": "742ccb9e-05a0-47d7-982d-198b9a355ac2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545134, "uuid": "6192670c-e045-4aae-8b48-d5a0bd274532", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96192796-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620417, "uuid": "39dac41d-89e5-4ae3-8b31-771e851757a5", "comment": "Malware payload (Mirai)", "value": "6345157aba49b6376ed51fc80020db07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620417, "uuid": "44cf90c0-64c9-4aef-93c4-e8d43854b496", "comment": "Malware payload (Mirai)", "value": "890aca5a9d6573db9709753c724c28d7704ecc55951426b89c688e862447c541", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620417, "uuid": "788da4db-3d03-4194-a6dc-a193872fc66c", "comment": "Malware payload (Mirai)", "value": "0c7bc65be51df9befebf1dc4168fdb165b818cbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620417, "uuid": "3b6d964e-0020-46c2-9d4a-c8cd7942331b", "comment": "Malware payload (Mirai)", "value": "2d79e267d0927f64739e05a020c68a1c3a4efbbcc451f84497b282c9b5d8347cde8f1730506e15e1b14e066bf2590598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620417, "uuid": "e60e7f33-d6f4-4655-95e4-60afe0b787ac", "value": "T13023021D85EFB912E909113DB4EFFAEA0650DC0DF28957969A186427C6B0718372439B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620417, "uuid": "35496b27-3465-4e37-a88e-11f665481873", "value": "768:tHcRwRItbk1q3fjh+/9RVDD8l+oT3RrEKOQFNj8/1XjNkqB/wBnbcuyD7UHQRjk:l2hk1q3fEFRVsT3VEKO2tOFNkqBAnouJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620417, "uuid": "33086f51-251b-4520-b9d1-e0091861ec86", "value": 48020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620417, "uuid": "59ca2a58-2188-4f49-b6db-d73922cab350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620417, "uuid": "4cf8e56f-6e5d-4ab5-86b7-35facad70514", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d862978-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621717, "uuid": "73d99923-2af3-4ce5-b721-192167eaf191", "comment": "Malware payload", "value": "afca7d0d8912d760d7fe1443a094fab5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621717, "uuid": "ea13d3e6-3566-4a31-8347-50306944d900", "comment": "Malware payload", "value": "89ff91a2caabdd5c75de87b3bb7745f43acd276d30f21f11869f8744be2c305e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621717, "uuid": "c4be49c7-007d-4cad-89c2-5f88b64d43eb", "comment": "Malware payload", "value": "252d154b165cd5c81129e8a8e184e2783ae2eb36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621717, "uuid": "0c3fafee-3380-43e5-bb76-16c3efba7f3a", "comment": "Malware payload", "value": "32b62b2ddc8487520b543d947012268efd4a799e9c99b06e6b13f8e1449b5801ba3ff3736358d2c5b951beee31a248a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621717, "uuid": "0b5e6eb2-5f78-4f5a-95e1-95e4bd6025fb", "value": "T157F08BED949640323F0D543771194C552642182F24B95BDD224E9D635E0CFA8274EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621717, "uuid": "16b2c678-884e-49a1-b6d8-44777a3d36b9", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQSTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VszBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621717, "uuid": "cc439bca-fddc-43ec-85ea-e6a3051617ca", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621717, "uuid": "04535bc2-0b84-4cf1-917e-566df23cce38", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621717, "uuid": "f6f0d556-66ff-49f9-aebd-a053a64b9d8e", "value": "sensi_tbk.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426984aa-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785613834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613834, "uuid": "5d378f83-d97f-4e62-9f34-8ac28418e5e2", "comment": "Malware payload", "value": "fc6c01f460a35b32dc1634ad6bf10055", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613834, "uuid": "fe860e69-e482-4ef9-9b0b-e5964749ee85", "comment": "Malware payload", "value": "8a87d01ce5f9e1bd0bcafa9fd85272db6d491d823dfa73c21814a1693fb257a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613834, "uuid": "6cb9224e-e06d-4282-803b-faecf1c21407", "comment": "Malware payload", "value": "fe9103e0a9597afb41eea87638fe892c19738352", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613834, "uuid": "6e3b36ad-57e3-42eb-9681-20f0671da049", "comment": "Malware payload", "value": "b81cb226ce04f45785e04e49f8574829bd3e266442fd4854bb1fdd6a7997c63c4ef7968e6e4fa7112fbc35726c8e1c55", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613834, "uuid": "f877c61f-97c8-48eb-a3a9-2a4e54a5c45b", "value": "T16DC27E966A867C44BDC94A3E4CBD2B1D6DF5C3E1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613834, "uuid": "c08eb8bf-63ff-4069-8bf8-bb30bc321097", "value": "768:88vCB+25j6es8RrX9FYpMSUpi+20qUpi+20YQX:88l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613834, "uuid": "217cfef7-9e1d-429a-97bd-ba1edce3b148", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613834, "uuid": "7ed9bea9-fc85-4fc9-bf0d-cb5ca016c27e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613834, "uuid": "1857ebaa-4fe9-4feb-b57c-d109d70c9fb5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c850fc-8d3c-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785542706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785542706, "uuid": "8d558ae3-ca78-4448-ab42-1d7db1c88a6b", "comment": "Malware payload (NanoCore)", "value": "36db027cb081301eced5fe08f94ee9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785542706, "uuid": "77a83635-57c2-4e0c-8193-13276b932c91", "comment": "Malware payload (NanoCore)", "value": "8d423e57b2cf148ce393b09c1c67540f591af26b242ec428b4b7986a17fadf30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785542706, "uuid": "98e40efb-a850-4e90-a81e-c3a2466172d0", "comment": "Malware payload (NanoCore)", "value": "1ae40493dea3f1e16aea0db764ce3a8356150050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785542706, "uuid": "dff46418-39af-4f54-b128-5c7c15e53521", "comment": "Malware payload (NanoCore)", "value": "f3df41c20a73d4ae962ec8e6c52508d428baf7c270df1d07f01ca5864dc83dbadbcaf5a923484c3f4c8eb28daa07cd1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785542706, "uuid": "cbbdef67-28ef-4527-b86b-2f49c8e0df0a", "value": "T16614CF5677A88A2FE2DE86B9711251128379C2E399C3F3DE58D464F78F227E106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785542706, "uuid": "36c72d96-20ef-4bc5-88e7-a20613c6e660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785542706, "uuid": "20ec33e9-fec3-47a0-a7f4-a543a32dd343", "value": "6144:MLV6Bta6dtJmakIM5U0cFHkf8wa3PNMGd6:MLV6BtpmkjrH3wKlMGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785542706, "uuid": "19e2d3fe-6de6-47cf-885f-560a603ee12a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785542706, "uuid": "21774d55-63f7-4903-b620-beee0b6d3707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785542706, "uuid": "3a31e785-2904-4842-b77f-94869f0825e1", "value": "36DB027CB081301ECED5FE08F94EE9EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efba290a-8dfd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785625721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625721, "uuid": "6602ec08-a452-4a9e-97be-434905c5f457", "comment": "Malware payload", "value": "ae21a0ca8dd2e0271b8fb019c8cb598c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625721, "uuid": "621e8fa8-8ede-4802-a0ea-9c35596bd4ca", "comment": "Malware payload", "value": "8df8f982ddfe70e73c88835d2815eb6e20247e8b6c0b1dfa769059b920531fd5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625721, "uuid": "8354c9a9-b1ee-4bf2-b2d7-8d5a3e2c1884", "comment": "Malware payload", "value": "79b9837a96dacbd9645ebf5c9b873dc0b5cd4e46", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625721, "uuid": "9f926776-ec3d-4ce9-b3ba-ae39203b1c74", "comment": "Malware payload", "value": "34ccc01eb11b37299c45445f619e33ad1c25d3c9111b21a3e6709371f319d241e58278fc02526c8ab145374a1716d70a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625721, "uuid": "8be6a26b-01e4-4d65-a128-02b78a96476b", "value": "T1C7268D53BA644CF9C1D6DB3A84761265BA75B8484B3133EB1E60BEB92F363C05E31394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625721, "uuid": "3a6617c8-153d-4aa8-a2ec-905453644b83", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625721, "uuid": "0caa4339-f73e-4c63-b9c3-d4994726477d", "value": "49152:fsrGgL1+LMbT1hXjoeNXH8QzQu18HRSWdKwfPkqEsNiUpJKDcpHMIBmr:f16bjJV8xSiKwf8gNiUjKDF4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785625721, "uuid": "799d5a8e-8089-4037-8a55-6f32a6e0437d", "value": 4515192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785625721, "uuid": "7830cab3-33c3-4ab1-90fb-2b525851d237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625721, "uuid": "804353f8-be8d-4e58-b813-dd857d846324", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22443e81-8de0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785612921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612921, "uuid": "722ce9e8-007f-402d-b2a8-3c92df6a1b11", "comment": "Malware payload", "value": "50a9a1fcb001dc2e806fce909475a18c", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612921, "uuid": "7f831f90-597a-47cd-9b17-bd9b685af61b", "comment": "Malware payload", "value": "8fe83c4ceebaf00bfa977ff415dc067c962f7159c75431a0849d4342e505573c", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612921, "uuid": "eb85dcc9-b7cb-4390-90f8-b53d8e618983", "comment": "Malware payload", "value": "46c192138f740f6cce76d27b560b3b7c5ea1125e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612921, "uuid": "0c47e3b9-ba47-4385-881a-efacbb2ee24d", "comment": "Malware payload", "value": "cd04472b8fb9dece829a116e9d4f74ee6a6abd054c8f7c8ea69f40f992eadeffe481b4f4392921e080d189b953e21d06", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612921, "uuid": "51cf40a8-9d4e-4498-b418-1daf20be3fd4", "value": "T137E512837B816841C01ACBB09952E7BD7339FF485A258F1B71D9AE03BC96ADE4D352C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612921, "uuid": "f32a8adf-718d-4ea6-9b73-6b508a70bb94", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612921, "uuid": "888bcaa9-ab5d-4a6e-a3cb-c0bb85a052fb", "value": "49152:2Fn15VmYoHJARX025If3zb6CU+Pxibw104K28S1v6Q5EJ3hWKImPm8:eLNyWIf3zV9Zp8Sv644EKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785612921, "uuid": "e95b8d85-b65e-42da-8f0e-a3074dca846c", "value": 3150888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785612921, "uuid": "867d2cf9-faad-4043-b77d-0a497b493e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612921, "uuid": "dab8f16c-c587-44b6-968d-57f0bb510ade", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9337d80a-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620412, "uuid": "7b6b93f2-0345-42a8-bfad-fa27e59c4bfd", "comment": "Malware payload (Mirai)", "value": "c823a1bb7a48f61243fc7bd7c7884a27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620412, "uuid": "2e2bb376-71de-4732-9231-c03a12330e36", "comment": "Malware payload (Mirai)", "value": "9128520daacbc5fb79f57a3b816ea9b6231cdd630308ff88194b52a3a3a6ebfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620412, "uuid": "c67f12ee-de92-4082-af02-41b3032b219e", "comment": "Malware payload (Mirai)", "value": "7721bed85855be0b5482b9fa1a23c31844ca57b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620412, "uuid": "b2c4420c-a2bd-4bdc-a878-4ad6608829e2", "comment": "Malware payload (Mirai)", "value": "656170232dd34bcf1012a3352571f84b4b7bb5be55ef1be1cf64434d77eaba570bb1c7fc5a3da4e598291d094304661d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620412, "uuid": "081feaca-5e29-4435-97ec-43b1c1aba382", "value": "T1CC23F19EEF857961CB7188BAD6110D00B5EF90F8E0F83816264147580BDAD9A37FF192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620412, "uuid": "fe348d65-eef5-4497-9792-378d3bd6f87a", "value": "768:mtwD4qxOm5prq/sWobT/NHv54/x+oTOQlsWkdEtVST6lZ0X/Aw8QF39q3UELhH3:o/qxnpW/8H6p+MlsWkdxQZ0Xo6FGLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620412, "uuid": "753ce85b-965d-4599-9153-ea509a53ed34", "value": 50072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620412, "uuid": "703b6964-94a5-417c-9f9f-26f4402aa13b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620412, "uuid": "7ff86cd9-298d-4766-a1eb-ab4a09306ff6", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b13fefc-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620425, "uuid": "03125b93-50cc-440a-b46f-5545e081669f", "comment": "Malware payload (Mirai)", "value": "bbfd5f334cede12d94a2db08fc4d3068", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620425, "uuid": "45fe24ef-a62b-42e7-a0d1-0257173e697f", "comment": "Malware payload (Mirai)", "value": "918e199ab86aaa150ec2293524ae865bb7840cf04daead4c64921849acfc9655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620425, "uuid": "712eca9e-8ea8-4bdd-9410-8771114aa815", "comment": "Malware payload (Mirai)", "value": "3ee321fa38f34c7b8fccd12cafdaf64beae1c8c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620425, "uuid": "b1eaf599-b470-41cc-890f-6c746e681880", "comment": "Malware payload (Mirai)", "value": "ba9a161284765e21e781b9930d538ad505a426131141e4ed95cbd405e9fe58c6ca5f7a5a4f350bc0c97055616796b071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620425, "uuid": "88830276-425c-465d-96fa-191c3f2be6ee", "value": "T1CD23E15DAA128BACC12B8C7C52E91B155FF127E990539C87792299B2CCC2C6D3D437E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620425, "uuid": "b99dd5b6-b1a7-4771-886f-5a12e7f8d351", "value": "768:SOVdVB4caSsQhdZDROC+X7/ZRxa272vBdyjFSD/Z+t+LFRqzwBbJ6Gr8NtMiJgGq:jk7SsQhXXJ27Zk7ZtRRqc/6Gr8NtMmVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620425, "uuid": "d08bc1c0-eb8d-4850-9947-711d9d448fd0", "value": 48512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620425, "uuid": "df269cf5-03da-4700-bfab-bc64c6715dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620425, "uuid": "45241ef4-577d-4182-a347-2940e11dcd15", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588b3932-8d6d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785563620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563620, "uuid": "7a44b338-2110-41f7-b88a-67afde617728", "comment": "Malware payload", "value": "fba867df17721879df9d8dcca68d6900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563620, "uuid": "486a10eb-bbbb-4ea8-ba11-8be63614c1d5", "comment": "Malware payload", "value": "918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563620, "uuid": "d1078e2d-b7cb-4443-add6-257dc96887db", "comment": "Malware payload", "value": "510af9bb00ff5d4a6856b1291af55db9f6e13551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563620, "uuid": "185b519b-79d9-4625-b440-b5ec3283aa04", "comment": "Malware payload", "value": "674477939e522ad790e1a5a973f2e00dd347efddbcafe65b14bbebbf9327b5026684187735a037b4c2a0072e5fa681cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563620, "uuid": "30616332-87c0-4eb2-aa8f-9ee0f2eee3d5", "value": "T103864A07EDA555E9C4ADD2318AB691127B727C490B3027E31BA0F6243F77BE06EB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563620, "uuid": "38b37dac-de77-4abe-880c-c5cc57200a0e", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563620, "uuid": "b389925e-8cc2-4074-b7f4-27423cc728af", "value": "49152:/4sfnDspRPNLTR8GPHJ6dI7CmwewbJnzZQBuK37/Vviizf0VZ/OMnz0DTPIyOj+1:/4sPgzBqCJZT0fTSrgBrsES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785563620, "uuid": "d8b393a3-1616-4f5a-871c-c79c3fb6de00", "value": 8113978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785563620, "uuid": "2168a630-eb4f-4b14-8022-007d0ef714c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563620, "uuid": "fb20c99b-8553-4865-a530-86441d81a392", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08531e3a-8d54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785552748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785552748, "uuid": "0d1a6d16-04bc-4f76-836b-4726a85c4079", "comment": "Malware payload (Efimer)", "value": "05b59210318a43454ae46648ad6deadb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785552748, "uuid": "9c063adc-1f87-4de5-9e49-fe6696330815", "comment": "Malware payload (Efimer)", "value": "92b146eff8d54fff90445bd258e0e5a42f1277e213b9fa0137c7ab5074c01a46", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785552748, "uuid": "061a091f-1154-4a7f-a2e1-fe756bd2cdc5", "comment": "Malware payload (Efimer)", "value": "774a6157c2f566d6507b1fce08fa1fd486725d91", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785552748, "uuid": "aa839b20-35a3-406e-bd56-f76487c0316f", "comment": "Malware payload (Efimer)", "value": "c4b548e1c29df6781ae2406a885c9f7a2cb135192197146781bd58016feca671d23d8cad3ec44ac229602198a97e37d1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785552748, "uuid": "945bd216-ab0f-4ced-9cde-2e50e896bb29", "value": "T198E6334C5DD006FEEAA3853CDEE20192A9AA7C364F31CDDB8790D6626C572E04C7D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785552748, "uuid": "dba44583-6a04-4d3d-85e3-c8131dfdb73a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785552748, "uuid": "ce7940c5-28fd-4a43-abe2-27756702e901", "value": "393216:EJcUcFrddsj0kxTwW8VphpXPXMCHWUjTcuI3/PGTAI:EJJLxH8fhBXMb8QH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785552748, "uuid": "ce79cb58-5e15-4436-8b2c-ea3e5ae87c81", "value": 14280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785552748, "uuid": "fab56f05-b673-43fd-a720-139060c3c464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785552748, "uuid": "91db3db1-62d4-4a02-a813-c36d33c7f49b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b5f0bf-8d7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785571299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571299, "uuid": "7c338e09-848a-479c-87c7-4d90bea0210b", "comment": "Malware payload (Mirai)", "value": "ee6eb6ba543a78430c52de0b20c0bc71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571299, "uuid": "6acbefb8-8139-432e-ba90-e7fd1c03ebd4", "comment": "Malware payload (Mirai)", "value": "92cbd7a1283aeb05c1e5bf3ecb1d69020c45a90fc3035081d8600180e192c5ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571299, "uuid": "84992273-0d3d-45d2-8884-7149f1c9ac82", "comment": "Malware payload (Mirai)", "value": "23074c106724e76b2060e8781bfa6e0571a1e60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571299, "uuid": "89ecabae-93ec-4c67-9a1d-8dd530a0e21a", "comment": "Malware payload (Mirai)", "value": "d68322a0d1293397b9f012044477fe31b044fc5d60264ad3acca8b05b3b8eb9ead50ec01af44f5775a1374b20a87e805", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571299, "uuid": "1befb1e2-0730-423a-a759-ebef89950bb8", "value": "T1A213E12ED2658F98C4B912F0C6C2B91D6B0D940EA25CD7C70EED3037582AF66AF107D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571299, "uuid": "8f5322cc-a4da-4ea6-80c0-f52b09cdfb37", "value": "768:hn14vjR3SpuPL1TnCeTFB/ib5j3byQDOO0gXAyNf/HhpPM5nnbcuyD7UkWykkAM9:hn1i3NxTnCeTF1ib5j3bpOO0SbHH0Nnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785571299, "uuid": "09f4d449-7e96-431b-913a-66af2c9b5ccc", "value": 43884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785571299, "uuid": "ca4ec2c4-ac57-4766-b790-efa1fc274ee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571299, "uuid": "4d47d224-29d2-4e88-b4b9-558927681706", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0636b022-8d7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785569065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569065, "uuid": "3a5c9277-75a9-4c33-b51c-e067d02556cf", "comment": "Malware payload (Mirai)", "value": "7ed7d31ed6c224fb5ebb687518625d3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569065, "uuid": "0803aba9-f8c0-4488-b93b-b87665a3af76", "comment": "Malware payload (Mirai)", "value": "92cc7bb38c35e0d6c610c12b9fe63cf03ab882c1bfd66b2be1c5cd9803739c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569065, "uuid": "7da45570-f1e5-43c1-86f4-da0b87730c1e", "comment": "Malware payload (Mirai)", "value": "6484baeb47cdda8c91a621fae447af7340d6e30c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569065, "uuid": "42a26a1c-c48c-42f5-baa1-3b38d70175b2", "comment": "Malware payload (Mirai)", "value": "6102a80273f729427fbeee357a4cf710656b799def8d2d2de27afb0f42f833cbc69f222a267e8d484ebd82c637f8e93e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569065, "uuid": "5c45251f-14e5-46d4-846b-30998f1e66b4", "value": "T1BB144B99FA0F6D42F1C7D2FCDE4D8BD13A2730E3D7368A656D0203EDDAA39995940902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569065, "uuid": "aa6538a4-159b-4ea1-9a23-1f7c4e527bd2", "value": "3072:DHcAqep369iWEdLOK7BfJtjcwtcPPRJxtxNOm7KT6PWlO0N7Mddfjq:eaBZJtjchP/xtxNR7KGXm7wfjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785569065, "uuid": "518798e8-a731-4dc2-ab04-de636a143cb0", "value": 198544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785569065, "uuid": "2e6519d5-d191-4d8f-a391-5a02d54b27f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569065, "uuid": "0a8b8dc7-5c58-4ea6-9574-5f4571d2edf8", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea08b89-8ddc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785611197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611197, "uuid": "bf95dc7c-f984-4a9d-b27f-5033348618d2", "comment": "Malware payload", "value": "ab70072d3eadeee594363e715a438955", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611197, "uuid": "43ebcdbe-0758-4ecd-9824-db174f745bd6", "comment": "Malware payload", "value": "9349f4127c21baf73979c2a7d4a47d10065b2c3c32474314ade38c058d51ca23", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611197, "uuid": "fad28397-8bd6-4446-a033-df5d0e09265b", "comment": "Malware payload", "value": "8f83fbd8b6d68d3e6daf4afdaa2d691f40b0c0a8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785611197, "uuid": "b6bebcad-23b8-4c6b-b266-96f703b56c29", "comment": "Malware payload", "value": "ce8254dcae6634fedf7633a2c9bc5f7809b31c46734f5e84579e35f79f2ccc6fa4173bae8860f4f9b492e2d050ce3fb8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611197, "uuid": "87e1ee8f-ea56-41a9-a39d-09c72dc46721", "value": "T16DC27C956E867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D9A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611197, "uuid": "7c7aacf2-a383-4eb6-b23e-736452369be4", "value": "768:K8vCB+25j6es8R29FYpMSUpi+20qUpi+20YQX:K8l25Jgd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785611197, "uuid": "70105267-384b-4abf-83b4-3e4276eedec5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785611197, "uuid": "c347652d-d1fa-4488-addb-cd14cba9397f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785611197, "uuid": "93559d1e-302e-4d38-8f40-8fc8a700e9a3", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb4d4fe-8de2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614148, "uuid": "2d9f1bef-29cf-457c-8ca7-e7b3b0dcf58a", "comment": "Malware payload (Mirai)", "value": "c77b36117c7543a1ac80974a7b4fb80a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614148, "uuid": "1adc5491-9ff8-4d84-bb85-88700934f22f", "comment": "Malware payload (Mirai)", "value": "936262b3ce5ecf728b8967cfa5da917a087d94fae488caaa74de57d05676b286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614148, "uuid": "647111d3-0af3-46ce-8f41-ee0f06c766ed", "comment": "Malware payload (Mirai)", "value": "3508ca2e225216f88cb1e610ce7e87df43a411ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614148, "uuid": "c9713a5a-0d07-463c-b0f3-20686e6dcfe5", "comment": "Malware payload (Mirai)", "value": "114f928a6014ed3dc1a298b354fac5f3d77853ef1222d02ddeb74b173619c516d16997a8894ded51cf309f81de59c05f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614148, "uuid": "b6416be4-46c8-43a8-93e2-8ebc2adbd113", "value": "T13D737BC6AB83D0F0FC52053121BBBB765A73E13E0169DA43D769A836FC12542D66B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614148, "uuid": "48efe627-7aa0-4b1a-bf1e-63ca19c88188", "value": "1536:Ued86d1IiQ/gRz2Kw/CR7sdW9SEJHG8HoxcH99Zbmem34At6doCZzoXYE9aOwBZ:Ued86d1IiQ/glg27sdjEJHGtiHf4em3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614148, "uuid": "bbe8cd70-c44e-49d6-93cd-f5a48410fb83", "value": 79472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614148, "uuid": "9549177e-3c17-488c-9e8d-200c1f01cdc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614148, "uuid": "6f54f0cd-a0ca-4997-b748-95e37d068b2b", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3217eab-8de7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785616278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616278, "uuid": "7fc6c0a6-ce0a-497b-b7ff-8693565916d3", "comment": "Malware payload (SalatStealer)", "value": "810610e1e52c5b789bafea7d5d4e1ce2", "object_relation": "md5", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616278, "uuid": "3de86502-e6cd-4c54-887b-58965445c6f5", "comment": "Malware payload (SalatStealer)", "value": "93acec7eeff046efa957c819fed3c98eddcee365c276c62555a3f5ccb8a96a41", "object_relation": "sha256", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616278, "uuid": "7e3d8d33-41ea-44cc-a357-5d060b8078d4", "comment": "Malware payload (SalatStealer)", "value": "ef602380f15c5bb7aee218bf8c5ad42f2d4f0937", "object_relation": "sha1", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616278, "uuid": "57b1163c-c60b-4bf3-9fbc-fd7fb5b9e2a6", "comment": "Malware payload (SalatStealer)", "value": "6100aefbd5d280029d934f0cd9a7d0ccfc1bdb950e4af1b1d37d7455d03b97a640bd3017ccfaf1c3ef97318f73a75e13", "object_relation": "sha3-384", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616278, "uuid": "25e1c394-0a2b-44c0-a84b-d1660fb1e26a", "value": "T16D773349A86B131FC13446737FAD58303AE0722766FB217ADC0C6367A14A3675D0FA6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616278, "uuid": "cec6dddf-b156-46e8-ad57-108dffb4a7d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616278, "uuid": "df1b7c95-aafa-4213-ae23-639873f5be6a", "value": "786432:9NA7zlc0ePvQX65JkGdLkcsZwunrl4GOKFsQXqDOMP:9IKBPvlOAbyS6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785616278, "uuid": "c603d18f-b7f8-4993-a566-b2ee962bef0b", "value": 35113984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785616278, "uuid": "05b65c5c-a892-4056-8fa3-c906879e7778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616278, "uuid": "23a3fd4e-823f-420f-b72c-3c229e5569bc", "value": "BrutalPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0531c326-8de4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614590, "uuid": "e9f5968b-16d1-4376-8619-7676b3f0c741", "comment": "Malware payload (Mirai)", "value": "7ee6869cf2cf9e9e6e39443bc60b64ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614590, "uuid": "94650e55-7395-47a6-b2dc-abe8b117fb8f", "comment": "Malware payload (Mirai)", "value": "93b391240a65a4eb7527641145717e079c75c68993f8f583a32499b5d55798e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614590, "uuid": "86f9ef18-1cc0-43f2-b984-025f8cf76d60", "comment": "Malware payload (Mirai)", "value": "a7e665f22db334723f945c94540bfbdd41ce5615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614590, "uuid": "9d599ca9-758b-48ed-a497-d5a15f50413b", "comment": "Malware payload (Mirai)", "value": "20a6ffd228dd536253d941d5e1892ab89e99d4e683f60ef33a1167ffa5411a97bb8d2cef7ae40e56bb7a589f5f441950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614590, "uuid": "c2f6f847-b56a-4ea2-81a7-bfb7b0b9b5d1", "value": "T1D003F127D4DE8A2EF13D41305A9D2B59C870B66858D648F9FDC0243B6ED9F20741F6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614590, "uuid": "4191a353-35bb-44d3-bfe6-0bf3787da197", "value": "768:amQGwj/GA7TDBNOdSl6h7MHlCr0vbE6zLmDEIaR9mCuIRi1dVZp0jHx8FnbcuyDD:WNhY7EhzLmDEp/mCuZOjHCFnouy8Gya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614590, "uuid": "06e62090-b4ae-4b17-acaa-d78e84de63e3", "value": 38988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614590, "uuid": "4e61472b-3f7e-4e82-b893-88593cdff436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614590, "uuid": "0eb4ce31-70d4-42e7-8f24-e7e48d11905d", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d37aa79-8db2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785593155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593155, "uuid": "c9282d1c-1e97-4782-8de3-bcd7082e8dfa", "comment": "Malware payload", "value": "6d915b2d33d38fd8cd7e8a1e3442333a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593155, "uuid": "df79caf1-8e53-4238-8164-e5239b5efd5b", "comment": "Malware payload", "value": "94494180d3ac0fe9e54f4c7f7b2210976e895aa4ebe962978eefd61bda6dfa7d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593155, "uuid": "53a141cb-95e4-47e2-b1cb-045ebb4cea6a", "comment": "Malware payload", "value": "41e19def4d7651e9eb4181d2084d5495867b2a51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593155, "uuid": "428bebf6-aa8f-43c2-8b85-b6d6aa87eb2c", "comment": "Malware payload", "value": "1077ef6062a32b6cef0958aef6b993354882c4279622a9e839d844bd4dc8bb10fc5c3ba25b826fda315c9527941a6436", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593155, "uuid": "8fdcd2bf-20f4-4f93-b9b6-eae5f722e602", "value": "T1BFC27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593155, "uuid": "0856e2ad-9762-47ba-8ac4-a7dce95cb870", "value": "768:t8vCB+25j6es8R5l9FYpMSUpi+20qUpi+20YQX:t8l25JVd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785593155, "uuid": "da649d5a-552c-4dc4-b4a4-cdef8c992e1a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785593155, "uuid": "c8456790-5e76-4982-8dac-a1f4f2e2c2da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593155, "uuid": "14385010-0f52-445b-8ebd-a479d0d0781c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e63d71-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620450, "uuid": "054b8f1d-6fb0-46b0-9c34-4566b01561c1", "comment": "Malware payload (Mirai)", "value": "d563a4f89064fe239c5473e0e0c4b56c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620450, "uuid": "8207b7a8-4a63-4b16-8c01-bf6edd27715e", "comment": "Malware payload (Mirai)", "value": "96ad04740707bd7ba7a410e6e39997005e4e4b5e315acbfcc16ddeacaabe5c5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620450, "uuid": "36ea9dec-88e1-42d0-9f69-3963da2e2a2a", "comment": "Malware payload (Mirai)", "value": "9fe3f3d5598547b8007f952c606d7256ee12b2ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620450, "uuid": "20628152-1019-42ca-a81c-11ffcd46a2a1", "comment": "Malware payload (Mirai)", "value": "6f1895db31ded7ca6e44c6d9274d5c3dfc27da3e5e4a2dbee9b1db1451ead8c4fb807a54b94b47268368b42f2ad9eed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620450, "uuid": "0e017506-1838-48f8-af5d-973aa773531e", "value": "T10CB36DC9F647D0F6EC5705302176FB37AE72E4BA2328DA83D3A49A327C21641D456B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620450, "uuid": "27c9a615-1270-40c7-acf2-9a66c9345122", "value": "3072:/EqQwKemz+S5OCXUBnb07+I62mRs49CnBD:sqQwKepSM5Ro349CnBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620450, "uuid": "7f815469-43d1-45d9-ad74-a9cb181ff074", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620450, "uuid": "c8e7ac19-1cf9-4402-93a6-05db49d9cedd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620450, "uuid": "0b838de0-fb79-4a62-a74b-1f138463cdde", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cf08f8-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621627, "uuid": "2a3a7e8a-8457-4061-859e-d0af04e28876", "comment": "Malware payload", "value": "570ee0e670fd3a5c8c3ff8db0d199171", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621627, "uuid": "a9f42ce3-396c-4741-8c8f-2cf5fcbc9bfb", "comment": "Malware payload", "value": "96d65f665a5afcca661374d3cb28bdbece6e053bcfcb965858269f8987aa0e0c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621627, "uuid": "3155af97-4354-4ab9-bbcb-43ea5f16bd76", "comment": "Malware payload", "value": "d4299fe00ec5e5cf7064877a598bc291d1a33f11", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621627, "uuid": "92af81d3-e85f-45b1-896a-0f046c521435", "comment": "Malware payload", "value": "f0a89efabed42ffb1ecaf383419e96f77d3d1456461cb8cb082d6428da11fe5417e3d5a91cab75b8f87bc0b4ebd097b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621627, "uuid": "fdae732a-e69b-4c36-bebd-3806ace6b615", "value": "T1D3F08BED949640323F0D5437711A4C557602082F24B95BDD224E99635E0CFA8235EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621627, "uuid": "c0abc195-721b-4bea-9a4d-6323ba6f49b4", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQBTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsGBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621627, "uuid": "a11e5929-93ff-4fbd-ab7f-4de0c5603026", "value": 529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621627, "uuid": "063fdb06-cbc8-433a-bd7c-220c86f1a421", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621627, "uuid": "900acdc2-024f-4617-abca-151909550e1b", "value": "sensi_zh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c10a7df-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621715, "uuid": "04742e32-82db-4cde-9567-6a6d7090bb80", "comment": "Malware payload", "value": "4c472786d7e72433c038b79d7260c656", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621715, "uuid": "2d0cedda-4eca-420d-8b69-57d7860ffecf", "comment": "Malware payload", "value": "97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621715, "uuid": "bea6d981-7654-45cc-b360-1f4bbe2bcb17", "comment": "Malware payload", "value": "5f8ceb8ea609fc5fac6165258a403a0dbdc759b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621715, "uuid": "d8cea0cf-f233-4205-a72c-f1f7595905fc", "comment": "Malware payload", "value": "df9b5579b65ada194f73b021f81db095460a0d1e5db362721ddbe0df47c23c0dd44ba8b2f88efb52e9a11ba5032988c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621715, "uuid": "0bc3af24-0b74-4c32-beb2-1426a1cecc90", "value": "T16EF08BED949640323F0D583B71194C556642086F24B95BDD224E9D635E0CFA8274EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621715, "uuid": "882b11ba-02e2-42c2-a78e-647af53a7a41", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQNTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsMBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621715, "uuid": "392bb312-2c30-4910-ac48-e2d57481df51", "value": 528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621715, "uuid": "4de635d4-c574-4130-9e92-57c1e55d1195", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621715, "uuid": "f0504ae5-df6d-473c-b23f-2661ad1cb74a", "value": "sensi_dv.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa58674-8d91-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785579147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785579147, "uuid": "1532bb19-77de-4c07-818a-170141de7e72", "comment": "Malware payload (RemusStealer)", "value": "5db5b95c27bde6c4437cca24245f30aa", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785579147, "uuid": "7e1fbc54-da8f-4d64-9d6f-2c96145c8f66", "comment": "Malware payload (RemusStealer)", "value": "9a227c008092640c375b8eee5e43557f2cdb9dfe6a8cf55050cb3c4353df2e87", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785579147, "uuid": "59aa7cf0-e457-454f-bf8f-4a351424cb35", "comment": "Malware payload (RemusStealer)", "value": "0f1beb21d2de86b025f657d3b8eeba0b47d6e184", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785579147, "uuid": "b87a20c5-40d0-41d9-a17b-28047d77eb1f", "comment": "Malware payload (RemusStealer)", "value": "eecd1d66a4f1f673522d0ca012761f4c3217c731fc8609484b49be5550be190dec7f60f9f5ce3100c71cc84d3cd65938", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785579147, "uuid": "16fcd669-c880-4a16-bfa6-b842600af102", "value": "T177E55A03AD914CF9C099A73A85B75616BB34B848473173E72EA0BEB92F723D05E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785579147, "uuid": "f5e5e6e1-df33-4ccb-9c54-783cd37349d8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785579147, "uuid": "1ef6737c-299d-49ae-9dfa-c9bff2db518a", "value": "49152:7ITdlynfCvoFP+sm+p2PdQlRzhPtrorCr+:7+erkPQZ++r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785579147, "uuid": "b1ac7fa1-4b44-4d9d-8dd2-cc38a13c1b30", "value": 3221864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785579147, "uuid": "05e72653-78f7-4f8b-93b6-c500de5eeb93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785579147, "uuid": "e93fe3fa-6ec7-4a6a-acb1-d69ec3e68133", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9b98eb-8dee-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785618953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785618953, "uuid": "027c4f69-abf3-49cd-85fa-f2e6c4bcf600", "comment": "Malware payload (WannaCry)", "value": "301b4c0650787760609a2f4535ab9ff3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785618953, "uuid": "2a900226-df0e-40c5-9f53-31b012c6a2b4", "comment": "Malware payload (WannaCry)", "value": "9be73437f744884e7ee2af167deb9ffb93551419c2ad9b4f8852d3f7c5f3bb8b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785618953, "uuid": "0af6bf5b-b347-480f-bf45-1260514c3664", "comment": "Malware payload (WannaCry)", "value": "f2930bf9aa785c2f10884dd59e814e33eef096fb", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785618953, "uuid": "86938b30-3779-4db7-93ca-870800c6741c", "comment": "Malware payload (WannaCry)", "value": "0b0345402a08be0837c1abfb662bcbe6f71ce3507c1326e164eebbbbdf470a7f8a8fe577c53757b3eeb57020ec5b99ee", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785618953, "uuid": "40227194-964f-4a62-bcf1-172b1f50dbd4", "value": "T18236334962BC91BCD0560A7580B74E27F7F3BC5A97F64B0F4B84867E0E537866BA0702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785618953, "uuid": "400347e0-a104-4f9a-8607-10563074643b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785618953, "uuid": "c54225ee-9ec5-4fe8-a004-bb8dc39fd35f", "value": "98304:DXDqPoO1aRxcSUDk36SAEdhCR8yAVp2H:DXDqPj1Cxcxk3ZAEmR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785618953, "uuid": "11f22255-255b-4221-a925-4236e4202689", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785618953, "uuid": "a5670b1a-8e0a-4cf4-baf6-1956e31703e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785618953, "uuid": "d9610fe5-1978-4bdc-b6c8-1dbf0b13c42f", "value": "9be73437f744884e7ee2af167deb9ffb93551419c2ad9b4f8852d3f7c5f3bb8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d02270-8dfd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785625427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625427, "uuid": "0e94556f-b050-4492-9bff-67d0072e8d3a", "comment": "Malware payload", "value": "94ec77ae0de759460f4fb1a4544dc302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625427, "uuid": "809da59c-cf9b-4850-9011-71fe3263c60b", "comment": "Malware payload", "value": "9ea600a96c3d6950bfbf5b98980bad957a88441307a1cb8e3c6a21b3bdc65d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625427, "uuid": "135fbe3b-155c-4fa8-b7b8-8e4fd227e1d9", "comment": "Malware payload", "value": "e9a14e56848eebb309e8a5ec3230a63ae53f9afc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785625427, "uuid": "9cc72c0b-343d-4096-a3cb-e24f3fab75bb", "comment": "Malware payload", "value": "d9f23fb5e428d6a721a4ba2dbeafca186b1ab718986c550db7286680982f4375fafd83f3af3d41b924687225f8b4454c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IronWorm", "colour": "#B4F703", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625427, "uuid": "b045aae0-3a94-4ca5-b415-fe9738f3ff12", "value": "T19D957D47F5E144A9C9B9CC74C30FE133E728B8859222752B2BD46B412F26B64EF4DB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625427, "uuid": "7c1f4bbe-5403-427c-985b-d03e439d08b6", "value": "24576:smmoodEfzjvFMnVIH06iyGyOxDRIv6nLXmSNTOmtYSeeBCtCVGvY:smRVwIU6i/VIv6nrmSNRtYSFBCtCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785625427, "uuid": "b5998d96-8963-44ac-98de-8492799152b7", "value": 1916896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785625427, "uuid": "0b5180a1-4440-49ad-8f2b-209e74ca16fc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785625427, "uuid": "e8dc8e50-b899-4088-92d2-02e984dac76a", "value": "setup.patched.unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cfe99d-8d4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785549690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549690, "uuid": "9193e183-33fa-44b1-b10d-387d3e37954b", "comment": "Malware payload (Mirai)", "value": "d40471aa330a6759937e5865b2dae1c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549690, "uuid": "51855758-5653-44a7-9636-3341f819cd65", "comment": "Malware payload (Mirai)", "value": "9f11e24531de2a3e5de458d335485805c725ca08ee27d60b66887676c36f0537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549690, "uuid": "018ef4f1-80c1-474c-ab84-5d16bdd7737e", "comment": "Malware payload (Mirai)", "value": "8c0ff7c24a247290a2e5b07990987814a57aae03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549690, "uuid": "8e1f7983-7f7a-4c59-8945-7faed3ef2c56", "comment": "Malware payload (Mirai)", "value": "2335beb6d4e93cb11f830fd084d7413ed3b7533ac2fe9458db098309cfb96ccfa6b9ab09a3a3b052226377550a4b698f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549690, "uuid": "4929508c-4373-4d86-8537-800be27db80c", "value": "T1FCD30A45F9404F17C6C265BBFF4E438D772A17A8D2EE72039A256F20379B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549690, "uuid": "b2b7bec1-1806-4f2d-a1cb-3ce5e86454ee", "value": "3072:yNhorO9tS34s3XyWhwedcga4bZAbwTZBr:yNupIKXyWhwEcglbG0TZBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549690, "uuid": "0085b0ca-8cdb-4c02-8c04-f13bdc33c848", "value": 138840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549690, "uuid": "e3185450-b82f-494f-a852-9a4bd879de58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549690, "uuid": "bf37b2be-2999-4a90-9fb0-191c53442bcd", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9567f6e1-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620415, "uuid": "629517f3-aa72-433a-a5d9-4ddc39e8d466", "comment": "Malware payload (Mirai)", "value": "050b46e4b0345d7135ce95cb65c7242e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620415, "uuid": "448d9284-8037-4865-b7dc-f41d4293d11e", "comment": "Malware payload (Mirai)", "value": "a0f65777186945557be82ff539ef0e58276e020f2c878d1da12a5728e046a02d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620415, "uuid": "0841b134-79f7-4750-bdcb-3dc0de8d2ff8", "comment": "Malware payload (Mirai)", "value": "d4081ea2c7c76201ddcffabc0fc8cc222f8cad12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620415, "uuid": "60c74918-641c-44b3-9326-fa5cf8095993", "comment": "Malware payload (Mirai)", "value": "cec93fad9c0624ec70b69b3337e7ffc9df1f40c6cc08e52f8bee968940ab4ca486b9866c956e08df9a4dd82323416933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620415, "uuid": "2e56549a-47ea-4e1b-895f-852569335442", "value": "T1CDB36C22B8391E27C4E098BF22F74766F1F557D914A8CA0E7E710E8EFF255502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620415, "uuid": "e83f3b26-e3a0-4bb6-91bb-9ab522ddbdf0", "value": "1536:XDjLJhrmcjF7V1Fnfnkzfw6PUxiGIjCT26bx9L2+5u+rA1zHtDEYm5w4cNJKtDL+:T3CctVmCT2MBu+ILFEYOdlL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620415, "uuid": "733c1a02-eabc-48cc-b455-0e42786a8635", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620415, "uuid": "cea915fa-b54f-4ed8-bcea-c7e11b281fec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620415, "uuid": "c4683853-e8b1-4e3a-ab1f-0b70a414ef13", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89f5830-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785547970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547970, "uuid": "a498919a-8553-4ee8-a274-e82e853739ae", "comment": "Malware payload", "value": "f1521e5ba67ca731ab86b379b6f31c76", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547970, "uuid": "c1ba1b18-8b3b-4d97-b61e-9d5282dd6099", "comment": "Malware payload", "value": "a21a25390ada2dcbc1b268a4ad45399e67af9e8bd540c9a313e1011e64229977", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547970, "uuid": "44e6c1f9-999a-4068-9498-7cd3bbc05bba", "comment": "Malware payload", "value": "4a9db92d0fe5200082d11b13fd527ef82ad32bc4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547970, "uuid": "93af4b65-6b8e-4677-9413-758c49d3127e", "comment": "Malware payload", "value": "9180138a1780c13ebe47bc8a574d057a9e64bd771dfb2ccb26d033b211e8af6de272d5a904e997d0d29cd9fa5afb7487", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547970, "uuid": "88f196a4-9a80-47a3-97a5-7930e73a0b1c", "value": "T114236C6516857C14AA98C4375C7E2F0CBDAD43E6314492EE7FCB3CF28C4AAAD920875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547970, "uuid": "3ef6ad70-7a58-4bb5-abaa-a1102430457e", "value": "768:29NyXsZztCk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:2HusZccr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547970, "uuid": "d1ef3059-b130-467f-bdfa-7248c1865c12", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547970, "uuid": "3080d439-2e81-4bb8-b8b7-a6b6e9e81a7f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547970, "uuid": "3edac70a-cd13-4724-8bba-bdfaa7a078c0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59fbe20-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566863, "uuid": "57d063cd-9cec-49ec-ad5d-60d82c177631", "comment": "Malware payload (Mirai)", "value": "e12402d37b430785e5ee9d3f71e43dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566863, "uuid": "bc4e4f7d-67e7-4f34-b1f8-80f7a2759967", "comment": "Malware payload (Mirai)", "value": "a22090d7d906ff47407f66c0e478aef8b08bd756caf1a9be79b23eca57d285cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566863, "uuid": "84fdd457-083a-43f1-84f1-7df93807ae04", "comment": "Malware payload (Mirai)", "value": "d0a7fd425f7bcc234eeece235824eb5c8b975cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566863, "uuid": "290ca97f-fe09-4ff6-864e-22c231cb17c5", "comment": "Malware payload (Mirai)", "value": "f6b9d8dc21d089a24628c835f4e0dc91ca6f1dbac700d296d59ba8b186ef72b4ae3cc814d78d64a8b21bfef0b8ab3714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566863, "uuid": "75d9ba32-d45c-416d-b874-b1915ef0ec9d", "value": "T10A63D819ED782A17C5D1223604E74A21E67253E91BBCA68F7EA72C0DDD58320313EDDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566863, "uuid": "0bf41116-b272-4106-87d8-c8b569f8a13a", "value": "1536:BlRzDzj9zATOqgu07d5jOcLSpEZDu1urPLgA9DWl:75RXRn7dpLSyZi4FpWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566863, "uuid": "c9b43c5c-a87b-4abe-bcce-179220d7c478", "value": 67764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566863, "uuid": "bded78e7-159b-49cb-b805-7a7c87bbaa65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566863, "uuid": "d0b814ce-f9f3-4c93-a30d-40f40dfab3b7", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15c1742-8d76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785567688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567688, "uuid": "3c64e9eb-7e27-432d-ba6c-e9bc8f6a32cc", "comment": "Malware payload", "value": "8049df5c3fe8d35687e183aafc16d6ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567688, "uuid": "b972b2cf-33b1-453d-af83-be81f0d80cb7", "comment": "Malware payload", "value": "a246a03ba697bd9590704bad2b2bd7aa3b25f0f3ea94b42ce89e178d843f4beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567688, "uuid": "39bfd706-e7d4-45a9-8986-67c4291c6aa1", "comment": "Malware payload", "value": "b842946fb915dc347d70d8216f473db3a75ec7dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785567688, "uuid": "d5d25c3d-879c-4f90-bd55-7ee136eef430", "comment": "Malware payload", "value": "94239f7715c4d0ae159e5c65bc73c2996cf187e0303f62677ec7d2cee47074086932482fbf878551e7b6073ecd41790e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567688, "uuid": "332a4888-ae3d-4e28-8284-cb437900ab92", "value": "T1D2D40B0AAF400EFBD82FCD3705AA0B5635CC659732A577353174DE14BA5EA0A8AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567688, "uuid": "c7280403-1798-44f7-9bcf-6e91c4ca5fee", "value": "12288:yzrB+7IoDyTnJCX0CgM8F5wozL3STzeQ:A47IoWLJCX0CgMA5wozTmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785567688, "uuid": "7d3baa82-30ae-4107-80de-db13ec17a549", "value": 652468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785567688, "uuid": "bcc78bb7-82fb-4a33-a179-1306025895a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785567688, "uuid": "54c22efe-f4d1-43cf-b35c-9a953ded1d5e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af55940-8d7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785570442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570442, "uuid": "9b56e7f4-bca6-4a51-9022-48ed3d8d8524", "comment": "Malware payload (Mirai)", "value": "1ee2408f8eaef7626591a9e5bbb45108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570442, "uuid": "abd73034-a919-4ccf-8d34-1a51cf47a4ef", "comment": "Malware payload (Mirai)", "value": "a42bc2b1c97c01e02a96622e68631a75c9d74939d56bd73c61877110c97c37d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570442, "uuid": "7a0f93f4-8b4a-4e42-bdd2-419196ba7911", "comment": "Malware payload (Mirai)", "value": "810bc3e737e8553b3f674502ac628b901278c1d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570442, "uuid": "2afdef37-392f-41ca-a52d-07020cacef23", "comment": "Malware payload (Mirai)", "value": "83d34a7f1bec43297a9dbce1e1ec240787bd7f7c1230e4599bd7637dfc40be91cc05db030ddaa20faf3f1fdcd4acbcf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570442, "uuid": "ddb3ee5b-282f-44a9-a2a4-1a2b6d51ea74", "value": "T155443A46EA418B13C0C717B9B6EF42453333A76493DB73069A14AFB43BC779A4F26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570442, "uuid": "05c4094b-8ec6-4d5a-b4ae-6a8a25481525", "value": "6144:hVYvAZ8sBaI6ERrJGibBfKauyFYTsQgeXGtR5KFo6M/RvUmiU22IMpTxM:HYvAZxaqJ9BfKauyFYTskcR0oD/9Umif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785570442, "uuid": "12728064-0ff0-4547-9a22-68d64bd535a6", "value": 259611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785570442, "uuid": "ce958dbd-d00d-49b9-b44f-ca8e5f220a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570442, "uuid": "dea6589a-42d2-46e0-94c7-4f145a307bfa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d997de-8da5-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785587746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587746, "uuid": "10410b5b-9ded-4340-b165-3652d3ba13d8", "comment": "Malware payload (SalatStealer)", "value": "63d711bd0e3f33911c28fa2fd0d9fb76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587746, "uuid": "7ffdf2b5-c92b-4fbb-865d-933d5870a975", "comment": "Malware payload (SalatStealer)", "value": "a536b532e5ebaa0617688a42b5543b0a7144817e0dc12020826d74cc9b22c5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587746, "uuid": "fd8484e5-c402-446b-9f51-3180803b947c", "comment": "Malware payload (SalatStealer)", "value": "f5b846ec64cc86321af26e3a16606ed3438cff9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785587746, "uuid": "22d88d84-4fe6-4b0b-b664-8bbfcad148e4", "comment": "Malware payload (SalatStealer)", "value": "0900f47fc3b0fcba3a243a868e390366b97ce07536fada8d4153d6940011b7d769766335db6690a6f1ceb3be103ee656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587746, "uuid": "4127a05c-ec24-47c6-8601-71c55bdc0864", "value": "T104F533E504BC0EE7C9D6047D3647E1832AB03CA1C2CEC19A14EB52D94F57226799F6EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587746, "uuid": "6cdecaa0-3e10-4bcc-a1da-d41c93c8f568", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587746, "uuid": "05625b51-074f-408b-a7af-f8722103afe1", "value": "49152:lrI2FBS09+kd7lmX09RgAr2mVXTHC8Wsn0i+nRSTyGC1e4GcZkJVwkq/6eAm/4Q+:lrIMRgAfVjQ5iGRJGCttkSUVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785587746, "uuid": "95415229-56b5-476a-8d9c-dc7ecc4e3bb5", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785587746, "uuid": "c1ba6fbc-200d-4947-ba27-07e3ffe5657a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785587746, "uuid": "bd91d9a3-6418-4439-a407-8de08a29be4b", "value": "Zapret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5110a3-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545158, "uuid": "8b1408b8-a5ae-4c5e-b0ce-65269ef4d260", "comment": "Malware payload (Mirai)", "value": "69489f3f0e69a590454bb07b9001c7b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545158, "uuid": "c934ba69-6de0-4ae3-a7b9-628b8f764e7b", "comment": "Malware payload (Mirai)", "value": "a555e7dc1115168594e7cbedfd1e41cb98d7d7daaee41002b9fe981a3cc16aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545158, "uuid": "f5a6ce06-8f8f-473e-a2a0-ce4ffcbdd1fb", "comment": "Malware payload (Mirai)", "value": "09513414a8a9bc436a3ec7ca5e02138480b5b8d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545158, "uuid": "da51d869-77e3-49c6-a8d8-9ec855e8972d", "comment": "Malware payload (Mirai)", "value": "329a5a61e3582c7411ee0f8233d146fa809c9b9907530d430daa522442fb73e5d7a1a4b6cbf33b97a98a5ac79d05074a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545158, "uuid": "0f50eef5-bbcb-4dfc-a600-c41ace32b779", "value": "T12A935D02B70C0E43D1675DF02A3F27D1D3EEA6E121F4F688691F9A8591B2E335586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545158, "uuid": "b72c8ce4-a1e5-4f1b-91ee-75588f5a1abb", "value": "1536:GFsCCOHrTgbrkoUV4SKUgZ5VvHfNa0Y0uM1y3pAzKYbqpSVMuXyCg7cA/kx3B9e:LROHrTZoUqk8wAzV9MVCEOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545158, "uuid": "55747c5a-98c0-4fa3-a56c-697ebcfd347a", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545158, "uuid": "69cd59b3-e488-439e-892f-a1c4562c6df6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545158, "uuid": "01859384-c967-4262-ba2f-16001a1ffaf7", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befdc2ff-8d4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785550477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785550477, "uuid": "6038652b-0123-41d2-b5f4-bfb3bf466c1f", "comment": "Malware payload", "value": "b44a28b1ecdfbc123c404737740d1420", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785550477, "uuid": "386ead11-5280-4e13-909a-f1ce28271e5e", "comment": "Malware payload", "value": "a58ad957ea509d4bb8f3a0a274601df61d49e26a605ca2df559d7e7cf1d024c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785550477, "uuid": "5dc6dd4c-4020-4f79-b337-02b69f1ec1e8", "comment": "Malware payload", "value": "8377dd64472b3a8557f470a52d91f4623c395e92", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785550477, "uuid": "373a2a57-d3ac-4868-9c65-13335c6d4ab4", "comment": "Malware payload", "value": "54e2df51f126807fb247dc58b1f821e2cfd633d66993389744b0082204314d2727ee2efa82222a68c779f8ea08e9a42c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785550477, "uuid": "3b7066e7-232c-4d56-96b2-1b9d97eb1405", "value": "T1A6235C6516867C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785550477, "uuid": "919a7467-dd84-46a2-83b9-e1722c9b2fd0", "value": "768:u+T9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:u+0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785550477, "uuid": "e2c0b81b-91a2-424e-9ce6-8a741be70f9f", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785550477, "uuid": "46ca0928-312a-46ef-bcf5-de1ef8947ca7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785550477, "uuid": "762d2e14-ef24-4f59-b4ed-7d0b7e24a848", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0bcc90-8d79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785569018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569018, "uuid": "a8ea6d35-0c72-4f5f-b581-4f92afbf43fe", "comment": "Malware payload (Mirai)", "value": "5e8aa8d2a1fefc5456cbee0b25a6ca8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569018, "uuid": "ee78c695-181a-4524-afeb-a81892636fa2", "comment": "Malware payload (Mirai)", "value": "a5d86ea0f56092f8c135f45e1823a0a34ce7ad835a4bf581cd881ffaca9984b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569018, "uuid": "e04e20fb-9aa3-49a7-b1e4-8ed9713b4c0d", "comment": "Malware payload (Mirai)", "value": "a4cc32fdaa86a94ceb960c40086d465422eb7a7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569018, "uuid": "b52be941-872c-44b0-9068-131b354b4ad3", "comment": "Malware payload (Mirai)", "value": "305bb56f5f115bb23921a7159b4ab16d947be250217234534959910ba545749325e78a210680c4ed272ad65ef47275bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569018, "uuid": "899833c5-aa7e-491c-8769-624e14adea2b", "value": "T1CE4302C5048F17F0F8FD147A9EF94648AAF805DDF0F1363A5894CE6A2958FC5009D6A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569018, "uuid": "0d428e2b-fb33-432a-8514-3c46990df461", "value": "1536:zCZY5n7hesB4gDTfVKs2egETbAFAByiTCwR9Nzr:zPWsagHVlHbAFmyi+EfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785569018, "uuid": "8d897ab0-934d-408c-bd9c-81056edd5036", "value": 55684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785569018, "uuid": "a1559096-76ef-46db-a111-ffe1aeac3be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569018, "uuid": "d1b72dff-8c36-48b9-9413-93a1ee6d6ea8", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291d4fcb-8d3e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785543354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543354, "uuid": "07122467-2380-4606-830a-2d257da8d82c", "comment": "Malware payload (Mirai)", "value": "5e867ff01638fdf4861b292a19452de7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543354, "uuid": "95c83182-d64d-49d2-bb39-89f46c7dad35", "comment": "Malware payload (Mirai)", "value": "a7f3f9d9d14437727b3f75617fd2e469af27180be54b90c5a47387f30ba426a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543354, "uuid": "c5239e90-9f49-4d6b-ad32-4a4b1ac5f855", "comment": "Malware payload (Mirai)", "value": "3e7a1efc18b875c9d0bf474ecbe8c6d0885dea7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543354, "uuid": "d95a0a17-eea5-4caa-a1b9-2caa22af1378", "comment": "Malware payload (Mirai)", "value": "59895ee2dc83ee28ffa0b2b45521addb8511020e85324930424c8c5d2c01ab82e2e32e0088ea255047c06ccb5e72ddbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543354, "uuid": "de28963e-84c1-4d08-b072-07ed96d320f0", "value": "T1C9B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543354, "uuid": "809bf778-4c7b-49dd-b8aa-935ca160b437", "value": "3072:bdub7djS5HEC8VQb1KhRhFczcmVRh865xH:bdo7djS5EC3KozcmVRbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785543354, "uuid": "8e956af9-0ca6-4505-89f8-63ad7b0ffae8", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785543354, "uuid": "d896b36d-4c4d-4f06-a65b-f2310329a38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543354, "uuid": "eaafb15d-a9d8-4585-b074-7e95268b7a4c", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd0d5e0-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620426, "uuid": "66694d64-5ebd-4c64-abc9-25f4bdc55ece", "comment": "Malware payload (Mirai)", "value": "40b9a5af4e9d056f99c746761be01abc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620426, "uuid": "c624e2c2-52de-44d2-b765-8ace40da927f", "comment": "Malware payload (Mirai)", "value": "a80eedfadf36a2c5423abdb5aa4033c6dc88e477c45d02c1e45759e0e5028c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620426, "uuid": "43401c87-3cb6-4ad3-958b-ed8798a16358", "comment": "Malware payload (Mirai)", "value": "b2b3e45e72ed98864c12e58a71b0a6e107e835c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620426, "uuid": "5766d580-9196-4aa0-bf1e-c377d57db4c9", "comment": "Malware payload (Mirai)", "value": "82915e1a619149135f8d5076108a70df5d293e0cea155826291abf9acdd37dbbfc6ce2ceccac3a4d15f729c7008cddf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620426, "uuid": "e8d67720-34cb-4334-a1a6-2ab64709cf3a", "value": "T10E23F16299AD2F44C8FE5430444EBB8666DC79447080E6B287D09037E9FBF5EB428FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620426, "uuid": "1f6454fe-c7cb-4989-9ab8-450808268679", "value": "768:J3SKn5AzlUYOohz7F//JH4lZQggefNgqBTANU3yH9NoOxkSnbcuyD7UHQRj0:J3Sk5Ap5OohFJYlZhge1gQANoy7LkSnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620426, "uuid": "f317a5cc-cf86-4322-8f80-ed52bbda78b0", "value": 46912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620426, "uuid": "542534fa-f496-4c58-9ec9-d0735beb495a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620426, "uuid": "c4971545-54da-482a-b318-2e00725ecdd3", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b173e53b-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620462, "uuid": "312d8d2b-bcec-4564-b860-44c29e9a30d8", "comment": "Malware payload (Mirai)", "value": "885894361f0d130388f563df9f1db4d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620462, "uuid": "5b73b85e-2ff6-4b52-b9ef-2d57ba8aaa71", "comment": "Malware payload (Mirai)", "value": "a8eebc74628e2b5072fd0a1d9aa7fe72a313080c4c45b5c9ae7dfd7669839c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620462, "uuid": "31ecdac3-488b-4c1f-8da9-8ba1b0f2d6b2", "comment": "Malware payload (Mirai)", "value": "051484facd95190b7939f551a088bc8c032ef94c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620462, "uuid": "017359d4-6525-4689-a464-ae9cc5061b01", "comment": "Malware payload (Mirai)", "value": "b2aeb76211a88e193c5c38feba2a37c2e1861b67da07f7536e5eacd8b9e2b259db0b0f812e791bd238121f79dc88dae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620462, "uuid": "2906aea7-f784-4115-af74-c21bc0d21db9", "value": "T164E3E71E7E618F3CFBA9C23447B78E26965933C637E1C585D1ACDA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620462, "uuid": "63589f69-b26c-48a3-9859-265e6a89008e", "value": "3072:6F+6uk9hckUGXZy9q/uleW0AJsPQDfHFwLH6EDq0Rp6+P+po5C5DB1xnXtJji3fZ:6F+6uk9hckUGXZy9q/uleW0AJsPQDAHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620462, "uuid": "5cf50019-36bf-46b6-8bda-df0e02e96151", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620462, "uuid": "42db19ae-9f46-4694-99b9-aebfeed5cbf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620462, "uuid": "dc9d7af4-e096-4a03-bfb5-b05e69fbdafe", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c0c446-8e04-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785628395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628395, "uuid": "e1cc61d8-b03a-4668-aece-fb6efb71c116", "comment": "Malware payload (CoinMiner)", "value": "be2f08950440b3bb987fc5d0999b3f1f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628395, "uuid": "05c5a79e-178a-4de2-b74d-04ae9e77ebea", "comment": "Malware payload (CoinMiner)", "value": "a94e9aca1aca0c7e006a0d8684c5423b1a3bd7e48734eee4f12f0caa3b5d901a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628395, "uuid": "88767080-4c02-4075-a83b-c570f22839bf", "comment": "Malware payload (CoinMiner)", "value": "689a96b72e20cc501fa145637d1cdc3f76d68a3c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628395, "uuid": "464e4afc-7596-4b82-be41-d2ffb187b7e7", "comment": "Malware payload (CoinMiner)", "value": "78acc2157bcf628fc6a7983819c54b58b15f2eb9122e470f72bfe0b535f14647b4965f6b6129605f7c6cee8e1e74245e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628395, "uuid": "2fa1d599-9ea8-413a-8759-2e9a6736209b", "value": "T1AF36338A78CF6074C48BC7A5853A306DB075BBE55B647C0A7FCD54548EAAF18A43C3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628395, "uuid": "42c7e5a1-44ae-4e37-855e-153487bbd86c", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628395, "uuid": "29f92738-c01e-418d-82b7-cb5f794ff909", "value": "98304:4cOQTlHoQK8lS9TvPcBI2jJZcTkGZ2NRT+2lqGWl0bzcncr/YQBv:4JQTKXyS9rPyPrHT+2sVWHcbQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785628395, "uuid": "cbaec6cb-e0da-495e-b1fe-ed7f128d142d", "value": 5210112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785628395, "uuid": "eaa76b64-f5ed-4d96-a1be-46c87c4e8863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628395, "uuid": "b2454176-1eaf-4858-a79c-b31e995b26c3", "value": "SecuriteInfo.com.Win64.Evo-gen.64356642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad0340e-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785547893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547893, "uuid": "124db28d-ba91-47b9-adef-e1570b411cd9", "comment": "Malware payload", "value": "75167ba41e8b6fc13574b3e67392052a", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547893, "uuid": "bff6e61d-71a1-4254-b769-e88874c68b3f", "comment": "Malware payload", "value": "a9c3e1b23a6a102016c0a8c35b198e4401bf75cb28e4ef8b9ddd5d0e93a09c5b", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547893, "uuid": "9ac7a98a-81b2-4234-8bb0-c2fe0f08dca1", "comment": "Malware payload", "value": "cb965dfcf5164b65ab50844ddfbf311ed1d07a9b", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547893, "uuid": "1da3695e-1b29-4d82-87c8-84ef87482cac", "comment": "Malware payload", "value": "e9a69966d834b5476daff9577af18314b693f7d789dc784f6ed1a49142a11182af88612f61c1b3b78aaa324ea2faa9d8", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547893, "uuid": "16a82af6-a605-4c7b-86ab-6ed5c67d0dd6", "value": "T134D52289FDEB6670F472C7F747A321AC706A379446B44C5EB2D86B006E52528AC37339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547893, "uuid": "76017bd1-046d-495e-b34b-3413306eb268", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547893, "uuid": "0671044a-efd1-4fd1-a3f9-90f2e5cea12e", "value": "49152:C9YcUwTswSecahmiW5stBw3Ec1h99wn0ampZbHwjx1U7jDnQz4t6qXc:2TsVmTRaL1n9HfbHwN1Uf7QzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547893, "uuid": "aac5e23f-300d-440a-b2dd-73ce3eaf8d91", "value": 3006464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547893, "uuid": "b4ef2073-54b9-4076-ab16-62972b28b99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547893, "uuid": "f27a8e6d-3a3b-49c9-a014-27f22c9383a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32431e4e-8d66-11f1-bd95-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1785560549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560549, "uuid": "a7a71bcf-d9c7-4fe4-bd9d-0390ca331244", "comment": "Malware payload (Amadey)", "value": "7b0e7c8cc9ca514381a6bfecf879b650", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560549, "uuid": "a46e6771-5150-424c-9856-3bf6ba9c9720", "comment": "Malware payload (Amadey)", "value": "aa3ec6bd662f64b5471ba79945d9e620adb66cae5e2887e44eea03d8abc99c73", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560549, "uuid": "7fdb2640-e8c7-49ce-8aca-cf694a601587", "comment": "Malware payload (Amadey)", "value": "e1c1a8a9d67b3dc8cdce7f357dedf81cfe360ec1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560549, "uuid": "66a92745-ca08-474e-9477-2e99afe03dc3", "comment": "Malware payload (Amadey)", "value": "3111b4e9d6d4e128b90858c68f8d6f238df9f628849fa05a5f345a01de83350f7b0a3fd8aa80aadd87dcdc21fda2843c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560549, "uuid": "98daec33-616a-4f93-aef6-083cbc810783", "value": "T130450B8ED59257B4B382FB63521EDA225DF6324680729A31CF453E364F02F34A129EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560549, "uuid": "5e42655e-c54f-4a07-9fd8-79fc36c4d4c3", "value": "6144:g8iG8Xp2Ee6pk2q1h4ZGDecJt/XYjitMaazLx6qtstbBDT4SVBcnnILHlTc1rBXZ:cg1nD6jaakTc9VEAFC02SpDsaMOdVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560549, "uuid": "5441948d-7db1-4353-a4e8-3b8376980971", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560549, "uuid": "15d1d85f-f8d0-4788-95da-4475a411c92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560549, "uuid": "af1cc7a8-2ea4-41bf-9ddb-6324a54f13c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e97d40d-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785573159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573159, "uuid": "ffc54004-c57d-448b-8254-fcd2480712b9", "comment": "Malware payload (CoinMiner)", "value": "532681b62d584f899e8eed3e8b1411f2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573159, "uuid": "bee07e6a-afb9-4132-98ea-f2cf43af344f", "comment": "Malware payload (CoinMiner)", "value": "aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573159, "uuid": "30644e1e-0d00-4b8c-9e80-b2d1794a6812", "comment": "Malware payload (CoinMiner)", "value": "88b73b8c6ed66bfb6e8421836bfdda30197023a2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573159, "uuid": "758d46eb-6ea6-4d28-b208-cab6a67b57fe", "comment": "Malware payload (CoinMiner)", "value": "33ea7c971a64e81bca5c34016b071b788a3b38a2bc032df71f06c9ba36d12e3f44d57ebd14f4b41e24bc5580eb984048", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573159, "uuid": "f76c2b4d-ac87-48da-9d46-4f00e25db63a", "value": "T1CB36338628CB05F6D1A2CFB9C296B9BDB27BB7620521BD0235CC2958CD1BF08557E3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573159, "uuid": "8cba3145-8e95-4a44-bbe5-173ff38b5cfe", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573159, "uuid": "d1626c32-9148-4a3b-af5b-57585cf0c4db", "value": "98304:SrI3957+cy4DUn2CXDEzKMfrB+zmjSI+4c/RjhDQUzp8Pb700lcIiQUbqae1H8BQ:SzcpDUnHAzvhnc/RjhQ170r/mOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573159, "uuid": "ee41fdbd-771b-4ec0-9218-7ef6b5fbfc3e", "value": 5224448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573159, "uuid": "fea8e0a4-603a-4ab9-8935-3ad8da651d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573159, "uuid": "499d9dcc-a63e-4c94-bcf6-eae62b61a7bd", "value": "SecuriteInfo.com.Win64.Evo-gen.49237433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58f7453-8de9-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785617060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617060, "uuid": "b3f6622b-d2cd-4144-abd9-6cb18f70825d", "comment": "Malware payload (SalatStealer)", "value": "1434d6d230e62adfc6f2a4d6f31d465c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617060, "uuid": "407d96b8-408d-4dfd-92c8-fed53e819dcd", "comment": "Malware payload (SalatStealer)", "value": "ab79affe31326c3a59b74a3aa4863207251deb7279f02d6177cf3a84031b2162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617060, "uuid": "bd971901-6493-4392-87c2-89c44309526a", "comment": "Malware payload (SalatStealer)", "value": "bf8e7181755cabed4958cd9508acfd9403fa6f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785617060, "uuid": "d7478e2b-a623-40ce-ae94-1a5960a07c8e", "comment": "Malware payload (SalatStealer)", "value": "941b21ffa42eea59699289c7e59e1f660744cb94488794e23bc640fd272cccda0cb3d88cb4137b147c235b94b135d69a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617060, "uuid": "cb6c93a9-d729-4bf2-8b6d-d768faeaabb2", "value": "T1ABF53350F89D2A11E2A70B3BDD4C1D3FD67E6E8792948C8EFA4D1248F683564E383539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617060, "uuid": "4ff671a7-3bf9-4f5e-b88f-968b7a250f92", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617060, "uuid": "634169ee-99d8-4bd5-afa6-a87ff8597ae2", "value": "49152:GGt/n9evLbq8ylGYw7lTMwJeq7pAJEkujD0L5QBKcoMQsTmLkJdZ/vVdPuAx+0DU:GGlSLbOhg9kGCGjD0FQ80MkrFuw+0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785617060, "uuid": "aef62622-61ee-459c-9047-04d26593271d", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785617060, "uuid": "51cdda72-a2fa-44cd-b416-4045b6cb1284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785617060, "uuid": "ee886312-2c3f-4155-9b31-f02548c0befc", "value": "Obxod Ds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd51dee4-8d95-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785580969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785580969, "uuid": "92849549-bfe9-4ccd-ae79-25457214d4ad", "comment": "Malware payload", "value": "08f7cc298a5c451af370ae2a7759b6da", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785580969, "uuid": "9dc1b774-b80a-4909-8eed-8c166f55b130", "comment": "Malware payload", "value": "ac0ef032165f08ebf92702b3c401b801e944638c81e979e29473897c69c35dff", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785580969, "uuid": "dcba918e-2621-4f50-af61-a53e4e47556f", "comment": "Malware payload", "value": "28109b5fd27a45821ff3e264888cd55f6eeb96f0", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785580969, "uuid": "71c8e385-db31-4f52-aebf-21ecf22cfd10", "comment": "Malware payload", "value": "3e314ddb101e36c2a6d3c592de7c722df90f9cb556b3a56dd936350aa0083b346c9e9843f367f7c14d44df21dd26b19d", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785580969, "uuid": "7aa46376-bb8d-49f5-9fe9-10977b28912e", "value": "T137665B07EC9554E9C0AE9134CA729653BF627C884B3123D72B50F6283F76BD0AEB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785580969, "uuid": "57d243a2-b61b-4ef3-a311-b5862c486afa", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785580969, "uuid": "ab364658-8e90-4ffd-a99f-deea3005a330", "value": "49152:CcZ0I7oUdU9IhX7sv1vLUflOAKky1p8jGnHO71RJ0yHfUFXqCLOrj5IAcrwL1EK9:CcK+j94iDyq9iyHfC1L21NtyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785580969, "uuid": "73ada894-4797-4302-9a47-a1783c0855b3", "value": 7071744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785580969, "uuid": "77bfb80a-6395-46e0-9378-fdcfe3907dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785580969, "uuid": "59439f22-24e0-45bb-bae7-8e07794a5214", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4de1e19-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566781, "uuid": "25e270d5-c3d7-4b1b-a0bc-5f0ac0f78ddf", "comment": "Malware payload (Mirai)", "value": "669eb141240ce2d506e4e3747035b4ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566781, "uuid": "91d7c249-7532-4343-8ad2-26501222faab", "comment": "Malware payload (Mirai)", "value": "ae06dac1811e2ca5ad7b3e544311a494637e60133decbb04f35d6490e8f0706f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566781, "uuid": "dbb5eae5-500b-4db6-8a4b-238732eea747", "comment": "Malware payload (Mirai)", "value": "05bc727f3a052adf8442dac13e8525088a52d776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566781, "uuid": "6e2522e4-d8ab-4884-9f1a-1adcfd5899a6", "comment": "Malware payload (Mirai)", "value": "7f362a14dcdc03a2f5aed1b98a56083c83616b374fb8aab63b95c52d47f4d76bb1389076d5c73b3fe22b92ba91c8662b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566781, "uuid": "08130431-4e95-419a-b9a9-d270dccd86f8", "value": "T19343F1D7492EA3BCD9244DF20769C6D08776A0A43B448E0B1FD4B3BE18DB5D46922A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566781, "uuid": "7594e227-e00b-4fb6-9058-4998ca57945b", "value": "768:Z/YjDh0p5RfTzcCJoc1FWnQ0GhLAu4DTShQacrmCyG1j6zjFG2UFqN7pl3:Z+UFcCpWPGX4naQaubq5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566781, "uuid": "9ffba40e-7ab7-4a8d-82ea-8d4d719fa6cf", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566781, "uuid": "b97d5fd7-166c-4bd3-b56d-9789af2dd293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566781, "uuid": "703a4ec6-c3c1-4d6a-87fc-e9ea03a446fe", "value": "zero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92199f38-8d44-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546107, "uuid": "e47bc2b4-d0df-480b-81c6-a66e70dc4bf4", "comment": "Malware payload (Mirai)", "value": "ac864c8da688a7e871618e9518ae8eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546107, "uuid": "f247a6f9-4d5a-466a-93b2-9c129716bf53", "comment": "Malware payload (Mirai)", "value": "b00dd207b70c2e6593aa6797d94cf023b41c5755da93787830dc15b383675b24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546107, "uuid": "66863603-5f5e-4913-bf0f-7c3333475add", "comment": "Malware payload (Mirai)", "value": "2e5bbc040321d91d53e2ad31119262f06fb62624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546107, "uuid": "d24d0c27-e1ae-457e-9b3b-637c78b87902", "comment": "Malware payload (Mirai)", "value": "a70a5a055d2c32244d51dd2a03e4b39de8c9350623db4d5e927252505fc7c2b0d41bd102ff5803daa7c542c0a5765b82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546107, "uuid": "dc3d64e6-ff69-4d50-8372-63d7582a952f", "value": "T153837DC6E743C4F4E8528973217BE7328A73E53D102DEE83D769A932ED12501D66A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546107, "uuid": "7b421c0f-c502-4822-a9d9-4109f9cada25", "value": "1536:bAxTtfhenc5SWTpCClxqVVk/13HWCsBjJe7s4TtAsV:bALIuSkpCClxq4/13HlsBdarp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546107, "uuid": "5562bc29-3e35-406c-b2e8-55a4bd49cdd0", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546107, "uuid": "dcdbfb62-3ae7-4da2-9cbf-579f8a67199b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546107, "uuid": "edd27ac5-f22b-4220-a228-82e275073e7c", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28083e42-8e04-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785628392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628392, "uuid": "ece1f812-4ff7-4f77-b9ba-db3976b5687c", "comment": "Malware payload", "value": "2c5a4089bafd03e67e7afdad3985523f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628392, "uuid": "26bc1996-29bb-4cb9-b166-63a88bf83be8", "comment": "Malware payload", "value": "b193be680eff393e70bd8dba2b8b1d84249b729191aa8a5014ab884360cdc9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628392, "uuid": "5a75f717-32fc-429f-a2d4-e0dc02b4d02d", "comment": "Malware payload", "value": "c16f7496e4cf87e816b98f0bb134ac77e577e1c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628392, "uuid": "fbd5352c-caf2-40c6-95bf-284f80528022", "comment": "Malware payload", "value": "f6c3ec6dafea2fcf9851466d1b8b7a6a7a137cd8aaddc8fef1d3db70b74b1ed229708f33b31d3d20c5b504dc7225ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628392, "uuid": "066d3607-992d-4a79-9465-fd35c64f1074", "value": "T192D5239A79FA0930C877C3B29F03F07DB01ABB5A8B618D47F6D865109E136986437772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628392, "uuid": "4d78d0f5-3eb4-4e45-a10a-7fdf0656a10e", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628392, "uuid": "558ba333-e5cb-4b0c-8d21-50a339de47b0", "value": "49152:8KtbOOWSuMJSPPDfV3uiW+BQg2iUO9xvBSOjO/YD8IGMpIzYzeFaIh9:1bjAXdVW+CkBLBSEOqQUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785628392, "uuid": "26cbb768-8e31-4d64-b07b-e4e602af7f5f", "value": 2909696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785628392, "uuid": "d9063a3f-f51b-4981-973e-6efdc60f002b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628392, "uuid": "3a383347-99d3-4a08-af1d-943ac23294fc", "value": "SecuriteInfo.com.Win64.Evo-gen.79735182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508bd743-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545138, "uuid": "9c82851f-0c51-41ea-a833-943075a65fc8", "comment": "Malware payload (Mirai)", "value": "390dd4faf0511b5319383a0a51e57e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545138, "uuid": "a34187d9-4c44-494a-aa10-6df34253f43a", "comment": "Malware payload (Mirai)", "value": "b284282059d0cbf9f7640624ae54b57018cd5d5e986002fff1bc5a34a8d2765d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545138, "uuid": "f5a03c2d-ddb6-4c2b-9c10-1cd1032b452c", "comment": "Malware payload (Mirai)", "value": "7d5d2f153722a0eb059cdbcb9a276fca65204020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545138, "uuid": "cc60574f-dac2-4591-95ae-fb89c4ee0a34", "comment": "Malware payload (Mirai)", "value": "08df065e8eb1f76098c3630ab5d03b2d796ff59a22d5d952ab361013d7e488d53d22e49186b3f654980840ec0a8eda7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545138, "uuid": "2cfc5395-9c5d-4e26-8d5f-3e4cc1c8eb2c", "value": "T10CE3AF9BF64F1450C82506F81BC75BAD2A2325118E6B95E77C6E373E2A339DF28063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545138, "uuid": "7bf35a65-a2df-4b12-8275-ab46eeb67bc0", "value": "3072:7FQW4VJUhXr2yvmJyzEteZnO4nGITTgZC5SgersQ0Mq:xQDaRxvmyEgZprTQC5orsaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545138, "uuid": "1ec59094-6bbd-4431-95ac-b761e24f4f51", "value": 148952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545138, "uuid": "7faf3e95-6335-4e9c-932f-ef586d7bd143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545138, "uuid": "5a629dc5-8dc9-4364-8d24-111083379aa8", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2943870d-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544642, "uuid": "4e75bc9c-0835-4745-bda3-9b249016a7c5", "comment": "Malware payload (Mirai)", "value": "753d12cbd8dca39528136bbe9bf437be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544642, "uuid": "15af50a0-b675-44d1-99a8-102dd7da3814", "comment": "Malware payload (Mirai)", "value": "b419f6e0ab5e13bbab3bbba935a46020e40da4acfa3112fd3c0e9b2cbe268686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544642, "uuid": "136dedf4-c045-4c2c-b817-e7a409daf375", "comment": "Malware payload (Mirai)", "value": "d6160a095c2171836d98d0a34a2675455080fba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544642, "uuid": "b7c1af06-bb5e-471b-a7cf-59d93531ef30", "comment": "Malware payload (Mirai)", "value": "11afdfdbfc70e461be051db1e66b4dd30ee1b9e399cd9295f68d66408b31192d285a6711e61583d6dd5b3b3af6a204f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544642, "uuid": "c719a5b2-1aa0-465a-9445-46ac1f3d27c0", "value": "T1C263F141D020ADEE4E7424B5D72A4DC6A70C1DB8533232F31267A5927DFD9CAF2ADC4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544642, "uuid": "e618925a-bbe0-410b-b45f-4b0cdad2a599", "value": "1536:N1dNN8zdeop8GHQQw7I5fwCpzAkSntLeMNrKnuYXMa8pceX:N7NN8zdPDwOfwC9AkSntLeMp8uVa82g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544642, "uuid": "8653d670-7c33-44a1-9434-95f3189eb11a", "value": 68128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544642, "uuid": "9d936e31-d159-402e-83b4-830268ba888a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544642, "uuid": "23d86802-28a5-4382-abc0-c7df446b9ca2", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d17776e-8de3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785614362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614362, "uuid": "fc02fce0-d8e8-4583-97cc-82cb30fc4322", "comment": "Malware payload (Mirai)", "value": "2cba347bac47edd4a30b62ec80368cb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614362, "uuid": "11f2d6f7-634f-48ab-bc90-ebd15e5cc9b3", "comment": "Malware payload (Mirai)", "value": "b5404a3df6c519d0c7c1d7ad105e4b6a6cbb8455a7f0d95ae5780831e101d2a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614362, "uuid": "a3fe5c57-324b-4c36-b9f7-d7a678835c04", "comment": "Malware payload (Mirai)", "value": "37d7e4cd0de2bfc5d6a780649addc8a7f5af6e6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785614362, "uuid": "f15c71ae-7738-46ed-8b9d-2206566bf964", "comment": "Malware payload (Mirai)", "value": "60ca23260735f6de794892a3494dc8f3c355aa07dbcef530dffa03de0b1bdd6b18b9e6e63a7b0eb4df2a845f69e88aac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614362, "uuid": "ad0d1e2a-8a1c-432e-bacc-d4912629a668", "value": "T126C3AE87FB871490C46206F003C34FAD6B93A2128E6F98E7BD1DA63F5A7A4DA15163D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614362, "uuid": "f9ec4ad6-e37d-4e69-9095-fbf418c4696b", "value": "1536:owy+K2krQKlEYGsNW+92eNmDgglQ5YKwD9rAfxPexgtfUl/LWB:C4kMKpGsND9RkDggAYKwD9rAUg0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785614362, "uuid": "cc7833f9-6223-45bc-9ead-126a26e98644", "value": 124636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785614362, "uuid": "715d70c3-55bb-4776-ab2e-acaf432c2f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785614362, "uuid": "f0b4a9d5-c612-4124-8bd4-b19d17ad32a1", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78febf9d-8d4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785549501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549501, "uuid": "aa195d63-6ae1-44ab-97e1-6ab7b7eb2fc5", "comment": "Malware payload (Mirai)", "value": "e163b085590e23a495c5f34770d76232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549501, "uuid": "42af2636-e11e-45ae-aa8b-4304ddf6b8a4", "comment": "Malware payload (Mirai)", "value": "b5fa45952fa3bb422b1d85d52a6a29690837ec079b72c678f883221e83f96aea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549501, "uuid": "1c490611-500c-438b-8ea9-8ba580518fa9", "comment": "Malware payload (Mirai)", "value": "77e38065a014df1a6f699e8fb4f05810ff09672b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549501, "uuid": "443fe4de-54d9-4d08-a862-ee1278852876", "comment": "Malware payload (Mirai)", "value": "264512754220ebce7cec8bc83b1837f590f7ac18c75e876bed078818c9b492549ec87cc0ea1f9ccbce5687cd91f18ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549501, "uuid": "3437f48d-03b5-4e43-a46a-7284265c5bac", "value": "T18304961A6F228FBDF268C73447F74A35975D23D627E1D684D2ACC1142F2029E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549501, "uuid": "8f4fd2a7-385b-436d-b67a-c41ae9e6a91c", "value": "3072:n5yS5Sc6pcv3tHZfvaYuHvTh9eLvwRvajv77WXjXpc:n5yS5ScVftHcYU7nFv0fWX7pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549501, "uuid": "535de083-8342-4e9b-a2e1-37e2aff474f0", "value": 190128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549501, "uuid": "b7336c30-a469-4a2e-a2a2-ce6134f1f6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549501, "uuid": "beb27ba9-a757-488b-b27e-925425dde2ac", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942d2769-8dd8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785609676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785609676, "uuid": "07bc0562-3911-45fd-8b3c-9e4b19df35a3", "comment": "Malware payload", "value": "c96e4fc897fb2b132fb93a0984aaa52f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785609676, "uuid": "c4cf39b4-226f-46aa-b1ec-81bd3d114aa1", "comment": "Malware payload", "value": "b76abc2c6b2463edf3353d5e9f86fbb57b6633374a0bec0140bcb979a46690ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785609676, "uuid": "4fc054c8-ea12-438a-b2a2-e4e2fa6d603d", "comment": "Malware payload", "value": "5fa5f9092aa7bfa73c6f19be3cb27c3814acb463", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785609676, "uuid": "cfcb2278-b6c4-486e-b842-806610dd8366", "comment": "Malware payload", "value": "a6fd91bcdef69a00b0c7c381ee09b9bb3540ae101c0ab802f2e4f9c255ab40cae900774ff29b577b78686db37d5274b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785609676, "uuid": "12b233d2-3246-4ef2-acb9-7a32de462102", "value": "T18F236C6516857C14AE98C4365D7F2F0CBDAD43E6314492EE7FCA3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785609676, "uuid": "5ac03967-824e-4883-b27a-11c9681c4044", "value": "768:O8r9NyXsZztC79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:JHusZFcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785609676, "uuid": "97b1f536-3c68-48b8-a2a4-49b80833b0eb", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785609676, "uuid": "07ad3823-16be-4368-a4c1-97828b6420ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785609676, "uuid": "d1969e4f-91df-480f-9e54-c9f319034c73", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dce2df6-8db8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785595948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595948, "uuid": "a51b1743-5124-420a-ae62-d4fb6ddfea7c", "comment": "Malware payload", "value": "67ed4c26a82da8b364fb925774d95506", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "LausivLoader", "colour": "#B6EC4D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "staler", "colour": "#71E622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595948, "uuid": "2037e928-93a7-4b1f-9b72-7b67923fe038", "comment": "Malware payload", "value": "b8d17ac80ddc58836ca0232122835f80b6dfd223e76abcbfd04004fbacca4a64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "LausivLoader", "colour": "#B6EC4D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "staler", "colour": "#71E622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595948, "uuid": "d5039e5d-6221-4962-bee3-90c457ba2301", "comment": "Malware payload", "value": "ce9bb0cbb258d7117e0f2544d5e0a0b2d3261126", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "LausivLoader", "colour": "#B6EC4D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "staler", "colour": "#71E622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595948, "uuid": "5a9f2028-09d8-4be5-b0aa-949c1d549aeb", "comment": "Malware payload", "value": "1a97082ae563f157b9aa0ada597422aa4c6584beb5d558db42a5b3b7eccef14b80e84b9b88850c0f12e4d9dcaa6f3c55", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "LausivLoader", "colour": "#B6EC4D", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "staler", "colour": "#71E622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595948, "uuid": "b24a51dc-e96f-45eb-8e80-4ecb0764a1ab", "value": "T117C4078E76DE8F50C8AF4B38B092196E7234B22A4CDBF35B0F8415B1A957710C5CAD76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595948, "uuid": "3a049ae4-0cea-4a28-b39f-c2878e56389b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595948, "uuid": "6294bfa7-a24a-4cb5-ab5e-bef8870e675f", "value": "6144:JRuOthJoa3HUcDW6ydqJtfyyHs29TujqsiRGfAuHOgYdHcb31fSgZY:JmMW3sJ7793J0f/0d2SgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785595948, "uuid": "bd5c65f7-4f7c-4d95-954e-6c4aa03ec1a2", "value": 577592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785595948, "uuid": "8d08c52f-d28e-4779-b336-b16e7924ae5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595948, "uuid": "0d2ab09d-9bde-46dd-baff-8ce06542be96", "value": "Microsoft.Win32.TaskScheduler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7c5c94-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620459, "uuid": "451e6eef-ba13-4097-b77c-891cdeff2f41", "comment": "Malware payload (Mirai)", "value": "7f7f30091a151a7b41672ba03746de85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620459, "uuid": "110ad3ce-b27e-4fb8-a6a3-8eb72bdf08e6", "comment": "Malware payload (Mirai)", "value": "b95b93c95cd89ad5c559708c33231c8bb1312505242826842277ac124023e402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620459, "uuid": "d6fa2921-65d0-4d35-9818-0882b9f9bedc", "comment": "Malware payload (Mirai)", "value": "df51f0c4b82747f531b5cd71fb1d1ea492b238cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620459, "uuid": "92ffc5b2-0cea-4105-9303-a77c141720b6", "comment": "Malware payload (Mirai)", "value": "689ae1c1f50fe950a09608262f4655b49c7930d1bd1dda9786623cd0e05e9963f5bfeec910fb3540779252b092ce25ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620459, "uuid": "a85e0372-74e5-4431-9a81-6614e80464a1", "value": "T12DC33A85F8828A62D6D7237AFA6E118E372163E4D3DE7103CE256F2137C651F0D67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620459, "uuid": "b465b623-483d-42e0-8dd7-8f4025d3a578", "value": "1536:y5EoK2wtMpj5Vxh0JbBfeYHrdawTvAG6KscEktRNqv4JX6s0NR98vo+:y5Ed2wKjnsDTvTEsRNnJ6yo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620459, "uuid": "c17358cb-369f-43bd-944d-491ab2a026cc", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620459, "uuid": "9a00d90a-d49c-4a85-9cf8-804077809ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620459, "uuid": "0b039d54-6b43-46c2-8221-2759c0c5372e", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9e0971-8d3d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785543276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543276, "uuid": "c71cd2a8-c368-4400-8d31-00f10a727fc1", "comment": "Malware payload (Mirai)", "value": "165406a6d7e0ed09d234c71b3f2042df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543276, "uuid": "770233ba-7ccf-48e7-aa1c-8c2c289e9c2c", "comment": "Malware payload (Mirai)", "value": "ba059b885edb94a1863a5e3989c6ab4dfa2afbeac9da0ed26208305223244591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543276, "uuid": "81897e0f-1c7b-4191-b749-b1f386268aac", "comment": "Malware payload (Mirai)", "value": "53ba261f3ee4447bc2cfb094a44243b84abe2793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785543276, "uuid": "7cdf1dad-760d-435a-b062-bd3394aa24fb", "comment": "Malware payload (Mirai)", "value": "fa9927eba5979bbf4373d219bab09044833a5600da798dd55f6013c4a17386941ce2972472641065b1df0f903d4db1e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543276, "uuid": "a4e23982-073b-4c92-8f8c-31b87eee560d", "value": "T1A913E1EFD184781ACD38ACFAD45D07B15549A1C153FB886933689C889B5AD8BE2C90BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543276, "uuid": "932e1197-bf85-4448-9f71-8eedd84507b4", "value": "768:Ox4mYFaluq7c2hrjYJO5AhCA7ks2Q4kUx8mV8koVL7BJoBOD9ophS44+eWH8:OxhYYuqYZJOFE2T2k8/oQ8heG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785543276, "uuid": "c7e943a8-95f2-4db4-95b0-172f8de6c187", "value": 44516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785543276, "uuid": "3180531c-b04d-4f48-8054-d59c467f1425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785543276, "uuid": "6471893d-af68-4cfd-8fb7-d553450ffdb4", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e989786-8dde-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785612082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612082, "uuid": "85d2ce1f-f322-4e67-ac0f-f563b907b61a", "comment": "Malware payload", "value": "1aaf148a916aefa11fd2a7aedc04e43a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612082, "uuid": "b618d17a-5b62-4e6a-9c75-b9a9cce76bec", "comment": "Malware payload", "value": "badd2d784dbb3deddcddc7077ae26e1d42042a44f12f4330f58661fec1850888", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612082, "uuid": "41ff77cc-aba3-45a9-a374-62c1251e4647", "comment": "Malware payload", "value": "458e729575a615a4ec1bc2b438314c4a69520063", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785612082, "uuid": "0e77b28b-8df9-4923-b21a-0602099baf82", "comment": "Malware payload", "value": "f04711471f79446468410fcd2680ad6df4362b2b67b734cfa45695da24d55a90e58f25814b8c6b37bb53551a0ac9d48e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612082, "uuid": "a6af9294-dd64-4663-b4d6-9f3dc7b695b3", "value": "T14E235C6516857C24AE98C8361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612082, "uuid": "1b1ba7cc-64f3-4a51-b9f7-02fcb9fb3de5", "value": "768:2+b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:2+scr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785612082, "uuid": "df9875e8-1a8a-4e7e-beb5-7553c95e9aaf", "value": 50075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785612082, "uuid": "575b4dc3-cf35-48f3-8f33-27155e2c32e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785612082, "uuid": "8dad6a08-2cba-424b-864c-6cf6a04b79cf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d30c5b3-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785573103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573103, "uuid": "2e8436f0-8838-4da5-8e1e-b0bcf74513e6", "comment": "Malware payload (Mirai)", "value": "ab93a856ec1f1c0a725d004a86db699a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573103, "uuid": "7957e968-81f3-4394-aa14-9d8cdef8527b", "comment": "Malware payload (Mirai)", "value": "bae38ec3836dcd3831a8ae4173ccb9fb3e20b78b8111d98f0e1ab25a1867882b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573103, "uuid": "5a1d0f7a-f2b8-434b-952f-d3bf675851ea", "comment": "Malware payload (Mirai)", "value": "346ccee727c8a0afd0413dee7003e371cb73d26e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573103, "uuid": "695a9c00-03b8-4ed7-b06b-19f001418dbb", "comment": "Malware payload (Mirai)", "value": "5f4635ed98433f62c46d712f3619e846ee3a89be06bac982d800cdd563ffb2102d4bde58a49e85c716db5a1899259488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573103, "uuid": "36816ccb-2cdf-463f-b4f8-a557c23c4213", "value": "T12B146CC7F801CEBEF80BF3B64897050975B0B79124435A3663A779BBAC7A0D51923E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573103, "uuid": "4b4438ce-6b33-4303-a8b3-a40ec766de07", "value": "3072:UptqnSqM4qeSti3I2eiQ7map01PcpHAMV5jbisLUj0iTyDKwQk6JF:tnSp4pKxiQ7ma+1uHACLNAyDG7JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573103, "uuid": "5b13f48f-77d7-4836-a9d4-dc35fd5d0fb3", "value": 206912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573103, "uuid": "5913b030-385d-412d-90c5-188e2ba48dd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573103, "uuid": "e6830945-f6e4-42a2-98b9-98fdf029f142", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9786a7df-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785620419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620419, "uuid": "8284a1d9-ac09-4d3d-aeb3-44604a838836", "comment": "Malware payload", "value": "bd17616c87cacf972a66805e93bc75bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620419, "uuid": "272e3948-ec1a-456a-98b8-0cf5cab8e524", "comment": "Malware payload", "value": "bc22d00dff0a309c428f7ed03565b43cd4ba39552683638e3ca1f1510a873c0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620419, "uuid": "40dc0173-b269-4b75-acec-df372ebd3114", "comment": "Malware payload", "value": "4469fca56a5415b06caf2141e1dc49aa96ba30f1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620419, "uuid": "7c913321-64f8-4c0f-9a5e-b6a5cd4f4a16", "comment": "Malware payload", "value": "8f3125bcc15a08be0c70137dd27f5848675109eaa009b6e13e7471d78c5a4f005e3b38f712cd73325c017ceb63d9ac4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620419, "uuid": "7bf975fe-cb56-4d4c-ae4e-ec5147ae2ab5", "value": "T1296192FB034546376CA2C9D3F2A848087165669B54DE9F79ABDC38F40C8CECE2D45E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620419, "uuid": "6ee467dd-3594-42af-bc86-049cbfde6368", "value": "24:ItG+vZsGXYbhG05kGTElfGJOmsGh2TGkRkGgJGW36GpunLG6R6NIpKksGTEMEGRZ:iEFu9HPxi1gbLGJxxa3wBgJsZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620419, "uuid": "76bea156-dad0-4df4-8a45-b2f354f46f65", "value": 3314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620419, "uuid": "95f5814c-e83c-4897-b338-6513e7cc8db6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620419, "uuid": "a864c273-d00c-4b5a-bd23-23e30d0764ba", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c6c17b-8dd0-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785606134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785606134, "uuid": "e04f8063-7d0d-4d5d-b398-732c5710775b", "comment": "Malware payload (RustyStealer)", "value": "c51ea79875ad62068673cdd298766d23", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785606134, "uuid": "42b79db9-e4b4-4a18-a68f-bfea52e4f53f", "comment": "Malware payload (RustyStealer)", "value": "bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785606134, "uuid": "498e0557-2419-4667-a3a5-e875a404fe61", "comment": "Malware payload (RustyStealer)", "value": "570f06e2cfffccb933f1e4077463b5f24aece6b1", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785606134, "uuid": "c532365e-dbab-4432-b033-84a21242e100", "comment": "Malware payload (RustyStealer)", "value": "e1584523ef0ee17a6e12689fe5a8f252b4abdfe05a9c1e03ce073d6d0d3f8ddeb8769182cffb07a82ec72645319f3a75", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785606134, "uuid": "8f1bacc8-c619-44b0-9e1e-452cef813247", "value": "T10575F7267E5A996DC05BC070C3868AB25A7270CB0F35B9FF458492783F69AF51F3C258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785606134, "uuid": "ed95caf5-cd37-4d0e-897b-b7dc0d1e29d2", "value": "87ce892c1157b44de3e217cce7127172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785606134, "uuid": "d824706e-2186-4996-8145-15bfdd90716c", "value": "24576:o7kLsHjLpkqWvMb/Cs+8IbLS+s8d6mbqjkGsyYE9J:o7kLejLmqCMbqzBHLsqvoGEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785606134, "uuid": "fb428f44-a0b4-4079-ba2d-dc51fb358f35", "value": 1613853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785606134, "uuid": "b33e5e48-be21-4427-8c6e-dbf70c09027e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785606134, "uuid": "611a99bd-0209-4682-b332-e54b0d73d91e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d858578-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785547710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547710, "uuid": "d24c3277-c2d8-4e1a-b4b1-3b3e0f07fd8e", "comment": "Malware payload (Mirai)", "value": "346a823dfd25c9ca3627aea29290b010", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547710, "uuid": "69b22877-9d18-4476-aa93-48e98700773a", "comment": "Malware payload (Mirai)", "value": "bca1a1ab6f8af45dc8b855a33d9fd8bd1e2658903428933a23ddd266a94cd293", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547710, "uuid": "0d810ff4-36b7-4b2b-b965-beaef0b95baa", "comment": "Malware payload (Mirai)", "value": "84204134091e117a90a34af0ed82bd8761b75b79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547710, "uuid": "3defee0d-5f9b-456a-b35c-f12fd7ec0abf", "comment": "Malware payload (Mirai)", "value": "ed0d5d8aa810688b26e33a0c76fced68548ad52b288a940c9a371d23fde13fd72e405d345f164f7a75db08a05a470e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547710, "uuid": "9e06e3d5-31fe-4af4-bcfb-47c86c6e9c23", "value": "T1ACC35A63CC296E6CC664D6B5B0708F792B53A661914B5FBE187BC3788083C8DF6057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547710, "uuid": "85e2826f-5bf8-4994-afb9-436d403b8cbd", "value": "1536:X+hsbaO4pi43PhWlrlHfC5RK4V7l7BT/pHqQeB/deMWVbWe8lhX98EMO5:uSd4p5pe1fr4f5pHqQC1eMWVWDXOEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547710, "uuid": "0befd5da-877a-4e06-9995-89bf08fdfe70", "value": 122936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547710, "uuid": "bb44b18e-edd6-4efe-bde7-9479ffebb10a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547710, "uuid": "191caed4-7bd2-4f09-9cea-031fd0610bcf", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4d1a8b-8ddb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785610894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610894, "uuid": "755743aa-e068-4a2f-bf48-d0b7ed01b97a", "comment": "Malware payload (Mirai)", "value": "98e7c2395858fb26cc438b1d2b46b716", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610894, "uuid": "2683a605-a5fc-4151-8b7f-6e7c0df08802", "comment": "Malware payload (Mirai)", "value": "bd216916031c63a5f3174bc27d64babf31294363f1b8274e4ab7d8802c46d91c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610894, "uuid": "26e8b2c0-c8ab-4165-a6dc-96c7bfd0926e", "comment": "Malware payload (Mirai)", "value": "58b9b175a79045f86fed359c724aff1289ee3519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785610894, "uuid": "7cbd6120-5bcb-4223-8c95-cc724c26225e", "comment": "Malware payload (Mirai)", "value": "7c3992c80c117be24168a0c9ad1cb891fbfeda1b0e0d0f7819c03e33d8d6c2444f5c41b90de2f5edf4b855739fc33ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610894, "uuid": "5954afa3-4fde-4877-95b9-79875b6b0878", "value": "T1B4E46C6277228FA4F360D17105F38B659AA921630EF250C2937CC610BB51A7D6C6FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610894, "uuid": "46cf3b65-f9fb-49bb-9a0b-8206c33d0c9d", "value": "12288:U70Sy2742fuAM9Co3Y3yOseJQO+QhUG1tw8NaV8pG5kBSXi:4742fuA213Y31seJQO+IUGI8Nmkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785610894, "uuid": "e721e71b-441b-45e8-ba41-62b1338d8c95", "value": 660784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785610894, "uuid": "0c595881-a284-4ff5-a130-68821725f0d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785610894, "uuid": "fa9e0e88-1e59-4fe1-96de-2848c77c700d", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ffd72b-8de7-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785616036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616036, "uuid": "cb92cd69-97b7-4fed-aec5-ce03a96f1eae", "comment": "Malware payload (SalatStealer)", "value": "d3fd162828ab54e5e860af9aaaeab41b", "object_relation": "md5", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616036, "uuid": "18b62c0e-235d-4be2-a625-a97635cee882", "comment": "Malware payload (SalatStealer)", "value": "bd283bdea40a7edcccaa1abc62a4b4c187cb5ff156e357bfcf9f7fd5f07462c4", "object_relation": "sha256", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616036, "uuid": "5e052fd5-7f6a-4e25-a073-8200ea0e8d8b", "comment": "Malware payload (SalatStealer)", "value": "ae57744a0bb883a8ea831bfebfa0689371120baf", "object_relation": "sha1", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785616036, "uuid": "c2c89e9f-6ccd-4269-874f-85821a9f872f", "comment": "Malware payload (SalatStealer)", "value": "fe779396d07be2c9509a064b6fc44bb7f21c7633bfe86e77f81908af34250d7f0d84a41ab019ec298364373c03a7623a", "object_relation": "sha3-384", "Tag": [ { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "DownLoaderNET", "colour": "#289D12", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616036, "uuid": "09fe3c8e-fbda-44f6-b7b2-817c8d0bc5c9", "value": "T1A56733C0A05E648FE67BCBB31839122A15ADDAAB8538F9BF740B75117CE5E90D417E0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616036, "uuid": "a6b54ece-aaf9-44d5-9a79-558f29d78780", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616036, "uuid": "da6dbb80-d23f-4fff-9883-9d339a7e22fb", "value": "786432:ECvlcsqBNHlaM6wzWHSGTtKJXEyQN/Tj1e2UmXKQqSgpM1:E5s+V4MfIG+rBY2UmhqSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785616036, "uuid": "317acae0-4e2e-4a87-ba70-a68a56bf0424", "value": 32434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785616036, "uuid": "03c17a4b-52e5-4194-be3d-9235f2abdfc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785616036, "uuid": "6fc20aff-0e3e-49ee-a32f-cfaa5f053fb6", "value": "NerestPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd7b254-8d4b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785549002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549002, "uuid": "f0d7edad-f1d5-4b76-a288-970a4c17def5", "comment": "Malware payload (Prometei)", "value": "7524f4675c910ac0328d2f0e6ff01ab9", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549002, "uuid": "3fbfb71e-80c9-4c8d-9f73-b967df219341", "comment": "Malware payload (Prometei)", "value": "bd841b12f1183e8f04d34d695f2f7c145f1b7aa5b7480f2722ccddc62b624c87", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549002, "uuid": "2ca6255d-3941-4308-8255-ce59cea238c7", "comment": "Malware payload (Prometei)", "value": "3a89be0b7e0320c0265caeaa3a7146833988406a", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549002, "uuid": "3b671f27-f0cf-4993-8f4e-a17d00a7fc03", "comment": "Malware payload (Prometei)", "value": "9cd44fc82632ac28faa6a2bd13715bc5a50c2f66f652c5a687648b8c895f0b3761c13ed02d87f1c3c6ef84ff96e37d36", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549002, "uuid": "deec4630-78ae-4f41-a7a7-608a669fca45", "value": "T14AA012C5067906C4C0144D0274B30D10B018814414008628984808378551701B102E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549002, "uuid": "30ed6f4f-59f3-4d20-984d-a61ec0d832fc", "value": "3:TKH4vGBwkSDETLtWiL73eaK+EOoz:hBD6xXL7LIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549002, "uuid": "021c8c31-216d-4ce8-b127-cdc7027ef37f", "value": 80, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549002, "uuid": "bd901b41-1d36-439b-8cc9-94965617f12e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549002, "uuid": "d680ae83-fba3-4fb0-92c3-7a7ac78b0312", "value": "bd841b12f1183e8f04d34d695f2f7c145f1b7aa5b7480f2722ccddc62b624c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8667fd-8d4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785548782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548782, "uuid": "1ec171aa-3c28-42d2-a689-7aca30afdc43", "comment": "Malware payload", "value": "40a5a6f260f05774bc4a1fbe452036a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548782, "uuid": "8df3f20b-991c-4ca8-b444-e49de1ab306f", "comment": "Malware payload", "value": "be93cf8050a0ec8bc1d142cc6d3106cbcf80633217539a98dfc81f5239fb873a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548782, "uuid": "f0b224bf-05cb-43bc-9994-ee982f0c96f6", "comment": "Malware payload", "value": "9bd2b49c43b189eef33393ff22eca9f746fd79e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548782, "uuid": "ec3c3b7b-e3e7-4204-b72a-17d252cdcc29", "comment": "Malware payload", "value": "c3c923630043e5d543b2d2b40b9a44cad025f16cc68c66102de5e1a1df21531c28f836d1ac6cab8b1247d5d65cbbfa20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548782, "uuid": "9830e784-1352-4752-a62e-73f08a3bd916", "value": "T173233962D6FA9D42CBE07A7A02F303E3C1DA9B144394DA1FDDD11FA58F46B108C56A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548782, "uuid": "5bca12ac-5b43-4fd3-81ce-889d7cba776e", "value": "768:7K+r9HH4nnn6WVkNAkr9HH4nnn/I9RN2ElJP01BFrOqCM7IqRBQGYtiOI1YS4a:7K+r9n4n6WM3r9n4ng932WJKBFrTRIqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785548782, "uuid": "ae2fdd00-7d04-4efa-978e-0eda803e5dea", "value": 46028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785548782, "uuid": "0c8bc33d-faa0-40b8-8719-9fcd0f1858c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548782, "uuid": "33e5b8bf-ece0-42f7-bd5e-6ab93a1abf87", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4e4bb7-8d6d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785563787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563787, "uuid": "f6bbc5c5-3187-4c34-a352-61a2c7862a7c", "comment": "Malware payload", "value": "c6f4df18cb880500f3921a179c3a3766", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563787, "uuid": "22af946c-5b1f-4677-944f-79c5600ab1b5", "comment": "Malware payload", "value": "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563787, "uuid": "8728e0cc-92f5-4a0d-a793-211fae54ef4e", "comment": "Malware payload", "value": "937e75e0e1c82eecab69e9b8ad481bd7e0845308", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563787, "uuid": "d2a0f4df-896f-4390-9d22-069171c77d38", "comment": "Malware payload", "value": "d9839e45189e44c1b0fe29d362f69a9b39bf58710e86476dd6132165057a63e38af16d7537dd68b654a8b98370432376", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563787, "uuid": "e5a2d41e-d57b-401b-a9e3-daf9e95dc89f", "value": "T1E343083A658A113873E3E0AF5D499845AF29F16B36442D14789CF19CDFCC674C3EA2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563787, "uuid": "17ae7efb-be98-4ea7-9477-a0fe50478205", "value": "768:nzRraObp9Aps2zOX3+cLNqO5YxytVYGnH3h72MRDxjqP2QN77iyFMqXGrvfcQF:ndhUw/M5xOqgH52MDY2QN7HJ2r8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785563787, "uuid": "f7fd3a7f-3ec1-49b3-8a9e-904a73c6b9ae", "value": 55877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785563787, "uuid": "be9e51c7-475e-4c33-9fca-e173ca64b246", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563787, "uuid": "0c5a559f-ad36-4a6f-8326-92192c2bf45f", "value": "123.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e45f7bb-8d78-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785568220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568220, "uuid": "161cf5a9-f077-4856-b90f-5980940ecfae", "comment": "Malware payload (Mirai)", "value": "fe8bc08a7ccc66b52f7e72fde823afec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568220, "uuid": "748f771f-3442-42cd-805f-b192f49eb491", "comment": "Malware payload (Mirai)", "value": "c08f60a2df802395b9eff8d2d1cdfa31cef1812bad5d4803c48bf76133b94402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568220, "uuid": "21adf208-d78d-4aad-a4d0-d380325c4828", "comment": "Malware payload (Mirai)", "value": "e6ad8ac5eed114eed6e751ea72fbe7be89c33f98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568220, "uuid": "5f23f329-7f57-4bcf-b34b-f49645d8dfc9", "comment": "Malware payload (Mirai)", "value": "88f932b6a56605e656f37eea0041f471ec9aa825a18024d5bf111de510e264901fa80fc6511d8a2f7240e850572cb6d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568220, "uuid": "3917383f-664b-4305-aab9-ae3e59257b03", "value": "T100145A02732D4D07E1A32EB03B3F27D153EF99D221E4B541299EAB9E8075E325945ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568220, "uuid": "8f8f3883-6e18-45ab-a6bf-184c3508d6c4", "value": "3072:QzJ/7gClGlzUOTfmKYqRayxxxOzkCKvJ0c+epg:U7gCEk4xxOzkCoaclpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785568220, "uuid": "2a6fd105-c021-431d-83a3-0ec2a289d7b2", "value": 190712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785568220, "uuid": "de659de0-8a8e-4bd6-ad51-11eb89e5cfda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568220, "uuid": "7a7a3d0f-2561-4560-8d28-17ac211818f2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f7aa40-8db4-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785594304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594304, "uuid": "b11f1370-0f73-4ac6-b53f-dabd532b93b4", "comment": "Malware payload (NanoCore)", "value": "98cf0b60a8b4015d47165b49a68ad676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594304, "uuid": "a529c661-a43b-4aad-a576-07658c15b422", "comment": "Malware payload (NanoCore)", "value": "c14164aa5550fec91514f073f35bbd23c28bc7eb740bc930c1e29daf9a9ed9ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594304, "uuid": "7bf2f7b7-33b3-477f-af79-6c6b299d11db", "comment": "Malware payload (NanoCore)", "value": "366942ec7db8230627f3639842737414b36595cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594304, "uuid": "e1464acf-2fa3-41b7-b922-2a711dd60f91", "comment": "Malware payload (NanoCore)", "value": "c01b7bbe0bbb58b25bb4f756fc1efd5ec34fb17e25e2265287bcebc08eec792eb69874d04a2337a52e0a62468d4a52ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594304, "uuid": "08c1cb12-824f-4396-a197-4d1e40d6b121", "value": "T12F14DF1A77A94A2FE2DE89BA601212579379C2E3D8C3F3EF28D455B34B163E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594304, "uuid": "158981e9-6876-4172-a447-d83b22767253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594304, "uuid": "9bd03b2d-4b07-43b4-9879-3b29a97f5105", "value": "6144:MLV6Bta6dtJmakIM5pMluAJDAxGJg09oss:MLV6BtpmkWRAioJgzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785594304, "uuid": "d12600d4-c7db-4f8f-9cf8-9e8e587ca248", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785594304, "uuid": "99383b47-23d6-4eaa-8c17-537bac19abfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594304, "uuid": "7d80140c-b3dc-46d5-a6fb-97c150d9f13f", "value": "98CF0B60A8B4015D47165B49A68AD676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b59d89b-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621714, "uuid": "94eeab8e-d9b7-483d-9acc-e4f86c670e02", "comment": "Malware payload", "value": "1aaf457dd97bb40f2a642a8b8dee1220", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621714, "uuid": "947b4f27-0d62-477f-b8fc-ea835d72d3f2", "comment": "Malware payload", "value": "c17902c68f6925b79416cf464d49e7cd78acd06144fe7084bd1818bfca969c6d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621714, "uuid": "ace280ea-2520-4764-81a1-ffec5bb8ec41", "comment": "Malware payload", "value": "832acf1a04941312f974d74ed88705991147c367", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621714, "uuid": "c8249490-5ada-4e23-a800-72005394d732", "comment": "Malware payload", "value": "ab6c49b593d108e3508200a9fb800bddbf670e73be94669c5c88dabc8f241e20c839c850cdae0129ff1d851615d02f18", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621714, "uuid": "34568b9c-112e-4ca1-b1bf-4327127d6989", "value": "T1C4F08BED94A640323F0D5437721A4C553602082F24B95BDD224E99735E0CFA8234EF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621714, "uuid": "5d4ad725-d8b3-4b3a-a5f9-f6cf5a624b16", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQZdyTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/Vs6dyBYXmYRYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621714, "uuid": "85a3e139-206b-426d-8418-d2471315a385", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621714, "uuid": "d6d28a76-4116-4786-933f-bc2bb442224c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621714, "uuid": "53f1a986-ba0c-4062-ab81-b24a8d691df3", "value": "sensi_hi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6cae5e-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785573102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573102, "uuid": "a282dbb3-742d-4792-8e13-d88d3ca098bc", "comment": "Malware payload (Mirai)", "value": "94ac093c1c1eb7397867294ae056e0e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573102, "uuid": "91c015bd-649b-4e0a-8e43-5dd5c0d6e2da", "comment": "Malware payload (Mirai)", "value": "c1830b4c48710a67315f933ced4247f378e1bc5c9bee0cad792d6d1525d3d014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573102, "uuid": "c4238c7f-052a-4615-b049-bb596d3dea81", "comment": "Malware payload (Mirai)", "value": "c0419457bb3cb5fc177d4043a77682967aecf27e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573102, "uuid": "076ecbc4-2ac9-4098-8487-547d5793733b", "comment": "Malware payload (Mirai)", "value": "bee1836da9f1e6e43ee5daa21b45bd190f5a413131f74688a87903579c520085e59be148769f0114e20df3cb69b77f82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573102, "uuid": "5c15a632-41c9-4111-840f-e3953d880a14", "value": "T1A714BFEBB70A19D0C84602F40FDF5F9E5A2312435DBBC2DBB9693A35683A4CE56103A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573102, "uuid": "a6eb4497-40b5-420e-b5c0-fc409b3659ac", "value": "3072:e9hEPRVMoZTuI88wyh4TIJkZ94/qp09gfCM62mLWENWEtqO:eSRLwyrJMuymUCM62mRIEtqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573102, "uuid": "4bac3ad0-51f5-400c-a752-3e2d03ca7156", "value": 199532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573102, "uuid": "af52a84b-c981-4cc3-bf65-98a95c18e342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573102, "uuid": "ae1af549-2761-4e20-b9ab-751e67b2ee87", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed3e371-8d44-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546048, "uuid": "94c1c079-14fe-4d97-9c7a-75850e40e72e", "comment": "Malware payload (Mirai)", "value": "f4fe527879cb447894c4d1c3f2b5963b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546048, "uuid": "4ad93ae8-9b40-4fea-b670-0d55c569f3ee", "comment": "Malware payload (Mirai)", "value": "c1abcf5afb316cd4e384e8f7db4f08233850fd6a3bcf0e97c7504a6dea72b077", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546048, "uuid": "d7076962-c3b2-4a7f-b10f-6c1aca9fb69b", "comment": "Malware payload (Mirai)", "value": "3888a2bf8f8a896d850ac8e340293916df232300", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546048, "uuid": "a6c2a44c-8947-4111-962e-80397e298187", "comment": "Malware payload (Mirai)", "value": "287ecd7b1b4c3173329722dfdb3a9b74a7a0452d10d6131b1f8b9b2826512dec576620014203fd005db83a7afb552a19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546048, "uuid": "44ccd1db-e139-4cde-bc9b-82385475c60a", "value": "T19903F163D8FC4B50C51F513D108FB11F0E145697D83249A1D599A7B29FF2F9A6F182B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546048, "uuid": "70f6820a-ef73-41e7-a537-7c7f847c7ca3", "value": "768:A5UcnRyjFbZGbR6AZTJa/z0hb0hxnKm6B2f60owOc+aHnbcuyD7UGQRj8:A5UoyjFbZGPwz0BeKfT0xOc+aHnouy8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546048, "uuid": "be3c2613-9aa3-4b55-af70-7d56ec44f8ab", "value": 40428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546048, "uuid": "60fccfe6-8a72-4c7e-b4e1-5ebaee9f9ffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546048, "uuid": "aabdfb1e-b792-439e-ab43-563a5b127aa1", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f7f3dd-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544818, "uuid": "a33a6dfb-f0e5-4e7b-9ec6-d41a35c9a586", "comment": "Malware payload (Mirai)", "value": "d9d51a04c326c34721a2b61c87baa553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544818, "uuid": "b8ce6daf-7daf-4d70-9a64-d5ff7ed1c070", "comment": "Malware payload (Mirai)", "value": "c1e61d32bd277091cf92647cabec47cf3c56d28d7eef2e5b1b95e486f587eea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544818, "uuid": "6a70d25b-0f57-4b08-ae81-d2403e61407a", "comment": "Malware payload (Mirai)", "value": "889d93bc01503fdc6b05c6886cfebd6c9bd6685d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544818, "uuid": "2bf6b73d-322d-4add-9eb9-1b80a846fe0a", "comment": "Malware payload (Mirai)", "value": "1813a877c81b4bc49a36bb4902e9b1842f057eb4c40e41a7b085145f8e58660b534b4312013bf03f3c6d08eca27f32d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544818, "uuid": "3df129da-f490-4460-af4b-213fa3183dcb", "value": "T176D30845FC409F17CAC265BBFB5E438D772A1758D3EE72039A256F20378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544818, "uuid": "767ad933-cc84-467d-9774-e129839cfadd", "value": "3072:yJOhbTdCxd9NcgmEYIw87lzPuJ9q07nOljf:yJQFYL2PEYIwwlzmJk0LOljf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544818, "uuid": "efd4913f-b902-4b0f-84b3-8754a04fa202", "value": 135224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544818, "uuid": "550df561-bc4c-4199-9a34-1f90e9e51575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544818, "uuid": "a838140f-c24e-4d05-b7d9-c72627243b5d", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28da064a-8e04-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785628394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628394, "uuid": "2895f962-8050-46a0-b54c-0c1d57008fd9", "comment": "Malware payload", "value": "4a339cb67c78539655af90e4ff14de0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628394, "uuid": "59c6ff4b-0cca-4b58-9209-648299f03547", "comment": "Malware payload", "value": "c1fd57d1c2fa32e530ce16b95a306e98cd098e44e4599e9daa5d700d0a437814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628394, "uuid": "1817fc8c-547e-4bf7-870e-47acccf7c7a2", "comment": "Malware payload", "value": "b539e3a90222b09bedcd2cf7484e4f63a5bf7f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785628394, "uuid": "447bb869-ddc1-4a65-ad74-c01d859a859c", "comment": "Malware payload", "value": "f83163e8ae798a0f627a346a17152473f40912edf2901db76882b0b6ac0c61e28371f7452243125247fd483c2ff41178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628394, "uuid": "076eb65b-5f9d-4a34-b326-e15afbdf710e", "value": "T183D523D264F65974D07BC3B28F92E87CB059BB818A608E0BF6CE7540DD23689A537770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628394, "uuid": "6f42d6d3-2c82-4bb5-927f-0b1e0d245011", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628394, "uuid": "19b4a76b-1faa-4d6f-9334-2974e44a2648", "value": "49152:ypvDoNFFOpa9cEn5JTS4i1KIRyuEy9LqGQZB/pAgVLB4IM:yp7UOoD5JS4Y17Jqb/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785628394, "uuid": "74a77ebd-55d4-49dd-95eb-f030ca587f4f", "value": 2911232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785628394, "uuid": "7ed1e8f6-a26f-4ec9-bf51-00e83e4dbcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785628394, "uuid": "6da91b8c-2912-4550-9c7c-4cc381a70f3c", "value": "SecuriteInfo.com.Win64.Evo-gen.37843656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d44ec5-8d48-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785547907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547907, "uuid": "66e56015-f9cd-4ff1-9ac7-86a46c1083d5", "comment": "Malware payload (CoinMiner)", "value": "e33cd1b6164332e4b88287ec5a3a402b", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547907, "uuid": "3feeaded-1dbf-4538-8cda-ce828e00cc2e", "comment": "Malware payload (CoinMiner)", "value": "c23cb82c4e48e91f71b389cb16d419510a15bd1ebd9b3e53a7fd8f38960745a5", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547907, "uuid": "b88b166a-6e6c-4464-9fb8-bea5b94c0f0d", "comment": "Malware payload (CoinMiner)", "value": "85957d0307ac37f5957a98bd4b8e8e6e7e471363", "object_relation": "sha1", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785547907, "uuid": "2bc5dd34-dfc0-4713-b973-6a1e668bc004", "comment": "Malware payload (CoinMiner)", "value": "4455fa7c3a814778ad8f8bb104f3f7e4275a684e5173ea46f35c6aec9c1455e4a76dc980db6335ace575459e4658179b", "object_relation": "sha3-384", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#859160", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547907, "uuid": "37397aa3-8a8c-40d0-b4dd-ebf72933aff0", "value": "T18236336968CBA17CC003CBB49D1379FD723E7B618461BC1A77CD2A505FAAD20953E782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547907, "uuid": "cf20e904-f9b4-4f8e-9236-a928bb6404b1", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547907, "uuid": "54195f4c-6e52-42b4-89a7-43c9672adbee", "value": "98304:5zSOB7+/SVObiG4xYyngKK02wN2L0glfALt4Jhe6yk5i9Dj:5nySYkxYyngKK8N2LzfALu3e05i9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785547907, "uuid": "8ad3f723-8767-43bb-8a8b-a04084189a90", "value": 5302272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785547907, "uuid": "9fec2708-14ff-4c4a-ab39-9fa8e0c07739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785547907, "uuid": "d3d010eb-e13a-41c0-b061-44a6fded9daf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee1edc6-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544652, "uuid": "080becc4-5eb4-4928-89be-a088608c78db", "comment": "Malware payload (Mirai)", "value": "e8e731432520e0bb46f196931e81d073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544652, "uuid": "c666438c-19e8-464e-b172-cc3808785c09", "comment": "Malware payload (Mirai)", "value": "c2be6ac32851aa53fd921a7dadc1b5470f0a649b8555ff8606853127db855f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544652, "uuid": "c3a4a92a-9f3c-42aa-8bd1-29dee424b632", "comment": "Malware payload (Mirai)", "value": "d167c65c3d60f704d0396f86cb2e6858721c900e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544652, "uuid": "890c4709-5ad7-4e7c-a52e-e8d64702b9c4", "comment": "Malware payload (Mirai)", "value": "14c9eb33d9bc3df981089c74b5bfd205d59e7022d624a607193b1e2eef1d47defe3c5c3de76079b80479abbe81a81628", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544652, "uuid": "2b63335c-9926-4c0d-b6b7-2604df179f45", "value": "T1F5043B46EA404B13C4D32B7ABA9B424633239B64D3EB730699187FF43F8679E4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544652, "uuid": "c4bce939-3dc9-4249-bc0f-f9baac629f9d", "value": "3072:J2PZAbx9v3raBbPUaqNe9k09mNFpGZPvMirZQAM/9BDKpgS:JOZATPraBbPUaqNL090pkP0irZnM/9BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544652, "uuid": "f120de4e-9c08-4341-8292-8efc40fa964e", "value": 182265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544652, "uuid": "abbeac2b-c74f-4319-bae6-6579a0f69198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544652, "uuid": "c1974690-ba11-46c3-8481-45a2d2a22228", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf7cea6-8d8c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785577153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577153, "uuid": "614c698a-11b1-423f-b892-6f7361752a58", "comment": "Malware payload", "value": "14c854786fbba2ab05878050147fa840", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577153, "uuid": "85586d48-5d85-45d9-88a4-5772e45126ec", "comment": "Malware payload", "value": "c30f2e6b7e808d462ea4113e0da7e8bad4d037dedc1b5c9c87cc9f9a3ad6affb", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577153, "uuid": "82b78348-fc12-4732-b6cf-0b3d81052bee", "comment": "Malware payload", "value": "f57dc8227e85c2261dac0a452eae2ef5c64110f1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785577153, "uuid": "d9bfe032-c696-4219-8ee2-6dbc577cb896", "comment": "Malware payload", "value": "b69ae0b32f35b5d28a95ab10fc90c7271a770842c1cb3368cec6a7c4ae55e2356dce86f5208b1bf9832b1a428551318b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577153, "uuid": "4a6c709e-1b25-4188-9da8-fc725c1012fc", "value": "T14521651B64039B47E59984F38EEF3716DB299AEA0D00C408684D410D3925B023268E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577153, "uuid": "d24a118f-60b4-4e0a-aa6c-17c4eb3c63dc", "value": "24:8+TKVnNeCFgKf3TCYPk/sESxiYCIsQZHJwOgpRcdBm:87JDCYPkNaiKlJtQRmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785577153, "uuid": "b7ad935c-9a5e-449a-8063-08b5bf347bd2", "value": 1162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785577153, "uuid": "629f9182-80c9-425c-a086-1ad38a1d120f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785577153, "uuid": "233c3b40-dd8e-42b2-94d6-8302dce8c64f", "value": "c30f2e6b7e808d462ea4113e0da7e8bad4d037dedc1b5c9c87cc9f9a3ad6affb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d389cd-8d7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785571341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571341, "uuid": "97beb8ba-dfd1-4071-aba7-8ba3f551ce6e", "comment": "Malware payload (Mirai)", "value": "46049f2f9aa11936bb4c944d80d01e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571341, "uuid": "e8306f5e-5446-4ea1-b2e7-6c8f899e1e8e", "comment": "Malware payload (Mirai)", "value": "c49f910075727026be80b6b12cf3581496f25620aa00d25283c99d70df6f353b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571341, "uuid": "2c6dbb70-7f09-4786-8b25-289a93add69a", "comment": "Malware payload (Mirai)", "value": "916ea0edc27643352e74911561d74bceccb28f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571341, "uuid": "b0e4dffb-fd22-476e-af2f-a10af1796f63", "comment": "Malware payload (Mirai)", "value": "af43483eba8e0eb53f0c2674b835cd40eafd0a3311b4ad95b26e5d5aaa53c97884e5446c03643ec3f47f6eb8d3f14a69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571341, "uuid": "ac7dfa04-1800-414f-a8c3-be7eedc4380e", "value": "T13FA32B0DE787E5F0C9421AF0505FBB379932C8E12220DDFBE7E47EE66961681A046E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571341, "uuid": "f6f96186-ee6d-47bd-ad3f-298b05348180", "value": "3072:MWq51YsBfHpn9Z8YRrKrTY6ApIN0lGrQKq:MWq51YsBfHpnEYRrKrTY6ArqLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785571341, "uuid": "26fb689f-0b00-446a-b655-ef8f4ab01c85", "value": 98948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785571341, "uuid": "67e77339-6b1a-4f50-9416-173fdd86831e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571341, "uuid": "1c122d85-8b35-4404-b7b8-12dac8098a2d", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2e4772-8d78-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785568298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568298, "uuid": "31d941a8-2d88-460b-9e2a-8a5a75ac0b3f", "comment": "Malware payload (Mirai)", "value": "a92122940155628f9430519112726885", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568298, "uuid": "80001b0a-dd52-478f-bc04-5f5f100645f3", "comment": "Malware payload (Mirai)", "value": "c5cd54b142b788d40fcfdb983f6ef201f8b430fbb8593afaf58a1007350c1352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568298, "uuid": "8bfba9c7-8163-43ad-9124-206eb679f9d4", "comment": "Malware payload (Mirai)", "value": "f3474e9e9a3940837f313ba0831bd91a17fca8d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785568298, "uuid": "5b2cbd48-21ad-47f4-91b9-8226e94b4627", "comment": "Malware payload (Mirai)", "value": "be8171bba6260dc5bd28635781ee136788a0c4ff23cc91dafd3f43b80852568dad1ea33eb4306366e7d995260f7c9fc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568298, "uuid": "a39865e6-245e-46ae-8602-05710488b389", "value": "T19A048D72E4356EA8C2228174B0F59EB41B23D69181435EFBA5A7C3754087D8AFB1C7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568298, "uuid": "6e9caf6c-e623-4429-ac57-61c8ab0afc6f", "value": "3072:LdVPLOhLYXb/P/VlnQZTguUWxJEuTT3H7:LTDjP/VlQLNxusT37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785568298, "uuid": "b98cc393-73bd-4bfa-9a9d-cf8ac8e48409", "value": 173184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785568298, "uuid": "918d1c6f-60ac-42c1-86b3-bbb640be44c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785568298, "uuid": "305b55bd-703a-4e05-86b3-ea16cb3096f9", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecfd176-8db8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785595950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595950, "uuid": "7f42f757-9cd5-4a7c-8491-be8f35b515e9", "comment": "Malware payload (RemusStealer)", "value": "de65b65e7d5d3fd35f062341b5d47eff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595950, "uuid": "60f5a996-a303-4adf-ae83-6c2ae47f6915", "comment": "Malware payload (RemusStealer)", "value": "c703f7c8a9719198f450e6e9f91df340f810a197ef44a24926212c18d70abc8a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595950, "uuid": "5b903fe8-5a2c-46cf-b22e-46d75772ab86", "comment": "Malware payload (RemusStealer)", "value": "53b2409da145971e26878378ddd1338be7ba48d0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595950, "uuid": "51db563e-2c10-4eb6-a35f-7a782ae9c3a6", "comment": "Malware payload (RemusStealer)", "value": "2ff7d76e3e94cc09bf2db90a2a4f48f2b6d786700e3b4d8ec2c7ee8cb08849ddb2a32bc50d68ff1aa3044ff50af32710", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595950, "uuid": "87066ca9-c0f0-4151-898b-0dae04c494af", "value": "T1F8E55B03AD9148F9C099E73A89775616BB74B8084B3133EB2EA0BEB52F723D05E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595950, "uuid": "2e9b5aaa-5508-4c59-8caf-4e7cf0015bdf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595950, "uuid": "b8e30c14-7f69-4b9a-aecf-86bc3ff69280", "value": "24576:OlPNdp+kQv2UHlvONYbf3lXMalcBPRWmFSxcY7d6GRv/JBele5r9D9COG+gWbah:OlPf4kQzHlvcYbf3mDNFK7gErwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785595950, "uuid": "80ead2c7-7e5c-4fee-b0bb-0d24c7db788b", "value": 3216240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785595950, "uuid": "fbf72345-912b-4098-b25d-3eec21895862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595950, "uuid": "20a5d794-b3e9-421d-85e4-a6c0ff778adf", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6887fe95-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621629, "uuid": "98e53c56-c0d2-4052-aff9-8bc3275ae9a8", "comment": "Malware payload", "value": "13b899c5403b213d495cbf0dca847ab5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621629, "uuid": "dffb76d2-d345-4477-9a5f-205a4a2fea56", "comment": "Malware payload", "value": "c72585c030b0293a75a3403846bdda879ca759ec06e1ceb777d551a1d16f6378", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621629, "uuid": "623c3cdf-cc38-4a0c-aae0-453c3ffb1fbf", "comment": "Malware payload", "value": "5b0aa9e0306c0a0cb89bfe4ffae6c371653aaad4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621629, "uuid": "f13d60db-1883-4b81-929a-0edca8d78700", "comment": "Malware payload", "value": "42bdfbae0752bb54fb0df63ec6a1d89fbe263b269c6c83d34e5ce23a46b7fe584c903f20e5a21d5fb3f9a8bc8197f1c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621629, "uuid": "5194cc2b-3cf5-4347-916f-d83d3e96e274", "value": "T1A5F08BED949644323F0D583775194C552602182F24B95BDD228E9D635E0CFA8234EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621629, "uuid": "759834ad-d8ce-4d40-8851-681a759e2aa0", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQrbTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsiBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621629, "uuid": "98329d5e-9b69-476a-b53d-409e3fa645c8", "value": 532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621629, "uuid": "9c061e0d-1e57-4f96-a3e4-c2308cb7ce89", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621629, "uuid": "d38a60eb-0dbf-4488-a56c-e4a59f34cb5c", "value": "sensi_ct.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d46901c-8d66-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785560487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560487, "uuid": "f4458c44-e110-4ed2-8bcf-825ea2d57bf3", "comment": "Malware payload (Vidar)", "value": "7904c7fcdd05bd24c0195cb78cdf9177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560487, "uuid": "ea7707cd-54a4-4f3a-978e-81461ed8fb1a", "comment": "Malware payload (Vidar)", "value": "cad2fac072f40774247e90a9c3acc96fc85a57abf833e6d214975884060ff864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560487, "uuid": "fab436b7-fe6a-455e-ba1c-a81f32ad899a", "comment": "Malware payload (Vidar)", "value": "62714e1de1a8211d7302d8638b202e3e04277b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560487, "uuid": "6817415e-8d99-44e6-b475-3ba44e056b35", "comment": "Malware payload (Vidar)", "value": "e79a63d578833f671b0af45ce2d09c565780e53ae2527966dbea60612ab04fc2dd863a96e71c289252a75d2033e1111e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560487, "uuid": "0bab22b0-8bbc-49af-adc7-9534ce3426a6", "value": "T11F254F8EE49213B5F3A3FB73821AD2625CF635058072963ADF456E356F42F20A019EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560487, "uuid": "c7a16cbb-5ca6-44e1-b648-607e9d89297c", "value": "6144:P3K9MPka6UhlzlJ2iU03q4BUJn2GKArhrCbneJlWN1mmW+RataNOKIlVxkOqFemq:Pc8Tl3q4BmzKArhrCbn3tDMmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560487, "uuid": "a9e163c3-d92a-4ff3-b3d8-ba64e33b27b1", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560487, "uuid": "349c30bd-bc41-449a-b79a-51297c43384d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560487, "uuid": "7f32b9f0-1819-4fbc-8c45-284e2a8ec7ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb94c9d-8d58-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785554854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554854, "uuid": "20c5fc9d-09c5-42d1-b8af-63b81d43282d", "comment": "Malware payload (SalatStealer)", "value": "e5d203aa2c95d96736d44cb35fff96fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554854, "uuid": "5c1b4211-e30d-4776-b385-dfd86e20f699", "comment": "Malware payload (SalatStealer)", "value": "cafcc76c5d1e97e3b86529e6564f7d95ca189b70f2fa092dbd1f50a8d16d9c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554854, "uuid": "9fbb6d9f-1f50-4503-8b1c-387379091a81", "comment": "Malware payload (SalatStealer)", "value": "6c37d6d05ab8ba5efa827a4edeb15e03a9b6dcc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554854, "uuid": "0489d87b-0e86-470b-804f-bfa1f13d6f44", "comment": "Malware payload (SalatStealer)", "value": "70d8871db46416a4567a9bd3dabbde9ee8824918deca6049ae1caedc93c2aa1820a83c0f22249e7b7d8a93688dd6f1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554854, "uuid": "4772a4ca-e9ce-4e4c-9151-82c9bbb70400", "value": "T164D633AA3A03432DD507C0355A165078C8E5B8B36765A498DBEB70D75AFF3970E03F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554854, "uuid": "317b5a0f-5078-4900-b635-b2b433b3870b", "value": "44d4eec854a3d541453f2cd97e7d6cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554854, "uuid": "815fb31c-2239-4b63-8454-b7f54db119bb", "value": "393216:2owNtJl2UxWNKGvN+BvtPAsUk2/hAEPu5M:2owtJl25NK5963PuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785554854, "uuid": "74da710a-f16f-4d2d-927c-0a367698a896", "value": 13455360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785554854, "uuid": "6c2205bd-e150-4851-b2b4-dda1503ada14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554854, "uuid": "59bc9020-ff1d-471e-ac9a-2879d289142b", "value": "MM2DUPE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af3aa59-8d80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785571784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571784, "uuid": "3fbd8e8d-ea1b-4fef-b7e1-3665676970c8", "comment": "Malware payload (Mirai)", "value": "f5ef09078d866f9ab3b229bf094e0222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571784, "uuid": "eac64fba-1db3-49cb-9281-f61426cc35e3", "comment": "Malware payload (Mirai)", "value": "cb5d4f001a00b42ff3bd082528c9a2056925191fe47f448cc3b77bcae24f4973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571784, "uuid": "4cc260a2-7b27-4310-9428-de577f14f955", "comment": "Malware payload (Mirai)", "value": "71ae8b5242113c76e05a7601244a47a1c44cf4c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571784, "uuid": "a9893516-04f0-4d63-b689-26e7baf9fa08", "comment": "Malware payload (Mirai)", "value": "4f0ad12d15da3dc6ce5c55a1ebcd4db6eb746151f23732348dcd3b47dfada55fe10d47f3fbcbebe8362bc2276c49af59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571784, "uuid": "2caf0ad5-b21d-4b35-b876-c5018fdf450b", "value": "T13134D71E6E229F7DF6AD877447B38E24976923D613D1D581E1ACC2101E6038E642FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571784, "uuid": "6dc82277-1db3-48b4-844a-28a744a68387", "value": "3072:7GKwsOW1rlB7zl0ufGnfTDF+At0r37q7djkMe4vBMp:7GKwHW1rlB7zl0QGfgf3SjJeuBMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785571784, "uuid": "f4869d2b-0af5-45b8-ab74-36f552871fbf", "value": 246636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785571784, "uuid": "62606ef6-1eab-4813-9fd0-be6a724d0327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571784, "uuid": "022b59c4-2ae7-41a4-ae7d-e29d770d7af4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2db89d-8d4a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785548863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548863, "uuid": "92970df3-fde3-4290-9d78-6b4d6c12adbc", "comment": "Malware payload (Prometei)", "value": "682809e141e6c8066a7758cc4bff1a8f", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548863, "uuid": "5a11debe-07f5-49f7-9e7b-d1dc1b2c50db", "comment": "Malware payload (Prometei)", "value": "cd89fa8fe43679b7ab6e1c7b7bac49585d54676982b35cd41ff5dee37832bf55", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548863, "uuid": "103b935b-f29b-4815-b1fc-7394faca98ba", "comment": "Malware payload (Prometei)", "value": "a40584d847775d9918dadc955e6cb67c714e7875", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785548863, "uuid": "91ccf2ac-ba69-4167-8436-3566d6352fef", "comment": "Malware payload (Prometei)", "value": "4dc5e8d674c767a488ffcff010c56c99a8e86ce34147529240f9591c41fd8cd8ebf2ab349b160813bf257dc2aaeb9b4b", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548863, "uuid": "1da961c1-6254-4bdb-bf5e-e57c4599aa09", "value": "T143E092E1B1F00BF1F0194E1BB3461D10A9CB0A7A0AA4B590E885BD776A2851AF106F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548863, "uuid": "f1439468-3bae-4c59-b6e5-7f1b54f2b0be", "value": "6:hJAcxX2xXL7RKB5DRF1E3FAsxXLXDIe+xXL7RKB5DIewbsrdun1oEQ:X2dL7RajF1cFjdLEe+dL7RaGeLduW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785548863, "uuid": "e3bfa019-bca5-4477-9c84-4061d2864122", "value": 379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785548863, "uuid": "852b7347-79bd-4632-80d9-e8b05a468d02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785548863, "uuid": "00370af1-2608-4234-9ce6-6d42c9668dc1", "value": "cd89fa8fe43679b7ab6e1c7b7bac49585d54676982b35cd41ff5dee37832bf55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877975f5-8de1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785613520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613520, "uuid": "071027d8-3751-4a99-8287-50662be1b0be", "comment": "Malware payload (Mirai)", "value": "5a1b8e9fdc43020ad6891ccb335711a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613520, "uuid": "263b3ca9-85c6-4fad-b48e-c0785fb9d2b3", "comment": "Malware payload (Mirai)", "value": "cfdb0bc47947dbf29fe39234445ce59f2cd4e2e9173ecf0ac1110a7e351e7149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613520, "uuid": "57857b56-8e10-4f53-81a8-98e966ba8fdd", "comment": "Malware payload (Mirai)", "value": "5e566ac560ed592ac7e77bf841fa9d6a0b99a793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785613520, "uuid": "ba7ee94e-05b2-4859-b61f-1136a1879a0d", "comment": "Malware payload (Mirai)", "value": "3f783dfdfd3c3e6aa3e2b2107de7fa5c260c0fe7f1ae7a292ce784298201864182a88e3ce8a91ee8df043815b7bad9ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613520, "uuid": "b4d79b48-7ed7-4fb7-a057-3b4afb2f0430", "value": "T13BE45D06EF440FEBC8AFCD30856E425B14ED998712C1AB74A1FC499CB69D7994FE3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613520, "uuid": "250310ca-31e9-4b15-89bd-0b85b6633eb6", "value": "12288:5AWy6uJu23rf3jB/AB7uNRJic7mqNhZlJ88yC3pqo29LewwN1oatIwUwjcs/VIog:5AH1S5LeX1gScC+QHG6lghC/aVu4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785613520, "uuid": "c5bade49-536f-4072-bdaf-d91677389d5c", "value": 661024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785613520, "uuid": "7159d497-ed47-4eba-91ea-6079797e53b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785613520, "uuid": "0f5fcab3-1328-43bb-8a75-5b5874835791", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ee9105-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620413, "uuid": "4c423457-7a15-48a8-a5b2-92a8962f1e3e", "comment": "Malware payload (Mirai)", "value": "862bc447631322b04e492fe0be4b6df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620413, "uuid": "d19b3d99-3994-4378-9e5d-af27c652e52c", "comment": "Malware payload (Mirai)", "value": "d217b37e7b50db1d4a30e5ad4e14736184b61de39039684b20233d4e42c56542", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620413, "uuid": "0e891a53-76fb-4b08-bad1-9ef47a620eac", "comment": "Malware payload (Mirai)", "value": "2b67835160fe7869622efe3146df0a286ebf73b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620413, "uuid": "10c00e43-7291-4af9-8061-5370b6bc5f94", "comment": "Malware payload (Mirai)", "value": "932789bf99778fd784b5046bc041b49e19908ca351e27954d031730ae623a400631b3bfb7effcfd0a0e98382b3ca35db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620413, "uuid": "b3c2b078-cbcf-4b6a-97f8-699806ba706e", "value": "T10433F15FBCD9A842CB9C14B8294C5A05CFD4B0CB035C1BA277920CCDB6BA907F19B5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620413, "uuid": "2abe7630-4099-431e-8419-2dc44fc5a3bb", "value": "768:qFeQXa6Vb3Jy7ripso5Vcl6sXAUIBydfMc24beGhgxP7NMLbYqBnSmelSWqxFVWL:YVq0b3USHGR8ByF2jAgxP76LUWcPqxbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620413, "uuid": "47128d96-ff67-494e-967f-b6e40aa58ea5", "value": 50412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620413, "uuid": "504c3cc4-c925-4ddd-86d1-0cc8e75ed2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620413, "uuid": "e5c57cb4-f27a-4b91-ac41-880fd206cdb5", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c61296-8daa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785589725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785589725, "uuid": "748b4515-b331-4293-aa19-d58f5ce8ad48", "comment": "Malware payload", "value": "8f45ec279223e7d933ba1f64ce832977", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785589725, "uuid": "b874b5c7-8cd7-4943-b142-ce21ec879d9f", "comment": "Malware payload", "value": "d3b2791d6a1b2a645cf3989baa1f5200b128553bcf0386266621c319a4e1d057", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785589725, "uuid": "61d369c2-8b28-45a6-acf8-b0a18be35e18", "comment": "Malware payload", "value": "cc0f6ad315cd9509c773b188d04c698501e9765c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785589725, "uuid": "88891ce0-00a3-4e4f-a631-2bdbe8f320b0", "comment": "Malware payload", "value": "7f7955dc487b32a0e8d433a0c6b5edcf875ff3cc8e12b195a70be7e02ea86817afe13d02266baeca0bf268acf44b4f17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785589725, "uuid": "ce158a06-566e-46ef-aa5d-aab9d95d1c03", "value": "T137C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785589725, "uuid": "3108333e-3272-4ab8-a308-5e01e8ae12c1", "value": "768:X8vCB+25j6es8RQt9FYpMSUpi+20qUpi+20YQX:X8l25JQbd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785589725, "uuid": "8bfdbcf5-2b6e-46a4-a5fd-774de1fbdd3f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785589725, "uuid": "9977d35c-2580-4b2b-950d-27474b0449d2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785589725, "uuid": "8c4fc866-0ac1-49ee-b2c3-db97c23acbfb", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b972c2-8d44-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785546277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546277, "uuid": "57a5f355-f433-42b2-ae92-0e5888f66cd2", "comment": "Malware payload (Mirai)", "value": "73e10a5388b1cddb9d27f230b71c5218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546277, "uuid": "4933a492-af76-4a36-9278-0ad71cb8ad2b", "comment": "Malware payload (Mirai)", "value": "d3e23fc669e19733d228929d75aa4a4b1751f51ff1c37ab1a232830c46468e42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546277, "uuid": "41e0b3ae-a270-401f-94e3-556b3544cc8f", "comment": "Malware payload (Mirai)", "value": "945632c172f09b7d7534aad63adbd897db668c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785546277, "uuid": "9f26f833-17a2-40be-9df4-0603eb3d20ad", "comment": "Malware payload (Mirai)", "value": "a77e04c0ea6138e8f6f40a8344ae08289c9829bd69fc432a2327693666f8dc6c81d915c19914c99e3e8b52937fbe4da5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546277, "uuid": "b6398d51-319c-4974-b523-2d8507d2a270", "value": "T18603F23B36ED07D5E935727855E72B7E0480321F90E9ABA4D6E5D02254A0F92763C3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546277, "uuid": "70e2143a-d274-454a-a099-4ba7d031a6a8", "value": "768:mAOfJjljkAJyWrt2zM8pAwiHQ7ECJHtUt0FjfPrOJrVC3XJqqpnbcuyD7UHQRja:POzQAsyt2zFpAwA7CJNUEPyiJJnouy81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785546277, "uuid": "efa4438e-71e0-4839-aacb-136eeb39ac7c", "value": 40884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785546277, "uuid": "64f73298-963c-4051-959d-a7602e8e7c6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785546277, "uuid": "8fb4e163-60ed-415b-894c-b687f5bf9518", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0c4650-8d60-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785558146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785558146, "uuid": "896eee09-846b-4dfd-a084-17d164ad2154", "comment": "Malware payload", "value": "876273d9cf54d3007a6fa23356e41b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785558146, "uuid": "0da05004-2340-484f-bb39-d7a24d237217", "comment": "Malware payload", "value": "d643f913e92cc3d9c799a3e87e7f2833cc2714b8872969b9029042c12dfb8677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785558146, "uuid": "14ce56ef-bdc1-45f8-8ace-ec02ecd4eaaf", "comment": "Malware payload", "value": "4dbfb3355775bc2ab50f8927ae6039fcd9e43b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785558146, "uuid": "4f9420ab-2111-4576-b892-8746df3e43ed", "comment": "Malware payload", "value": "20e78af7ed82af908df8abeed9b8566900ceef13c4085ebe5f01a5637f59f6701ca32433e6509bd28378c210a1d0dd75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785558146, "uuid": "016580bc-1359-42fb-8dcc-53a2e5f1d78d", "value": "T17AC7332A77225E41F8E7213A4362CD0E5B387BEBF703812745B60E4BB79B6582D32571", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785558146, "uuid": "65a16450-9dd8-4663-ac89-5cb38a1ec33a", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785558146, "uuid": "e9c24b36-dd2f-4e40-89e2-01a10340667d", "value": "1572864:5JZ8E8Ss2SN94ZgCsN8gDp8M8grR/BdWISpCj6QJ:xH8wSN94+V8gIgrUIS5QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785558146, "uuid": "0ed80a35-7fd0-4c34-a37f-ac0b9ab34ca8", "value": 52741762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785558146, "uuid": "ecb45230-34ef-4593-93ff-621796bdbf1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785558146, "uuid": "4aed5d74-3b1a-491c-b267-f67169463e9b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e1852d-8d7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785570747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570747, "uuid": "5b7b5802-f6a8-434b-8484-fea8a2b1665b", "comment": "Malware payload (Efimer)", "value": "615812884ec3c3c62e50f8fad5af3a71", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570747, "uuid": "e51a5203-04ea-49cc-babe-5340aaaf038e", "comment": "Malware payload (Efimer)", "value": "d9438d408b84c4163116e57198768a83300895f442e0129e202cc2184b18cffb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570747, "uuid": "e6175019-c198-4820-a8d8-353a1432ed20", "comment": "Malware payload (Efimer)", "value": "0cedba728452fdca1fa85736121969f68142eea3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785570747, "uuid": "f85b65e5-5195-487a-9fa1-53a95a77cf38", "comment": "Malware payload (Efimer)", "value": "0504622636398783c81f71b0b0d69969d3eed0e54bc87a8b3489e184ef38174411e6d950c493922d5069011937409d31", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570747, "uuid": "83231f12-b3ed-450a-9615-d9277e0da637", "value": "T1D8E633182BD422F9EAB7E13CCEF18667E034B4A31331C9DB4BA486532D631E45D3D65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570747, "uuid": "3312b4e9-6e4d-4255-9d6b-3999d9298b9f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570747, "uuid": "d6db636e-f0cc-4ed5-8b34-4da7a8096c3c", "value": "393216:HlcNNsEEtxv5Wm8FOHju6Wc5DYTrXMCHWUjGcuI3/PGTAI:H4CVtrWLKCRkMrXMb87H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785570747, "uuid": "42b8ad55-3f85-47c7-8dfb-c460549fe7e8", "value": 14319378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785570747, "uuid": "f84b4c76-aabc-4964-879a-1c9feeb72b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785570747, "uuid": "fad4fedd-397f-4f4a-8f2a-5deb68f53d48", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28fbb52-8d7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785571582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571582, "uuid": "449515e9-7109-461b-8ff4-341cd36405d3", "comment": "Malware payload (Mirai)", "value": "69db911ac55d25e56296ab32f3fe03b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571582, "uuid": "17f3e0a5-c37f-408a-b4dc-493e6a61f52c", "comment": "Malware payload (Mirai)", "value": "d9511387127b4395e716c2bbb6e4baf8b5ed27ea4f557afd1f69174854ba147e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571582, "uuid": "03b63c61-a9df-4048-a1c7-0b69b8cdec6c", "comment": "Malware payload (Mirai)", "value": "a6940bbcb806a98d2b1c14ca75938da25b75a971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571582, "uuid": "fcdc448f-5770-45fb-b999-2b2412128b0c", "comment": "Malware payload (Mirai)", "value": "7bf8ad12691becd588d66947de19e3412729d764db448e3b16c8a31d21950257c900e45487289e5bf3f5370d78bf8ee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571582, "uuid": "d7455539-2085-49ee-80b2-e3afc6f0d1bf", "value": "T18843022C9B0B8CE7EC1D19F0D1810350397487E0E643DE6ADD45BEE7ED6E939AD44A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571582, "uuid": "aac3d221-9707-4b8c-a433-92872c39fc66", "value": "1536:ply9oUKsaRnbGtEHh+E5c8X83BONzsQ8GcVJus:plAopsaRnYEzM3AMGcVQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785571582, "uuid": "eb3868b5-e9a5-442e-a3fb-57e53706cfbd", "value": 59980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785571582, "uuid": "fe2ba9e7-1664-405a-a012-23f71ca26110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571582, "uuid": "2dca97b4-3157-4197-89db-1c0f7da77334", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0614486-8d73-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566371, "uuid": "f0b21316-fabf-40cf-99a8-2b4bee0ade30", "comment": "Malware payload (Mirai)", "value": "9b34d6e517ae417db846fc07229d6df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566371, "uuid": "89ff3fd1-81c6-4e05-8364-538aa2d4cd9a", "comment": "Malware payload (Mirai)", "value": "db6229c11c9fa4abcba4fb6bd7e433fd478cb487189b0e88b4cad3fab625fee6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566371, "uuid": "38a81732-c569-40a7-a1cc-801cc28c108a", "comment": "Malware payload (Mirai)", "value": "7f811652989419fa69738bd2a70851a5e1d044c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566371, "uuid": "880b51a0-61d7-437e-a0fb-a5f2c76d55a8", "comment": "Malware payload (Mirai)", "value": "ee7b41cd32e87bbc24bfc4c7a66a0a8092737844f1738d66c4df10c9e4b1c7de92e02058eb1bdfdbcbbd7e361725760c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566371, "uuid": "036f6df5-c5be-4aa3-8d75-c916d003c3a6", "value": "T1E0F31C86BC814B01D1C225B6FE1E124E37135B78E3E972139E146B3D7B8AC7B0A3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566371, "uuid": "c7d88035-fa5b-4a9b-b61b-59bfed1365cf", "value": "3072:c4EyIZRXvcQaneUGd9AsXfrU5UIaur3vrq5un597:ogQaetUsXTU5NaIoun597", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566371, "uuid": "93e1f1e9-30cb-4967-8ffc-102714728a79", "value": 171164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566371, "uuid": "26b60497-8cca-4a80-b517-0703029974c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566371, "uuid": "f990d26d-58e1-47c7-956b-5e47a1bb3909", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849449f1-8dbd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785598053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598053, "uuid": "49343eb3-05b4-4b13-87c7-c50c24f56456", "comment": "Malware payload", "value": "ae6dbea78478454c767ec31ce9616683", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598053, "uuid": "9a98d5ba-e1f7-429d-92a3-557f2aff31fa", "comment": "Malware payload", "value": "dcc9ab9cfdefd308235e4299af5c710f1b59920ed842a13ff3b2d43645abee7e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598053, "uuid": "c90803bd-9f9a-4106-85b7-6521f792667b", "comment": "Malware payload", "value": "71e46a8e11d05584313ab27311b3ca470df53d5d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785598053, "uuid": "ba202877-6075-4881-86e8-79275e6bdd66", "comment": "Malware payload", "value": "e2f7016fdb2622ad6ff53b9fd104d91401728f4caab470afd6d3db8cd2cbf456c76467a8f3c4ec50a076081cdd91027b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598053, "uuid": "35cd1a8a-58b2-4a33-96b0-fc06bad5b167", "value": "T1C3253A1BE36344EDC67AC070476B9372BA70F86552346A6E1F85CF312F21E705A6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598053, "uuid": "8f99fac5-e143-4372-8c78-d8aabd43ad07", "value": "aad9df263df01897ce9c0e650203572c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598053, "uuid": "859db7aa-6bf0-49d7-8265-fa69a86c385c", "value": "12288:fjt+61a05ftH/3QPhGcuFyALY9SBLuKmzrgzN:x+tuftfQP4cALY9SBW8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785598053, "uuid": "b3f497cc-98d8-4633-bb0c-67aed9307e27", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785598053, "uuid": "71f67d3b-5d1d-4613-adbb-cb9d49db4671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785598053, "uuid": "8cd1ab98-7a07-400d-9abf-fa13023625e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1773eb-8db5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785594734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594734, "uuid": "60a45f92-b79f-4d23-84a0-f180fe29ff09", "comment": "Malware payload", "value": "b6ed2e5481d0959f3dcd7fdacdc3e9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594734, "uuid": "6c8a6f45-cb49-4ec1-ab00-d0a0e9c7e67f", "comment": "Malware payload", "value": "deff02ac3bd2ecce51edcdf0d5f53f16e53a17f053f7fcaf1c063d599f74de3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594734, "uuid": "29693bd4-3a62-4028-bd2d-8f300dde8171", "comment": "Malware payload", "value": "5f8fb9126cadffe5f9a7ae3cd3eb9274c9de670d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785594734, "uuid": "9bc31b1c-8ee7-4c26-baa7-c6e38481ba1c", "comment": "Malware payload", "value": "938e6b7b4ada948d470af00de49db7b1a1eaa6cd5564486bd3abea76fb746758342e8f38dc66242f8b2f2a4df3c1d173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594734, "uuid": "32deb81a-9d3f-42cf-9290-635b2496cc82", "value": "T11B767D13ECBE044AC1C7B7398013A212FE297D504965235B3DE8F7607F76AB52BA1729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594734, "uuid": "d7746e73-0f14-4575-9a1b-2650fc4a5666", "value": "ebf7b31d91bc055ecd78c3af9ad17643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594734, "uuid": "12484025-e391-4d90-87dc-8081066c2abd", "value": "49152:nnIaFjHKE/64b+Y7yiMQNtufOkFgTgMVSw6QXy7f0wPGxJ0PF6K0f4BI84fMzkOy:w4qoytQNQGsPyL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785594734, "uuid": "131ba064-b63d-4448-aa48-ee244008b383", "value": 7573928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785594734, "uuid": "7c9370ae-5ffa-4efb-a9ea-a52b26e5b819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785594734, "uuid": "4ae1975b-2dbe-4ea5-b390-a3be96b00fa5", "value": "alblrvwyuqqpkhxuetty.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5f3ddc-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620424, "uuid": "378ebc6e-f562-489d-a17b-82cc2f6acec8", "comment": "Malware payload (Mirai)", "value": "83fa589e1989d302d78da60665db5d44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620424, "uuid": "d118029e-5b0f-4255-b3bc-88b0d4fda76c", "comment": "Malware payload (Mirai)", "value": "dfe07ea6c2e5e6eeb28d8acec21353efcc4b3c40d85803d0ab5f42bcf412c5b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620424, "uuid": "855fadfc-e54b-4809-9b88-8291d7bcfabe", "comment": "Malware payload (Mirai)", "value": "16eafb995df1900d78a3a05bc7d2645cd265b94f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620424, "uuid": "1ea488a6-66e6-4f4c-91a4-ae4cfd4a406f", "comment": "Malware payload (Mirai)", "value": "8fde444afc2c274d25c57f22acee72faf8d5f19ccb5d22ca9127c904cb8c9bd76c9f998e1f40e72d25571e141f044930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620424, "uuid": "1094cf72-3ef8-464d-9038-a199ac92732a", "value": "T19723F2117181B823CEA0A87FD07D430F7A2F4EED22E5B4523653035DEE06951A6F5B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620424, "uuid": "21b1ee4a-f891-4cdc-a73c-ca5bb45d33c8", "value": "768:v92J81vwtvOnygIAYyZe1BgrbsqBhNKITniWT3vsIu7YBs3Uoza:F9lsviy2B8BII/GniWbvsIu7Ysza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620424, "uuid": "ce3af25c-2548-46bb-ba82-f48ed226afdb", "value": 47332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620424, "uuid": "07f43b6f-838d-438f-9026-b725d5919543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620424, "uuid": "37d160f7-1f06-41ab-b6b2-070b0a1b57aa", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e32986e-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621719, "uuid": "2559a04e-6de4-461b-92f1-600a2ba9c725", "comment": "Malware payload", "value": "cd5764bb86932b3d41de5b3301aa99c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621719, "uuid": "b25d9704-57a9-4194-a425-2ee8988a214c", "comment": "Malware payload", "value": "dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621719, "uuid": "99ae1839-3ea1-4be4-8531-9e17fb1efcbf", "comment": "Malware payload", "value": "78fc05fe5413049d7721c3f20cbeb8f9f3140ac7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621719, "uuid": "2d113b5d-860c-433d-bacd-59504b6b6ae7", "comment": "Malware payload", "value": "eb2a0b84c8156cf82e06071e92851d2460ce0e5a32de4e4940308abe8793c407ca2d619be48e2fd0dd2ac2a52288307b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621719, "uuid": "2012e936-fcd6-4bf5-a82e-b0c1679c0801", "value": "T11AF08BED949640323F0D543771194C556602082F24B95BDD224E99635E0CFA8334EB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621719, "uuid": "bd114134-d305-4ed9-8f12-6316cbb3a9a8", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQrTERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsWBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621719, "uuid": "9d168711-9053-496e-b8c4-9c5a8b880e7c", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621719, "uuid": "9a5aa67d-377d-450c-8932-c48fa06b0eb8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621719, "uuid": "55a605e4-8c2a-4ff9-8f72-15d27e7dd209", "value": "sensi_tp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b621dd7-8d80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785571651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571651, "uuid": "5f8056d7-0bda-4c6f-8ab7-5525e6197e0b", "comment": "Malware payload (Mirai)", "value": "9126f6f1165a6dc5bdd82deb11c9824e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571651, "uuid": "d382fb38-a098-44eb-99ed-c8552ebcffd3", "comment": "Malware payload (Mirai)", "value": "e1023bacd4de80d93fe3e2a583c8f220dcdd30d4c88642eac0132e12e68e3c1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571651, "uuid": "79ffbe29-75d2-4e8e-ba17-7656dc070d48", "comment": "Malware payload (Mirai)", "value": "196ea561388f870a14f5d488b86800955f1e181e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785571651, "uuid": "7a2fbbd6-b68d-464a-820e-a33ed76500fe", "comment": "Malware payload (Mirai)", "value": "751841ae0ad1c29b5368e28728810fac9306abfa8780bd2f4360721133885941d82077011585ae7e142f16a60c67c19f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571651, "uuid": "8fa96754-bcf6-42a9-8202-80d52eeb9429", "value": "T13924A74F6E239F7DF27887344BB34E25675923D523E0D684E1ACC6105E2029E586FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571651, "uuid": "a1200ec6-a051-4d54-bc7e-c54ec00a90a4", "value": "1536:GJZJL0Ll6zzIdLHXOFdeuk8bmamsoK+xsGokMeraPzo+JTQXTPWKt/s8lBsG5nCE:q0sJd1NmsoK0sLkKPzjMSKt/s8gGA5Bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785571651, "uuid": "c2f0d327-e1bb-4ca4-86b2-22a405e63c32", "value": 210264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785571651, "uuid": "070e43b2-0e52-4318-b0b9-ab2c49bc2fb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785571651, "uuid": "cba60c96-f9ac-4ac2-be1a-73256c25d8f1", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cb0f88-8db3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785593786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593786, "uuid": "9c19d954-a4f2-4712-957a-d528ec3c1d5e", "comment": "Malware payload (Mirai)", "value": "ca7a4dd2924e4646b4cb5b36c379801f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593786, "uuid": "0f7f0ce4-837a-44df-9857-614d7835c5fa", "comment": "Malware payload (Mirai)", "value": "e109c0b30c8602942c7893b0e10c8ff1da9ea7484e404e00d0c43569e9c7f12c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593786, "uuid": "e2d93b3a-89f3-4c4e-9d20-9fb243a8dc96", "comment": "Malware payload (Mirai)", "value": "4fe08d58ed82d94ecaeedf22e0a01a16545eb66a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785593786, "uuid": "cf47da27-3778-4e14-a431-465209587956", "comment": "Malware payload (Mirai)", "value": "8992ed44abc19efe519349c1741c15effff40ddcfc6da022e5f954cc926a0dc8eeb3cc3ae9c7303e634065e9e540b0ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593786, "uuid": "f5972a54-03a4-4715-b7b0-28b3a7fbb609", "value": "T1DBE36D81F603F6F6D84605705077EB368A399265111BFE92D3B8DF36E8A3502CA17E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593786, "uuid": "595066ac-a069-4db7-b637-f60bc64faca9", "value": "3072:ZwcAOnT5luWLiO08pk8knQWAkLVzjO+JWmvEaZp78n+:ZwcAOn1l15kVRWmP/gn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785593786, "uuid": "62739105-5549-4b82-a6ca-770e973167b0", "value": 151144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785593786, "uuid": "2f9c56da-c73a-4b7c-a776-fc88efaec75a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785593786, "uuid": "b55df986-80ce-4f00-acae-e5b203cf2de4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5518b12-8d81-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785572338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785572338, "uuid": "8cd2910a-2cfe-4377-87d6-11942936d0bd", "comment": "Malware payload", "value": "1fbed3f678905392e7b65cd0bda219ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785572338, "uuid": "dec9f63a-741e-4a07-83ec-6d95dba82f7d", "comment": "Malware payload", "value": "e2d467633bac8ab3721026e91ba75a3224682a7bcfa66e1107930c85dd489b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785572338, "uuid": "eb277421-5e46-40f3-9963-726e39573058", "comment": "Malware payload", "value": "90fe6003079c867dfcde56dbf5faa70f60406ba8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785572338, "uuid": "96ac2619-6d40-4400-b824-a521d9354b15", "comment": "Malware payload", "value": "2211d295ea8c79980bef48956a204e1238b19fd2afc25780c24aa4879b662f0771ce83634c0b2f4e800130c07d265a5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785572338, "uuid": "8b8cf989-e7b5-4277-8696-a87571df94f5", "value": "T1EA63124623A92971567145F1E7FD6B88E60D3A5C8FF16C247C227CACB93236D5CC8518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785572338, "uuid": "5be06afa-2d33-47e1-8e97-f89459e81d2e", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2KO:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785572338, "uuid": "78bd27a5-bf02-47ab-8bfe-57a447a020c3", "value": 72688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785572338, "uuid": "815c320b-c746-4a14-bc32-99d7b2257926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785572338, "uuid": "a7f76617-7c9d-4fa7-a1da-000884efdaec", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f71eb5c-8d6d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785563551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563551, "uuid": "a3420cef-05ee-4746-90e5-1ca44dda6579", "comment": "Malware payload (Efimer)", "value": "8a7b910b72f28cde58f4d40a50ce7e9b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563551, "uuid": "0a6afb8e-7552-43c2-8453-734e56ce5ad1", "comment": "Malware payload (Efimer)", "value": "e3620b7fe4c3cbdf89ac002190d6b04eaa810094fb657fd5351b0faeb1df7326", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563551, "uuid": "287a40b5-b3c5-4d25-9d4c-a2eb9cae34b0", "comment": "Malware payload (Efimer)", "value": "ec3d50e4181a65b6a757381d805404b8526ccc45", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785563551, "uuid": "20ae769b-0c5c-4b2f-8260-e9fdef95e072", "comment": "Malware payload (Efimer)", "value": "aa17b91e9399fab6adec48d5c0c1407e03c868fd2ff0d428836b35447e517d6ef98b92439750e802b7c106eefcb88e3d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563551, "uuid": "a1b73ca0-4571-4788-aa13-064d86422747", "value": "T17FE6330D46D422EFF8A35138DFE35688E5B4B8BA0B71DACB171096627D131E46E3DA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563551, "uuid": "35e951cf-1d46-40cb-b234-83c42a9a5f00", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563551, "uuid": "10351894-c9f3-465b-8f3a-48122e0a268d", "value": "393216:kXrN7tosSoKsUmgXMCHWUjDcuI3/PGTAI:k3HSoXUmgXMb8gH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785563551, "uuid": "09a64e27-aa98-4e64-8bb2-881983996f5d", "value": 14317136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785563551, "uuid": "3ce7a42b-f8ba-47e2-a019-5f342b398dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785563551, "uuid": "0d4bd89a-074e-4a49-8011-c67f4cb3109d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5d9be2-8d57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785554206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554206, "uuid": "29490fba-9ce4-4341-a2fe-0dd62548141c", "comment": "Malware payload", "value": "6d3845b911891c68c72b835152be7505", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554206, "uuid": "c3066f8f-a746-4bae-9cbd-eb6ac8f3e8b3", "comment": "Malware payload", "value": "e378df570301e2a7cf4d1a79508a41acae37df09d2ea0460902e2edb49d6533c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554206, "uuid": "ac7249c2-e1af-4fb1-92ca-ae47529105f4", "comment": "Malware payload", "value": "483a6604c0ad33c5a6ae390822d8c0b88196aba6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785554206, "uuid": "ee950d13-d101-458e-a3ee-b6cb4fb3ebcb", "comment": "Malware payload", "value": "ebbb75ef4bd629c634f42c60dc2f8e053b933660d3eea7a51cd76f285242716c0cf5229d35e0fd5d8d6c11494507f8e5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f9d3d96cfe614ce8cced68416cbd16ba", "colour": "#8FE0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554206, "uuid": "391e294f-e026-492c-bb91-8aab956003ea", "value": "T1B9D52398B4F619B4C43BC3B19F92E83DB049375596908E93FBCC6A109E13A546C3B376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554206, "uuid": "9ac925fc-e18d-4782-9d18-62034dd737e9", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554206, "uuid": "4dde4407-fdec-4130-8532-0ef359482601", "value": "49152:05EC+S6HQoPCRKzdP66lp8ttw74RLIqeCAub3kD5OVIWjCmfyDrwz1bLAK/iRlDf:U3KaRS66fy84mqXAub3cWIDrO1M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785554206, "uuid": "c405ad50-7dba-4ca9-a423-16c3a6ffa4bf", "value": 2921472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785554206, "uuid": "5078b106-dedd-4829-9e88-0ba0654a9e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785554206, "uuid": "5e856551-4c8a-4379-8e84-8833ea8daecf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2872b55f-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785544641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544641, "uuid": "1e3a5000-7213-40a3-8959-9e625d3b7a2f", "comment": "Malware payload (Mirai)", "value": "62a3614f71ce2683f1e2b26ec81dc4b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544641, "uuid": "b7c52348-c227-4441-b29e-fd8e6baf25d7", "comment": "Malware payload (Mirai)", "value": "e4a65dd53b6c3ad3eaead696093c360196f75165ce98ddd75bf164b9c4a2af52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544641, "uuid": "e6f7e5db-997b-40df-ac55-c77bf3527ff3", "comment": "Malware payload (Mirai)", "value": "fb59320a5674b82ff8fd36d2caf7caeb50ab0f69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544641, "uuid": "3f83380e-d82d-4d49-8f87-a1161964d92a", "comment": "Malware payload (Mirai)", "value": "a0c0c0c98dda1445d99e3dd834e0edbd36d8e86e551d690c7a910c5e5f748f46284d1dc74fc46d8f6c569b39ed51b572", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544641, "uuid": "719c6b6d-a3fa-4bc0-ac3f-e83ca1efd33b", "value": "T1D0C3AEC3FA8714A1C46206F007C71BAE2F93A221CE5FD4E7AC1DB53B5A7A4DA1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544641, "uuid": "1f1161c7-861f-417b-841b-527c57f70b6f", "value": "1536:crMjtT/2h9gFinjVljXgPnlWuoPJUmEBYLlJYqFccxs5tFgRCE3/LWJ:crWT/i91XgPln+HEBYLgqFcVgBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544641, "uuid": "5887840a-2460-4934-97ed-9d74a8d1bd22", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544641, "uuid": "7dfb8de2-4a7e-4785-b102-90c465e563c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544641, "uuid": "91da1ef9-e1f4-4429-91d6-2edd5c92a1f7", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c7019f-8d7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785569068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569068, "uuid": "f47dfb92-d2b1-4d6c-b4cd-69652769ddc3", "comment": "Malware payload (Mirai)", "value": "648c4cbe71a96fb3059018c83659413c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569068, "uuid": "e24a4195-9395-4d89-b0ea-af0f3e6990da", "comment": "Malware payload (Mirai)", "value": "e696a2d4c7eeb9758511e2920c3a6f78cbca6e152770a5bba0555322915c12b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569068, "uuid": "a5fadd46-f16d-4cf6-bd0a-15a6bcc491cb", "comment": "Malware payload (Mirai)", "value": "86152be1e5c9e490c445f5659062b68a9f427ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785569068, "uuid": "b3003a53-94f7-4ce6-85eb-135175dec80c", "comment": "Malware payload (Mirai)", "value": "8ba0cb9b1576fc2e40d0471ba170e84e9b2836faa686fa46221d66a0b3a9dccf97c3d78e3837c75004ea0005f59dfaae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569068, "uuid": "de0351f1-b45d-469a-a3a4-79e4bb7988a1", "value": "T1C6F32C8ABC818B12C5E261F3FB4E428D372A07ECD3E6B1079D196B19375B8970E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569068, "uuid": "7dd18a15-98d0-46c9-877a-3a7712399066", "value": "3072:0aceXC7TtA4MTco9oKw4ObDAeLUadpV4HBPcK:0cC7a4MgWVw4Obsen74HBPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785569068, "uuid": "17792f0a-6893-47b5-8474-7d55f30874f3", "value": 163712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785569068, "uuid": "ac72bd97-1caa-4330-a2dc-f520aa577504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785569068, "uuid": "144dd5c2-096c-422f-9b18-df7ce1141c46", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1927e138-8d97-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785581552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785581552, "uuid": "839afd2b-2b9d-4eb3-81c2-30f1a23d2666", "comment": "Malware payload (RemusStealer)", "value": "523b0e6fe7b5d6bf1fa5784b4a79a321", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785581552, "uuid": "10f29ba0-26ac-46c3-ae08-8e942e2d4430", "comment": "Malware payload (RemusStealer)", "value": "e6d68f489e840cfd04b764b40adf3d41820d0c9d979d7af21edddc8295aaf1e2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785581552, "uuid": "34726e91-9bb5-490e-83fd-c0019a0dcca0", "comment": "Malware payload (RemusStealer)", "value": "892c612587511025b4821bf5405070d5c6ed3e23", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785581552, "uuid": "2c720778-f252-4328-ab0e-8dcf0948eefe", "comment": "Malware payload (RemusStealer)", "value": "c6a435ed8ba39ab74c3ca7ad09d66ae388c56caa538b86526029b04622e867330f3616ff482071e803ecdd3f938e06f0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785581552, "uuid": "52b83026-29d8-49ae-9565-06eb07c0b291", "value": "T1B1E55C13ADA048F9C099E73588775A56BA74B8494B3133E72EA0BFB52F713D09E31394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785581552, "uuid": "508f25c4-ddbc-45ba-bbe0-ab25b438be55", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785581552, "uuid": "a62a2bc8-28ba-46df-9b21-976b4a3ba915", "value": "24576:orniBCLMEuE7tX7beQq75h409IoqcvLbJBFOMSTcfRHQpv/JBele5r9D9COLMgqy:ornkKMtatXHeQq75b4ySYhEryM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785581552, "uuid": "ac84f62e-d58a-47c5-b653-9380341bfcd4", "value": 3212144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785581552, "uuid": "6cbd94cd-defe-4431-9740-fd92007842dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785581552, "uuid": "9f865dd3-6677-40b1-90d7-2669799dd123", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bf8f2f-8df9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785623667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785623667, "uuid": "5a0a8fcc-acb4-4b43-93eb-8db638afac66", "comment": "Malware payload", "value": "f933f8ddc34360b92de0c27f3f4f65fc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785623667, "uuid": "f1504d9a-6bf5-4fa1-a9ff-14d39b195c21", "comment": "Malware payload", "value": "ea4629087c21d256fa9cc6ad8129156395e160a386aae05746bbc37ef5d57e9d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785623667, "uuid": "802b0cd4-c158-465c-a7cb-1f519a8c5a6e", "comment": "Malware payload", "value": "87c928c2f33e58b6bc4bd737eb9fa0065c6053e4", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785623667, "uuid": "d821bac1-66e1-4847-905d-1f3c67408abb", "comment": "Malware payload", "value": "3b37dd6e1c52ef17621651dd5ee09eededd32ae66688f9219c1a78111c6a11504ca5a84b8a7738b49667169be4af43cd", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785623667, "uuid": "3a869bf3-c322-4b50-bd1a-cba100b44948", "value": "T10C276C2ABED578315BFED3839BD2CCBD8517900052673C9F298A17C88449B68BF6721D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785623667, "uuid": "5182d11e-9fc5-481a-8b1d-98f48e8f16a8", "value": "49ffa8e77f429c2caa4d731a3a15259c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785623667, "uuid": "dc13d465-4a4c-49e3-9e80-d86fa01c744b", "value": "12288:6AaTZbxy9eNdmgaLWUDh7iHTFzGXnpW+q5pBosxgb88AmQTGzjfd:6AwF0eNYgaC2OH7+EBoNDtCG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785623667, "uuid": "df1ede83-2d06-47ff-a0c6-873cfa4ff424", "value": 21009920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785623667, "uuid": "126f9c3d-e738-44ee-a929-f133b81b037d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785623667, "uuid": "f6869ac7-1c57-4b40-b4f3-f030596336ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b94b16-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620446, "uuid": "650782c5-1b6d-4575-b9c7-e99f63110a19", "comment": "Malware payload (Mirai)", "value": "7f3a1abe0ee027d542d50ddc463759ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620446, "uuid": "a5ecc5b4-0d54-4a75-a5f2-8d667a469bd2", "comment": "Malware payload (Mirai)", "value": "eabcf8d5823e1e5971362cb11155897ccb17f7848b5ea78b53071c61d05e78bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620446, "uuid": "a64dbdf6-3dca-4d82-9699-e4e819d53223", "comment": "Malware payload (Mirai)", "value": "0fd10edd562b13f0ed4ec0125c80715930a25504", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620446, "uuid": "3d04aa5d-1ea7-4563-a487-036b759fffa3", "comment": "Malware payload (Mirai)", "value": "9a415161dd09ab2a48a4ed9b45ee99c4c1aff5f8c0e95bfbe3899b4c430fcac99ae9bca32e9f5634d61cda7fa3d8c8b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620446, "uuid": "d915f9e5-da9b-4d95-a258-20ceefc1b2cc", "value": "T19EB35C4273180F47C1930AB02E3F1BF687BBE5D021E4BA89650F9B5A8675E77154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620446, "uuid": "0fecf3ea-79e9-49ca-97b3-d27223cf7ee9", "value": "1536:3Bbxi0VY3+TmlGzmRRuNfvyJpbl8pfnKlIpYwl5KD19j+JuM1+463tL7U:xbk0VkR8mkMpJSn5y92uk27U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620446, "uuid": "01adf709-eada-4065-986b-13681612d80e", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620446, "uuid": "13dd8216-1853-4304-a6b9-119cf49d43fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620446, "uuid": "6a50fadb-fa6c-4589-b83a-c30fcc26e54c", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268ac9c1-8dc6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785601761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785601761, "uuid": "5d071f97-5c41-42ce-a114-181f789fb70a", "comment": "Malware payload", "value": "4ae89563d7dea9152bd73a9f88f56da6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785601761, "uuid": "de1d99ab-f173-4a18-aa90-d0ec98e8cc06", "comment": "Malware payload", "value": "ec5cf45500cbab8d6ee6943d14540b3d470edd5f19efee82c17b55fff1a46d4f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785601761, "uuid": "3fa61c1c-f2bb-4768-bc20-ce0c0363d175", "comment": "Malware payload", "value": "b65f1be973a9fec0c488ccbcfa3745a16dbf4cd5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785601761, "uuid": "76bae3c8-6973-4ef1-a5d4-3b916afbeb9c", "comment": "Malware payload", "value": "eaabc94e849c88b1249676aa92064fded8e491d07d3a9e4caf77e6c9a47b69a68cbf446f58515d76ad523676d0b797a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785601761, "uuid": "a9c64287-5c80-4121-b3fa-baddd070d3c3", "value": "T1D2C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785601761, "uuid": "456b3be0-ab00-44a5-9054-e0b0bcbe2bef", "value": "768:68vCB+25j6es8R09FYpMSUpi+20qUpi+20YQX:68l25JSd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785601761, "uuid": "1e351fb0-c8ce-4f94-9907-bd17976d04f1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785601761, "uuid": "3f7db4e1-c846-4935-abb2-5b1fcbe3e157", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785601761, "uuid": "a1e72462-c11e-4310-9196-4b76c5440ca4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9047897f-8d83-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785573162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573162, "uuid": "ebc27d3c-6857-4973-a478-ead989b861f9", "comment": "Malware payload", "value": "ae32772d6ed6df33ff6d6ab7bf1d59ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573162, "uuid": "5294b135-dea6-4cfd-b318-966d90d9a15b", "comment": "Malware payload", "value": "edb9bdb68ef0f04c030300753b606d2a2cac2a7411554726d824ab20f2e53f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573162, "uuid": "c5f297eb-ddcb-4002-91f9-a5b725597170", "comment": "Malware payload", "value": "313761f14f722bbb4fafd36ddc41e56f39fff5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785573162, "uuid": "1b1c7bd0-4581-4166-8727-046696b74a55", "comment": "Malware payload", "value": "71b5337791c78e40fa3ad9521dc8d6702013aa99f1896584bea55780f0d1ea4c6e7e28f7f66b461ec06a4ea104283240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573162, "uuid": "ac4e9714-5204-4ded-9ad1-7fbe4c7c629a", "value": "T135D522DABCF269B1E836CBA6CE83E02D71987B554BB00EA736CD3A045D535645C3A334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573162, "uuid": "14101593-b82d-4605-877a-27f974ecdc2b", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573162, "uuid": "1a0055a8-5053-4817-b97d-fb370d691253", "value": "49152:lKA4lUq26ItugJHSuNWeaP0HbK8vSNgP56g8NxZR6EhRZuO:slxG4wNNWeacHbNSeYNngEf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785573162, "uuid": "afc51130-cfb0-4eb2-a88e-0c120a8d5de3", "value": 2989568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785573162, "uuid": "88997d6e-3cee-4910-8692-dd5ad211a9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785573162, "uuid": "84578304-94ab-4f09-96e1-4fccb3f69292", "value": "SecuriteInfo.com.Win64.Evo-gen.78661719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25093a5-8d41-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785544899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544899, "uuid": "e28b4bc3-c5b9-4a3b-96a7-066652f1e0b5", "comment": "Malware payload", "value": "03f6a7c870f1d1cf4547368d05db5af6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544899, "uuid": "3dabd200-58ee-406c-b287-b593cc8fc776", "comment": "Malware payload", "value": "eddbb347628295fe95ed818e7b28543562d2cf35c30077f5dd16da4af3ff30df", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544899, "uuid": "cab3ec43-53d5-42df-960d-9c16ede1f3d6", "comment": "Malware payload", "value": "99a62953b92a138555eb56fd1bded24a1d3a1ef8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785544899, "uuid": "add2f79b-3154-4068-bdb6-c739512c9e73", "comment": "Malware payload", "value": "5ea458e39275678673957c0424af23328183b93edba5bcfa8977ee811bdc8c2226bb7bbcadde91d98adad9ab21d63572", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544899, "uuid": "b73d132b-c8de-4a2f-8b80-1f30d8f4805b", "value": "T1D4C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544899, "uuid": "1ef8a5c1-29c4-4f9a-9e79-a4ed320c47b2", "value": "768:38vCB+25j6es8R69FYpMSUpi+20qUpi+20YQX:38l25Jsd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785544899, "uuid": "02e446e1-dee3-4132-97a5-1d067145d236", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785544899, "uuid": "adcc3453-cbf7-4e67-949c-fbfce570640e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785544899, "uuid": "b0e07367-ac13-4d14-80fc-31a7bac98eb0", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a784010d-8db9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Blackmoon)", "timestamp": 1785596394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596394, "uuid": "4706df0a-b6a7-451f-9c4b-1685b1cc290d", "comment": "Malware payload (Blackmoon)", "value": "9b80c3879f77b11b7207f8336101b486", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "Blamon", "colour": "#2B27B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Sinresby", "colour": "#909487", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596394, "uuid": "6d9c263e-396a-40d5-8976-4f2163de5108", "comment": "Malware payload (Blackmoon)", "value": "eefacb5cf039f7512c110564a489c7464032eea8ddb1781d3cac69db2f106d0d", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "Blamon", "colour": "#2B27B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Sinresby", "colour": "#909487", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596394, "uuid": "d898969e-b83a-49db-93e6-b1da86d31a74", "comment": "Malware payload (Blackmoon)", "value": "e9725da4441bb736b4a2834edc652dc7e3318ae8", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "Blamon", "colour": "#2B27B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Sinresby", "colour": "#909487", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785596394, "uuid": "bc1d3ae2-08d6-4580-8633-c1aa0b5ddfd3", "comment": "Malware payload (Blackmoon)", "value": "fec4ab3f5d03c737514e0384b5aa894ad18f65326613cfcf0d62592c3d912b7825ca3ca20f87dbb7d1bc0580e94909d0", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "Blamon", "colour": "#2B27B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Sinresby", "colour": "#909487", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596394, "uuid": "00cdc1bb-455c-41ab-bcdd-ad85c5c147bd", "value": "T1BE848E23A300C4A6E61416B395E30B3D6D7497A13CB5CC53EBD4CEB19E722319B6AB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596394, "uuid": "2bd544c6-7b71-4159-b226-8aeab72c5f87", "value": "c13c11e8631ec7a1635a1981bb585142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596394, "uuid": "6e257c05-4bb8-4eb2-b5bb-b39a1233d52b", "value": "6144:HfeeXd1dLdYAlYzVL4N7gOYE7f7JyIV+eUhTzuYfSjoJb:HfDXd1dLCAlmMN7gOYEbtVMhMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785596394, "uuid": "56d5b1a9-ebf5-4926-9c4b-c2e4eb0ab97b", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785596394, "uuid": "010caf0d-f53a-4c2d-84f1-104cc882a0cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785596394, "uuid": "1a34a49d-8644-4bcc-9b28-ecfc4e422f7a", "value": "cli2update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3052bd9a-8d4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785549379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549379, "uuid": "deab1d44-58b7-4efb-bd32-1ed504d06c96", "comment": "Malware payload (Prometei)", "value": "89681015d18fdd736bf3703a44aa73b1", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549379, "uuid": "50fa3356-00f8-49f8-b23f-c6084edfffff", "comment": "Malware payload (Prometei)", "value": "efcf7d27639d35b75eca73dde46b87ef103031d4c60de2f8d511bc11c49397de", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549379, "uuid": "c4dfc474-def7-434c-803a-012c30fdf61f", "comment": "Malware payload (Prometei)", "value": "17445b7ed339944538124114645930efb8709ac8", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785549379, "uuid": "e8198295-dfd3-48f4-a9f4-3373f574810a", "comment": "Malware payload (Prometei)", "value": "f511e87e9ad2566ff4fe86ce351e989208cea1af5baffe2d32acbf09e67832c57c1abd6f552c86941fd9533b951d1988", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549379, "uuid": "f2e51925-b403-48a9-9a22-0d795f6d1f93", "value": "T1F7B092E962761E80F0285A05709A1C51BA868AA595586A69F88848BACD49601F106B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549379, "uuid": "5aaa9ed5-f09a-4c19-b4de-816eb7bdd821", "value": "3:TKH4vGBwkSDETLtWiL71u9GN3+GuVjLWgKoKWnQDFpKSbn:hBD6xXL7mGEjuXVDFbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785549379, "uuid": "c39ef047-7f86-4741-beea-094d9635b373", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785549379, "uuid": "c12fe8d5-5ee9-4c5f-9346-8d3c67546367", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785549379, "uuid": "df3a7ac6-c05b-4956-9b1b-eec55e6e0acf", "value": "efcf7d27639d35b75eca73dde46b87ef103031d4c60de2f8d511bc11c49397de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bd25a9-8d65-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785560424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560424, "uuid": "d959dfda-df3e-4de2-8240-e4da1d56a22d", "comment": "Malware payload (Vidar)", "value": "6518d397d3d18380d927cb8cbf458c22", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560424, "uuid": "2aa957f3-00be-47dd-a5c8-a0c60f3af156", "comment": "Malware payload (Vidar)", "value": "f11bc43f99f2d7518365b726f3ce69ccff1d4e2ad6d2e7b3888c004efcacc80a", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560424, "uuid": "a06b75b5-c2ad-4c87-bf55-610b2802c29a", "comment": "Malware payload (Vidar)", "value": "6cd50d34b2f5dabe1ab6e9c022bd472cff9e7fbd", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785560424, "uuid": "d2144047-c36a-4cc9-9481-7808557b1176", "comment": "Malware payload (Vidar)", "value": "6af41ee4648b4e4ea4324c3b4be60ccd265fd75630262baf8bf7a4e0eec20928ec51bf1c1c0322f3b3f6f2da4d72cf6c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560424, "uuid": "cca982b2-6cb4-4929-8edf-8d2fde460f79", "value": "T1D95412C7A32BA04DE4E2C63911A748C45F1D377F3682D3A84959D60F33EBEA15C7A416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560424, "uuid": "aa0c7ee5-b8aa-49b1-a402-fb37141c7212", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560424, "uuid": "ab5bfc76-8694-4b38-b8b2-7ecde4bf58ae", "value": "6144:0S+pVt6Yh/o/k6HmX8nI6dicwKJYl4UKGaL/bgKu:P4VQFk6HddiTKJ59Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785560424, "uuid": "c1ddb92c-0111-4720-b50a-2ce2caa04bb0", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785560424, "uuid": "d934cfda-bbea-4472-8527-75b8dc6ef391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785560424, "uuid": "6fee4544-a4fa-4128-8229-d4da26322692", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c5c944-8db7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785595456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595456, "uuid": "555f224d-ab94-4d60-8f30-81d4807fa18d", "comment": "Malware payload", "value": "42365416171ed06852f0d66382fdf4b0", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595456, "uuid": "14e393a3-b707-43b2-999b-e8d219e16749", "comment": "Malware payload", "value": "f1e8de4a153e69b211f9fe00a07a35985cf1f0206a2789901d635ea8a713ed2b", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595456, "uuid": "682f3267-0699-4480-a9cb-ff65c5e94a5f", "comment": "Malware payload", "value": "b56fe75317f2c2c5b7d94014cbd7e440df43b696", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785595456, "uuid": "665f441f-82bd-4656-a512-659fe0f85ee9", "comment": "Malware payload", "value": "9e1463f0cb49120cf471d51b34437e4992d5911d89b4d856716d99e4f71f0b76a3ca9428af7e7d90510e7823deb927ac", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595456, "uuid": "008ffa77-4dd6-4654-b0d5-73dcf0e9bfc0", "value": "T1CE4294476382237705730152BA5C71E6E72A917C6337C664B86C863D2BC1C3866FBADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595456, "uuid": "b483976c-89b0-4713-805f-3a4b595eb829", "value": "192:23lUTpBxWc1iiX2MB7GdlywfKkAlhNd0SC3ejLtvjmVK9uoWXCRSyEBX3yb:j1f92MxwfPAlhPCOjL1mVKIaRsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785595456, "uuid": "3c4dc68c-c963-4c43-a0e9-d4568ca2a629", "value": 12437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785595456, "uuid": "4472075b-994b-47b6-a132-e4aa0b4099b3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785595456, "uuid": "313ae3c1-535b-49b3-8dce-6b97e88c2c3f", "value": "DRT7_187496.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1521c9-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545135, "uuid": "c60bdb43-dd34-480d-8cce-5b39a1e8b988", "comment": "Malware payload (Mirai)", "value": "d60105c1eb43ec3f7eff025924966220", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545135, "uuid": "2fdd0e89-dec6-4ddd-80b0-b5b32a88cc19", "comment": "Malware payload (Mirai)", "value": "f28ff115079db6cd81b52775a337d2f694b53d130a2c1e52a247585c55ef7e71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545135, "uuid": "92a3aa8b-4e3c-4bdd-94f5-9676049ff44e", "comment": "Malware payload (Mirai)", "value": "31e10119b42a6ecc9125dabb88e27d7f52f04c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545135, "uuid": "67574bda-6b66-449a-bf43-bc27089366ec", "comment": "Malware payload (Mirai)", "value": "acacc9345ace36f829fdcc0d099fb3c99d3cbedb76b0b7e0b1a434915086a1d640724f9b5ab1f2bda4abb7f0e191386e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545135, "uuid": "f9cb540f-6b5b-474a-847c-6e617b61cb6f", "value": "T1FD03E160E25E0F2EDFAFD4BD8F94E7D63BDA4AE563D1CD7040959201100B825BA5CEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545135, "uuid": "cbfb2215-6059-49d0-8037-3cf8b27a10c8", "value": "768:M9mIAsqqVUkJ96hb61ysYZNDkn9fj3yu92Pj0P+D65NeOD4uVcqgw0Ip:UmIJqqVbyVZQ9LyA+D6beOD4u+qgw0Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545135, "uuid": "7aa7060c-a3d6-42b2-ba82-ddc2c68c8c30", "value": 40660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545135, "uuid": "2beb0fb1-08ec-4add-8351-df371f7f42c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545135, "uuid": "2184892e-3824-478d-83f1-612044b04e2f", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487ab682-8d74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566599, "uuid": "9dcb9d74-f826-4147-84cc-a94566574d87", "comment": "Malware payload (Mirai)", "value": "7c837309446358a2e72fd4bfd5667b2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566599, "uuid": "d82c9f72-b3fb-4afe-9e50-abca5f9cab2a", "comment": "Malware payload (Mirai)", "value": "f32d274757f36dc256c0a4c1f66a49903802f8e954a8af6c96ea0a812e5f1ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566599, "uuid": "73a8be57-f81d-4930-b693-d25398705f8e", "comment": "Malware payload (Mirai)", "value": "260366983792f68036b7e0b9fa4b925551678934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566599, "uuid": "bf77da57-2b43-4b9a-bdbc-58d7245c3596", "comment": "Malware payload (Mirai)", "value": "49b00309687d93f8b3994a7abc81fa5d465b2caca012c552bcd2d994b912b37b19e61b2fdcd5fccf8e235b535f8532ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566599, "uuid": "99c86d52-a6a4-4095-b0eb-9cd3c5ca0b0c", "value": "T1F633F15F39061BF1CA31C469CB5E0EA655F107BDAAE9B473F8205270D2946ADACCC782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566599, "uuid": "872129eb-21fd-44f3-8fb2-e0222299a69e", "value": "768:uowaANNHH9lEAeesZI1de/IBBbxxivFYgxixi9cYCngr8Ktrn7xNn6ZxY9ovbMSH:uoZwHAAeAlmBSi6nggmnNR6ZfzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566599, "uuid": "c66da477-8ace-4e18-80e6-a5ed17ecf13a", "value": 54184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566599, "uuid": "58143a84-6f77-411a-9986-8332f6f9e655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566599, "uuid": "82bfe444-1955-4649-ba71-ac7fc10ee5d4", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bce0e81-8d42-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785545076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545076, "uuid": "3c53302d-ec4e-464a-8284-b0fa8db17260", "comment": "Malware payload (Mirai)", "value": "35b079eb7047b4df2bba40ebf78fb92d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545076, "uuid": "2be00a36-83c2-4a8f-9777-b8313bf846d2", "comment": "Malware payload (Mirai)", "value": "f774f92ea7a3c5c2ddf1275b869a3204a2c9fe7a16d96484f0ff4fa355185fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545076, "uuid": "2b684c68-1d6e-4d72-be3f-0006311e17d2", "comment": "Malware payload (Mirai)", "value": "f746aeaecb691dac23870102bc07920070bcad5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785545076, "uuid": "e32083e4-2418-49c1-ba57-ecebaf4b38f3", "comment": "Malware payload (Mirai)", "value": "bb9d2e55efda811902a5a6989746b02a4eb229cfe84ff40b203f890aeddbd66cca1e35f45f0acec49a48dce520c16047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545076, "uuid": "6594a36c-34df-4f79-b99c-441dd8508767", "value": "T15A932952FD814622C6C116B7FB6E428E376613A8E2EE3203DD255F2137CB95B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545076, "uuid": "89a03e33-d338-4b11-a6c1-c3b1605c2195", "value": "1536:S5tDkgSzvqbjFISR0szkdU4zgt9HSkijrPCHCjQlZtQ2v2aJc:S5tDkgUqbjFlV4zsJNijrIC4Fvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785545076, "uuid": "5b2a2a95-4d98-4df6-afd3-aa97565126df", "value": 93240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785545076, "uuid": "2371e5bb-09a8-4a03-baa1-1faf732eafb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785545076, "uuid": "409e1851-f459-4bda-a63c-095a268ca525", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cca4dcf-8df4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621716, "uuid": "b80e4057-0b16-480e-b365-80ce4ef26ee8", "comment": "Malware payload", "value": "e5fd9ba546494fe9e1e72ad7cb964e41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621716, "uuid": "03972600-2605-427d-837c-7b1707b16297", "comment": "Malware payload", "value": "f9c0fbb8c1466b61bf76112b79c79c3dec67cce1e4b7e290de753b6c194d62d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621716, "uuid": "8604b20c-654c-4895-be78-2f4ad7a91385", "comment": "Malware payload", "value": "b2e92ea7ebcf5e6020f3225767a05766ec2e17c2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621716, "uuid": "012d0756-81f1-46fa-8776-b54e11ccc229", "comment": "Malware payload", "value": "9220c05a565afeb8a06bd56ffc14d0f60cd4de4e418b2caf44cccda41d5318e116193990bc5bab4d9a9630e5b27bb0ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621716, "uuid": "6d00150b-ba48-4536-87ec-b594ac4c3f73", "value": "T11AF08BED949640323F0D543B71194C556602086F24B95BDD228E99739E0CFA8235EF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621716, "uuid": "95be4628-782d-47ad-9c0f-3c016ecf278f", "value": "12:ZsU9jWijWr5jW2FFl7jN/OQrNaQATERE5YXmY6uYCYEeyH:Zp9jWijWr5jW2Fr7jN/VsZBYXmYRYCYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621716, "uuid": "659a409d-fc9d-415c-977d-62e865344bb8", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621716, "uuid": "9507a250-2833-477f-8add-269244cf4ffb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621716, "uuid": "69430a4d-714b-40fc-83da-8fc5cadc014c", "value": "sensi_av.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed889de-8d50-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785551202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785551202, "uuid": "5c27bc93-cceb-41a8-834e-5a8f031df7b6", "comment": "Malware payload (Mirai)", "value": "db57135458954fe78233fb877bbfe483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785551202, "uuid": "1a72b57d-5e06-4d21-845b-bfa027e473c2", "comment": "Malware payload (Mirai)", "value": "faf518894303e8eed32039d755927a3ccb42504f0ed2527a7cb7f05300900f98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785551202, "uuid": "a183f9bc-fb42-4fac-b73a-47332991fcb5", "comment": "Malware payload (Mirai)", "value": "5df69936d29ee81e80786398cf4b638a9dfd13db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785551202, "uuid": "0660fda8-91e6-4397-b4e5-8fb33336de9c", "comment": "Malware payload (Mirai)", "value": "3604cfcb7621320ba0843e7df50a54e023a328dd17203e799b1e4f3a9a0309c95487ac49426db229bbdaefa4b98ef6b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785551202, "uuid": "82748dd9-e277-4403-a8d1-d3e1b0341da6", "value": "T195F2E71BE1A04D3DC8D4D131CA5BD22216B1A475EE32262F3A8862F73F8A75C497EF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785551202, "uuid": "e8ae7d0d-349e-4ae7-bd16-11a613469b1d", "value": "768:VU+101TLD7zrjbTLD7zrjOm+WuGe2Om+WuGe2Om+WuGe2Om+WuGe25BpxZhJR5Bu:VU+vKE38PCmIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785551202, "uuid": "f68d84f5-f071-4e17-b26e-46413f904361", "value": 36376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785551202, "uuid": "a52d5915-f5b3-476b-9df5-42a8b54c2339", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785551202, "uuid": "32fca3d6-31e8-4c1a-b978-dc41d27a49b3", "value": "xmr_miner_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5a3009-8d73-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785566315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566315, "uuid": "8e14e9ff-e744-4b18-903f-0556226dff4d", "comment": "Malware payload (Mirai)", "value": "571985ecdf04d0211fcbde7669461733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566315, "uuid": "932fa88b-1131-45c6-987e-598d9b9e54d2", "comment": "Malware payload (Mirai)", "value": "fb12ac6a790eb3d92a483863208a83665547f2354a7e1aac02785f3234e29ad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566315, "uuid": "ceec952c-07b0-405c-88fc-94d9568bae5e", "comment": "Malware payload (Mirai)", "value": "f4d5c0bcf827609a0fad9506fb415f5f9a48ae4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785566315, "uuid": "7ca91f97-7b6c-454e-97b0-323eb3f7668b", "comment": "Malware payload (Mirai)", "value": "af27c6a0e107d63e56f7886e86ae5bfc0cebbf0477705e8b49ba21ac756113d3d925cec7657ba38370eb8735b4669136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566315, "uuid": "e2f37411-cce2-46a3-8367-e5cce1952998", "value": "T190041897FC00DEBEF41BE77684570A057130B7E145926B377267782BD93E0A52823E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566315, "uuid": "338499b9-03de-4e52-a24c-912440e503c9", "value": "3072:uOC7LF7Kx+pPwSXVt4u9p9i5f9w4sbUVwjbiHLwhyqRWb7nygxdCAF/3:w8Slt4u9p90f1sbGLwhyqRO7nygHCQ/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785566315, "uuid": "afd04a5c-a33e-4e93-a2a6-fec9e40f16b0", "value": 175200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785566315, "uuid": "5632cdda-1ae7-4c60-b0b6-25d60264408d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785566315, "uuid": "d0426b9f-a5fb-4889-8de9-a516ad7ef1bc", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09d25de-8df1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785620434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620434, "uuid": "75311977-50c8-458c-a1d2-5be2199b4920", "comment": "Malware payload (Mirai)", "value": "4714bafaf09609614e75b13abe0795d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620434, "uuid": "30887e6d-d40b-4c9d-8936-b4098232bfd3", "comment": "Malware payload (Mirai)", "value": "fc9d3f7d658a24d1c62213ac12da40ba544885179bc8f8fa22ac237fedf23db4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620434, "uuid": "3b80f011-0a56-44b1-bb0b-cff3b8dfad41", "comment": "Malware payload (Mirai)", "value": "c4c7ef6cb67590fbcec9d17615b84b391f3d1a5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785620434, "uuid": "780c98b8-9540-4031-84fb-02108802ac34", "comment": "Malware payload (Mirai)", "value": "bc86737b5859bfeef9044fb59498fdd8fffecb85469c784789a6d2dd561c43840ed34ab278e7a8a8bbedf2b083d57c39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620434, "uuid": "ac16b8b4-da6b-49c7-87fc-2ab8fa5c8551", "value": "T1A183F782F8828A2AC2D4237AE66F658E3361B3E5D2DF7517CD204F123B8511F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620434, "uuid": "9749871d-7a6e-4ad9-b766-988d494dea0a", "value": "1536:70M2xk7lWu+aQ80nWpgAEEXR8SCpOCAWxCN3JG55QEhAY:70M2e7lV+a1z8IJGXAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785620434, "uuid": "9b1ebc8f-f1cc-4df3-807e-7e15dbe0e9fe", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785620434, "uuid": "694cbdcc-d3d4-4f69-b628-4a13d7b64e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785620434, "uuid": "52c2606b-9d4d-4d82-8699-94ea717e00f1", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d92b34-8dc2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785600099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785600099, "uuid": "926beee2-9f68-42d0-a958-38e93db8600b", "comment": "Malware payload (Phorpiex)", "value": "71a63b374d229f30f2912c501f7cce07", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785600099, "uuid": "c290f861-1fd0-4ce0-b3d7-68c3a8c74877", "comment": "Malware payload (Phorpiex)", "value": "fcf3ceac44b1c95dcc7442ddac5b286f64954c00cc09a265eeedd4638dbfac2e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785600099, "uuid": "4ae07881-9752-4a6f-b681-86ead932d846", "comment": "Malware payload (Phorpiex)", "value": "06047aeb37556139c4cd4ffa7a6cf7f801f3d161", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785600099, "uuid": "850bfa8c-b2ec-47e9-b825-a2984737804d", "comment": "Malware payload (Phorpiex)", "value": "9d330b762c83795c8f7ff8458a270a50efffa828f1cb904edbd3e9a3d2a4edc509fa06ed45da9e42ac561ec1a7ad6c29", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785600099, "uuid": "bb13e13d-6699-4baf-8132-b81c91620c50", "value": "T1E7824B0FB9424326D0E11070A276567BDA79A8B6378414DBF7E48AED0A686D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785600099, "uuid": "51e15a20-9ddd-4475-af9d-9f71d53e895e", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785600099, "uuid": "c0d2c45c-0fe2-4d98-b5f6-7c32d95d85d3", "value": "384:ec6I8vVaF6OeYUQQlmLu94gXOc4lmxav8U9csl:ecPvUQQt9s8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785600099, "uuid": "be90233f-cf08-4d96-9562-2fac285d8ebc", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785600099, "uuid": "b2143dbd-ca86-4f27-878b-7f693812fd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785600099, "uuid": "bd0320ba-fb4d-4658-9483-9168e6660ece", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5d4b0e-8df3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785621311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621311, "uuid": "d3e099b5-e948-436b-90f2-f04967aa09d2", "comment": "Malware payload", "value": "1be28f06e13eb01866e077f9b75d9e2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621311, "uuid": "0e394890-a875-4acf-9783-971304d57c7f", "comment": "Malware payload", "value": "ff9db6635dde76f4ab540eb3781ed43ab9221682a1d73d4add37c1fbd16ea280", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621311, "uuid": "24470935-48b7-47e1-832e-24733e50c9a2", "comment": "Malware payload", "value": "dd25854290f887798b4d4c90632dcc75928f8ed2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785621311, "uuid": "0f6fed9f-ea17-432b-b493-ff8933b5b195", "comment": "Malware payload", "value": "1ddef37dc61ee5919e4b97eed17e452d9834cd33c48adc1e2ea4e4f120533c5d62b6a19bdcd2fb7730d4a0fc5fe63a26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621311, "uuid": "a72b7762-07c4-4d87-97bb-4f69fdde1554", "value": "T1ECD02EB3A633203844B74921E8C22820BA08873E8858921BB80394302E64398F0C03E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621311, "uuid": "d2ddfba9-eb63-4c20-b3aa-c31b0d2c88cf", "value": "6:hTWc1oszjAViWpAulNXYq4HvXDG+NjVsNXYrkJ:V91oyAVioPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785621311, "uuid": "72386894-0cc7-4353-b9de-b5890e5d7aad", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785621311, "uuid": "c11174a0-5a52-49c5-9b77-e6842cb425ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785621311, "uuid": "ce4a6449-32b0-4807-8d13-d2777caef08c", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }