{ "Event": { "published": true, "date": "2026-02-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-07", "timestamp": 1770508982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "35ff3994-8b53-4212-b534-87ae961e3b4e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e74b371-0427-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1770470229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470229, "uuid": "a1d95fd1-00b0-4127-be54-4718da1fa6c5", "comment": "Malware payload (GuLoader)", "value": "1f941ccbf50d80370c99acff3593cb02", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tbjj-site", "colour": "#48D4B7", "exportable": true, "hide_tag": false }, { "name": "w2-xzqess-site", "colour": "#7EDEFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470229, "uuid": "2834cfca-977d-4485-8779-6065a4199b8a", "comment": "Malware payload (GuLoader)", "value": "012feffb86441278d04648ed0371d91e046004f01072a57b4a5a62024b22dad2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tbjj-site", "colour": "#48D4B7", "exportable": true, "hide_tag": false }, { "name": "w2-xzqess-site", "colour": "#7EDEFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470229, "uuid": "3d027104-b565-4525-9531-772062526458", "comment": "Malware payload (GuLoader)", "value": "6098c7053eff8e8004b108599c42ed757c926732", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tbjj-site", "colour": "#48D4B7", "exportable": true, "hide_tag": false }, { "name": "w2-xzqess-site", "colour": "#7EDEFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470229, "uuid": "d44eec15-2326-489e-83ec-27d64e95db4d", "comment": "Malware payload (GuLoader)", "value": "bffe9341e9bc99cbadfd695e6ea7cf19bc943ec7741d39ae331918b53875be2b9222a80be4ba50856714c4f9c5602026", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tbjj-site", "colour": "#48D4B7", "exportable": true, "hide_tag": false }, { "name": "w2-xzqess-site", "colour": "#7EDEFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470229, "uuid": "8ca51e85-5825-4132-b8bd-98ea28b3fa82", "value": "T15CF302026751C9F7C8194770453FDB38AFF69A6E91C519878341AF7ABD230838E2E2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470229, "uuid": "24c5d5fc-6bb6-4418-9627-4fe7a8d79b4f", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470229, "uuid": "bf6bdb61-a213-4725-8f52-2f30db67c7b6", "value": "3072:6wDijpS4DbYcRsuHpxVWMRyCHuq+K9kmAHOV/ZvBWu0t11X:6FGuJLWMRyrqjVuO1Wu0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470229, "uuid": "19b11c96-896f-42e1-992f-5105519a0902", "value": 158629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470229, "uuid": "6bb02577-4e9f-487c-bd6c-c2dc350cb9f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470229, "uuid": "be5d7e77-2902-460d-a142-ebab62a46c3c", "value": "w2.xzqess.site.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2d3c47-042a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770471542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471542, "uuid": "1d8db455-26fa-4bf7-9fc5-c0405f06e49b", "comment": "Malware payload (Mirai)", "value": "fa8073f90aa11453b00fa494af810657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471542, "uuid": "f9ee10b3-c673-4253-b7f6-8721075074cd", "comment": "Malware payload (Mirai)", "value": "0142aa3508b5d87fce6f3a06fe85217834d0689c3057e5a2b8290f63b462720c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471542, "uuid": "c184790a-005b-4e94-8f03-784ab581111b", "comment": "Malware payload (Mirai)", "value": "855441e4f0897b3f5aa7510f394561f5e334cba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471542, "uuid": "795f385d-4f6d-4e89-9657-ecb4ac240c9c", "comment": "Malware payload (Mirai)", "value": "d9a7b2151756da39d62a680beb4ff204886e44b5e570da0473c2184637900834218a1cf42225c0c9b2cfcce3ef892118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471542, "uuid": "d174e65b-46bc-4149-a612-d6c4478223ff", "value": "T11463189ABCC5C602C5F061B2BB0F51CE375643B8E3E2B157DD09AB29670F8A70A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471542, "uuid": "41a6f342-d4e9-4e2e-acef-e610729ac4d6", "value": "768:N31uWExgxtxJhH8J8uohxmM0YGliA1bKiJ29BH+C/kDkfomhmwo6CZ+s1h+f/f+s:qiN4wrPzmdsVIvuu4CpY76ErSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770471542, "uuid": "33f7c0dc-80e0-454e-8777-8e143298455d", "value": 71244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770471542, "uuid": "6959e50b-7c9e-464d-880f-c26475f13d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471542, "uuid": "b7d9ad14-b690-418a-8543-38ee9782e1df", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccfe3b9-03bd-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770424807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770424807, "uuid": "3e95afe5-4a72-45f8-94c4-56ebd2720354", "comment": "Malware payload (RemcosRAT)", "value": "88eb9eeba1377d77094b92180d95b7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770424807, "uuid": "52f5aad2-7c36-4297-bae3-df496144e5b7", "comment": "Malware payload (RemcosRAT)", "value": "017143897f2a57d2231dc9e54e3b76d4c041db591e61c4b26b135e6947613093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770424807, "uuid": "70a2ccb5-0cae-4285-b0ab-dca79f3c887d", "comment": "Malware payload (RemcosRAT)", "value": "0dd98ae484f3b2bf2b31adb7bede2425a31c6676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770424807, "uuid": "f2e5bf20-c836-485c-9b3f-bf1b192b1a13", "comment": "Malware payload (RemcosRAT)", "value": "217f527c2f8debc494fbeb91c1f1a99bd0950c22711a06af0872bc9afd014d6dce52143120c265b789e43324cd806bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770424807, "uuid": "3749c0b8-12bd-484d-93b4-1ea9ddbcafdb", "value": "T15AB4AE01B6D2C1B2D57654300D26E775DEBCBD2028369A7BA3DA0D57FD70180AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770424807, "uuid": "f3999cf7-3885-4edf-b414-7e2fb3ae330d", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770424807, "uuid": "c470f6d9-fba5-40cf-9ae2-6a101bcceadd", "value": "12288:86pxxGI8gvGOHJpAbDYGxLhZ+sPZt7mPFN:86pxxx8U+bDYGxLhZtZAPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770424807, "uuid": "3c6e18ac-666e-4955-a1bb-43c3050aabca", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770424807, "uuid": "14c96fc4-173d-4275-b1a7-94b2a183b1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770424807, "uuid": "aa03a9b3-98c0-42e8-9e03-ee4853c527f6", "value": "88EB9EEBA1377D77094B92180D95B7D8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369692ff-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474484, "uuid": "e6b3d629-9c49-4041-a99e-8a973eb28b26", "comment": "Malware payload (Mirai)", "value": "59b586201a81938206337ff8a6982e7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474484, "uuid": "0cf958f8-43a8-4bae-bccb-239585043976", "comment": "Malware payload (Mirai)", "value": "021e5a8d5d321f04da266f9d6275b1048d821b31a638845e3a6a1df16f3479f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474484, "uuid": "872ccbc5-3dac-45f2-9294-dc7d97f0179a", "comment": "Malware payload (Mirai)", "value": "463c440af39a27464c98dfd9591ae57b63fdd89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474484, "uuid": "6c7a6bef-ce5e-45f8-ace1-16abbf1bb948", "comment": "Malware payload (Mirai)", "value": "74968b8c5a9920a11a33e72ce8b2dd8ce22768e3115d5c1f4e4d5b3a578adedc8f1f9904223f5b203ce00de1d609295d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474484, "uuid": "c9c0a73d-33c1-401e-995e-15b52f982c7c", "value": "T100331A0272280A4BF5E65EF0293F0FE097BFF99024F0B584695EEB458536F761486F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474484, "uuid": "e3741ea8-42fd-4c50-ab85-175226fb5741", "value": "768:JTHz+ANmmo1oRze7TPRItebzyhBsIn3Z6BU8VbOkhA5LLv:R4mo1oRzkjHfyHH3Z6wKAxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474484, "uuid": "1bf26452-a5e7-4c7e-b2cd-d0a20780d8c2", "value": 50964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474484, "uuid": "336b1412-9fa5-43df-b040-c02f78d54e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474484, "uuid": "1759416b-428c-40e3-af75-8a8bd441154d", "value": "Owari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca75aabe-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770467001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467001, "uuid": "88a57d02-2d04-469f-a4f9-2a51ec883d3b", "comment": "Malware payload", "value": "31b9d03362eaf752ebfdaa9567cd20a0", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467001, "uuid": "420ea4b3-abb9-4bd9-a268-9cb32d89bc27", "comment": "Malware payload", "value": "03aaf3495ebc6a8adfc645f0ee2ca1c8790a78aed9aae56c312d21175c32aa39", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467001, "uuid": "769cf29d-bf91-4006-8a77-b58d79478c7b", "comment": "Malware payload", "value": "d874dd488bd45faadbd5d671089e1ffa60012c0b", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467001, "uuid": "830aae69-fbfd-487e-83a4-4be68a91d915", "comment": "Malware payload", "value": "439cddec354b19af00537d330e9d651cc2bd88ebb567f9c6a6566af27e12780b6cf151c983a31a8d1d43c6ffb8c124f2", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467001, "uuid": "a3d9334a-6929-420c-a00f-df1b82f5ac85", "value": "T1C64733C875280A17FC5B943BD4226B07E697426840322C19E95F379749FF7E272BB227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467001, "uuid": "71950ad4-8a1f-4fc9-ba4f-871361f699c6", "value": "393216:c3FAtZgkNC9e4Dx2g3JT/j607+SRbAD/RVkj9m9Cd+MrZVNwDTYwbidHyOtSbaMA:MCnNC99t/3pd95Ark9ICd+bYwbWyhbXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467001, "uuid": "ecd7da09-7c6e-4522-81db-13f2a56de444", "value": 25054509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467001, "uuid": "499a7a12-c59d-44f1-a41e-a0384df42e8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467001, "uuid": "d58a9557-bfc2-4baa-bda1-65f3bb0de9ba", "value": "\ud835\ude82\ud835\ude8e\ud835\ude9d\ud835\ude9e\ud835\ude99__\ud835\ude77\ud835\ude8e\ud835\ude9b\ud835\ude8e#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef2197e-0429-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770471035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471035, "uuid": "717e1a6f-0cb2-48bf-ae3a-03166bbfcf6b", "comment": "Malware payload", "value": "6fa85b4c54cc5ef50e73719e1f7039a1", "object_relation": "md5", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471035, "uuid": "90367baa-2b6c-4cf6-9fb2-154894a1aae2", "comment": "Malware payload", "value": "0440f93ceeb0ab2e9c9955422b178f4e92917ca15b60c8eeef69cc273faae277", "object_relation": "sha256", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471035, "uuid": "2713e66b-b098-4e8b-80a0-45acdd9d861f", "comment": "Malware payload", "value": "bac950f106d39b26931d46c8729b4baa3bbca66a", "object_relation": "sha1", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471035, "uuid": "44238be4-81c7-4a5e-ad57-ad7afa381e6a", "comment": "Malware payload", "value": "d9df304729322ad402ed7ac8994541abe44e3a5a964b031a5e438ccc1ead5fde8282b6ed73ff38af0d5f979b7ac5e9e6", "object_relation": "sha3-384", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471035, "uuid": "1de7f38f-2e3d-4ca9-bd2b-1d247575145c", "value": "T1EBC633543B950DB8F8D9E13EE69089366366FD3206E0C58B5BAC4D210CB71D8EDF1B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471035, "uuid": "df26af5d-a00f-4bfc-a5f5-a034180fea28", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471035, "uuid": "78c53db3-d4ba-40a8-9b11-0b5e14065584", "value": "196608:zRQYo0W8UAcyq/juurHm/eD9BKG+5fc2S/ErXKEtw+J4Jkz9Rwpr2Zwl6bnF2oFZ:FNW88yUjuuC/eDvV+53SM8+JLwqNnRky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770471035, "uuid": "5525b003-c25b-4373-a270-9417bfa7ddfb", "value": 11804644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770471035, "uuid": "afcfa622-5d6e-4240-9a92-c843b7109287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471035, "uuid": "1afa035d-f32b-42d8-970b-e9b9e4e9b6e0", "value": "xre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c160d3-0423-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770468416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468416, "uuid": "d967fe0d-2853-42d1-8ec6-cf702f53968e", "comment": "Malware payload", "value": "0bd695d2afd86ba2c11e013fc7b936c3", "object_relation": "md5", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468416, "uuid": "3bbe9ea3-e21b-48ab-ac89-bbb43731463e", "comment": "Malware payload", "value": "044c8d959daeb1b482872a130d94f5e478ec57d5c07a5828c831d32da1c9d444", "object_relation": "sha256", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468416, "uuid": "1ea66f23-f3c4-49a4-8ccd-64b3e91e9f40", "comment": "Malware payload", "value": "6f1bcbd567f6cedac259cba1486542929d0a7b7f", "object_relation": "sha1", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468416, "uuid": "2940790d-cda1-462f-9168-4d29ab40b99c", "comment": "Malware payload", "value": "0971822da0afba41ee5beaa55383ae8eea10afe86490c888d81b4dac4550c1a2876b5f692987bc390e7112ff8dbb2774", "object_relation": "sha3-384", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468416, "uuid": "6c191b92-17bc-4a02-92b9-4be49ed0373c", "value": "T119C35B5773A541BBE577C278C9530F41DB72B8151B60ABAF07A446862F237E08E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468416, "uuid": "5c668044-1485-4ab2-8b73-075284847241", "value": "120744e3ffbe1dcdcbc8d902f1e6f634", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468416, "uuid": "61757525-e1a9-4f26-bcba-6906079ad1a5", "value": "1536:McnVIp2UdattQ/S4HZk5lrHJISXSt1F61qVuJdiRPzYBsWfdw9dlujLTRcNRg:McVO6D45aHJImuUqVOdiPERAMLTRcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468416, "uuid": "2010ace2-e859-412c-85a8-badae13ba612", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468416, "uuid": "9642992c-b7d9-4470-8170-f98474dda1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468416, "uuid": "23f67ee2-d017-4b94-8bda-2350b733d58d", "value": "Activation64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1b9bec-0407-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770456400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456400, "uuid": "2000edab-1301-49af-824b-ace7ed538436", "comment": "Malware payload", "value": "7626b47068b307e5d3d500698c739379", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456400, "uuid": "2730cfad-88fe-4aeb-b79a-b0f1028b2292", "comment": "Malware payload", "value": "05a5cff25360301295e57d85fc6619493c4965a2884ab06ac4215107a9d37d86", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456400, "uuid": "426f4690-0ae9-43d0-b99f-6c9c0191b111", "comment": "Malware payload", "value": "b4c1fb325c8178b1097980a070dab057a0a8ebdf", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456400, "uuid": "3e5c8b58-43bc-4269-8fd9-987b72e1bbe9", "comment": "Malware payload", "value": "b826157876a7ad96d9b45ca24f7bf1458d515f81b642110fb04db0bda9b5746c4a9702d3e943eebee91962d43f401e9a", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456400, "uuid": "7ea88a22-e318-4797-a0b0-a9acacce625b", "value": "T1B9252321F622FF16C15345788EE2C8B65EAA7D40B760E60B7355B76E103ABF4C39704A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456400, "uuid": "a35743b7-936e-45a0-8fd7-eccf84d508f9", "value": "24576:uUmWDBP+hT+z443BWepU3KiUJmxcryIfLEzsxHH6y/:uUm0gepG6Jfr1usxn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456400, "uuid": "1c8a22fe-6576-4a0f-9ca2-ceb0dd413a31", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456400, "uuid": "6bf3dcd4-4902-4cbb-9503-dafc9a6be30c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456400, "uuid": "d60a4a41-c80a-400f-a068-70b8c530e397", "value": "SecuriteInfo.com.Other.Malware-gen.25646485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c01dbe4-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437288, "uuid": "0896819e-35f6-4b44-8aa6-52eac814ec9e", "comment": "Malware payload (Mirai)", "value": "87c5d839fd54fd1bc50e056a4e7646de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437288, "uuid": "f2ca6b7d-2a70-46ba-b10e-d1710fe79daa", "comment": "Malware payload (Mirai)", "value": "05ecd003baeeb30f4c82f309cdb18de1bcc4fa50c6a6db60b995a412db1d6571", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437288, "uuid": "f3d55db9-c8bf-4df2-9f0d-eff74a78ea88", "comment": "Malware payload (Mirai)", "value": "41d0bb492638a602faf6f8248c45d67b7d5485a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437288, "uuid": "126af0dc-3218-412e-95be-984964ed9361", "comment": "Malware payload (Mirai)", "value": "6c12899eda3a5b7f00bcf36f8c614891dbc67dccff30e367d182a6f7c8ade0e67d3e3e1173b9fc17acf6fdd38967968e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437288, "uuid": "17561684-0005-477e-9957-d14d496a7442", "value": "T16EC35C1775D180FDC8DAC1B49FEEE226EA33B4295138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437288, "uuid": "09c79323-93a4-41bc-9c85-13f9f1fe75b7", "value": "1536:UyAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3n:UtFmSmviqS1Bs0+Nd6lAqktNMxSNbmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437288, "uuid": "a13f4e09-d9fa-4ca3-9f74-6d6bb2ec39ec", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437288, "uuid": "7ff4ded9-e826-4172-a8b9-433ab05ab7fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437288, "uuid": "e0bc591d-fe31-4d82-a69d-27ff1b4efa55", "value": "israel.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e5bbe2-0429-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770471268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471268, "uuid": "59727459-ceb8-4b0d-9da0-ecf985239226", "comment": "Malware payload (CoinMiner)", "value": "23f9dda13ff0ab33497d5773d4aa8efc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471268, "uuid": "7385fe55-8995-4fb9-9777-93a565aa89b2", "comment": "Malware payload (CoinMiner)", "value": "0781ee8408bd89207b10c80ef919ca7f88824715672749b8512d75944a86651b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471268, "uuid": "cca80d86-e727-4b70-90c2-05f5c20673cf", "comment": "Malware payload (CoinMiner)", "value": "d62546b4448a26fc3f49b9089a5aa4c3aac200ff", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471268, "uuid": "59c1a521-433a-423b-9913-81a4c7c2e98a", "comment": "Malware payload (CoinMiner)", "value": "f54217b5da802f96060ea8e049a8644b840a551b57be8d2a12077a162aa025b8fe401d127d7a8f967577dcd8e279bafd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471268, "uuid": "effb8845-b000-4d1c-940a-165db04f6fb4", "value": "T13717F11B68821A6DCDFF2A7DA157063477319D209B088B5792046932CDF31CFB776AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471268, "uuid": "415f247e-37ea-47fa-95fe-d77714bb3b36", "value": "393216:Ax2rdTuEVxy0YPFoyIuyC5cYjwv7MAT/0KRrg6CtJRuLuzz:G2xiQYPyZRCWlvj/HM6Ctbss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770471268, "uuid": "3f773b11-7b70-4ffd-9131-ceabcadbc2bb", "value": 19478672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770471268, "uuid": "1342ed28-e228-4858-8b79-49a814493d82", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471268, "uuid": "db38c8c5-1d11-45c8-b9ec-4868b55219ce", "value": "xsr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a32004e-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474490, "uuid": "9980faae-3e92-4674-b25f-abb14a77cf52", "comment": "Malware payload (Mirai)", "value": "c3a0ae9af1a3e6e13f9edbadfd926c25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474490, "uuid": "e04a4bba-fd85-4522-aad0-f62a3fdab890", "comment": "Malware payload (Mirai)", "value": "083c9ebe27e1175659961a804f3e4d540e3d5eaebf733425bca65d5384f1c95c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474490, "uuid": "8bd05316-c66d-481d-b3f3-afa007ee5905", "comment": "Malware payload (Mirai)", "value": "269086cd8a7fd5278308d68adab941fa91319dac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474490, "uuid": "0b9e2557-7b3b-480c-bbf5-4752ad475701", "comment": "Malware payload (Mirai)", "value": "5c4ab93e4aee8b2b6f5bd58e66b55be2c34fa6628dee3dbbd6f4ea79b14cf4e77a3282cb6543e569503c7b281bea14df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474490, "uuid": "c0c34e9e-a852-4b36-82f8-bfe51c4762b8", "value": "T1FF3309DAB402AD7CF98EEABE80670E09B230331451531727676BFDD37D32154E952E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474490, "uuid": "63c4ad5f-9f40-425e-ae03-60558098df33", "value": "768:p8eTIuI9Me1KyWFr/Qhyuw3gFHnuGU7wWWJUH8w9KqQeO8tTW:eeId9MUKBEoAFnuGUwfUH8wkqQV8RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474490, "uuid": "24ed51f0-de25-45bc-9d3e-850119f5fcfa", "value": 52360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474490, "uuid": "20f9cb70-5925-4d85-a386-fcbfd5246731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474490, "uuid": "419ae146-af5b-4515-a163-f912c5257ac0", "value": "Owari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb31660-0447-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770484268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484268, "uuid": "8647a3ce-36bf-46ae-9c07-e3a1bbb56b3c", "comment": "Malware payload (SantaStealer)", "value": "24b4096627c8c94c23857dcad98674d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484268, "uuid": "c380bc81-208e-4dec-ac66-d92391518d5f", "comment": "Malware payload (SantaStealer)", "value": "0992a2d2f68b550a9d2c261aceece823810a184f6c599190f6382c1099dca99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484268, "uuid": "924e1f53-4292-4860-b606-784a9c164dcc", "comment": "Malware payload (SantaStealer)", "value": "f5299e11c85b1a5d14e7c1285485025fbe688529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484268, "uuid": "3ce05d5c-5542-42a7-bbf5-00b3e7012a69", "comment": "Malware payload (SantaStealer)", "value": "8e716b0aefd60d210bd738ae271aed6d5fc892065975879d86134f4a8d3806db689a5389338d5bce229ea9bf1acca364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484268, "uuid": "66c42b45-4b33-4e13-920b-41d0746e14aa", "value": "T114D5AE0AE15349D5CC6BC0BCC39A6131EA357DB9CB242EDF17914B613F52B806B39B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484268, "uuid": "6047ccbc-05fc-4368-ac65-3a9e5ded02f0", "value": "8ce038dd8e3bb128b6fce43c5c582390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484268, "uuid": "d909f588-3988-43a3-a534-a707a7b53674", "value": "49152:TF5lFVzu22e+uLqvFEeyDY1oyPh7UEQ3OD6:1zKumv6e84jPNUEQ3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484268, "uuid": "77734e57-e7cf-4ea5-bb64-394881be7e1f", "value": 2839552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484268, "uuid": "b21074cd-80ca-46f8-a409-4d20894de2f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484268, "uuid": "cd7e705a-9626-4a4a-a7d1-fc0706ba3ce4", "value": "Y3593UGC11D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29de9d5e-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489065, "uuid": "7abe173a-f5cd-4bba-982c-a46b24ca31e6", "comment": "Malware payload (Mirai)", "value": "db7ac7876dd27a69af249a3c3696388f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489065, "uuid": "9a3f7d90-7695-4a49-b412-4f730a7089dc", "comment": "Malware payload (Mirai)", "value": "0a072e8117d67c1f883e9324712b69d4d1bdd280418a4e7ece8de8c292fe28d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489065, "uuid": "f6b01020-2c54-4b01-b331-7a8856c06628", "comment": "Malware payload (Mirai)", "value": "7b0d6cda9fb76534a7ff28c02aa21da6c0511dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489065, "uuid": "166313a4-b601-4a4e-b468-b17e64c5e2e1", "comment": "Malware payload (Mirai)", "value": "251348e0361f23a952f1248bce9198f234cdc43522e25f6a9277600cd909bb02da3dbd5a93d72d88445f28df18b26ada", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489065, "uuid": "1b98aa24-1b6b-4d02-b4f8-59e554b194c2", "value": "T1DF630284FB782F89EDF9AB284312A7856F9917417992FC8781D4641EF203448D385FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489065, "uuid": "df680a1c-57b6-40c6-b5a0-e4456e49440f", "value": "1536:AU5IEEv87/YRZSSB0geyCcjzTH9LVa5uARu/F8M1WCeinCkc4u+qgw09i:pIS/WZSu0ObvZWuAQVeinCkc4u+qgwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489065, "uuid": "2812b3d3-092c-4119-bbcc-02084a8987bc", "value": 68764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489065, "uuid": "11d9f74b-a611-4c4f-97ea-5d8f94eaf6bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489065, "uuid": "b4972398-dc27-491a-b648-1911f973d721", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292a15c8-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489064, "uuid": "a31ad703-ba42-48ba-8042-abebb9c548fd", "comment": "Malware payload (Mirai)", "value": "b9ffcbd955360aa6d2ac2c37bdb653c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489064, "uuid": "7c7ccdca-8136-41d5-8d7c-136617e5b899", "comment": "Malware payload (Mirai)", "value": "0af8c9cc16722aa269a9e9102943fa7d335ffa6a4da6c4b7ddf2321c97b64416", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489064, "uuid": "ed09c9e0-d293-4679-bb15-55db08d70269", "comment": "Malware payload (Mirai)", "value": "d6ffc64608d9367d928eb261972dfe28f22e6f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489064, "uuid": "1b96c720-84d9-4950-94e2-9bea04c2e8a5", "comment": "Malware payload (Mirai)", "value": "c9a5c1e273b86b88c91e5147fc3a37c53f96a2bf3d54a5d59ff5b8f1866079250938de75645467e9bcc333dd33ea43eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489064, "uuid": "4984ae72-6673-4cba-baa7-3211a14dbea8", "value": "T1FE9312B5F46B4F6142140D74ADCD48BE3FB626A845F7647A0BF0DDF8286C08541B68DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489064, "uuid": "4d84b2df-36ab-41a4-8174-708b74bfc742", "value": "1536:Fm7uHJXrtXe2GAD9D5/P+9ezFLl7JOdLTzbdSbqSPP1KVjLAL61TGEUUxIiWN3uh:Y7upX53GADv/sepdwFpGlKVj8Ls1xIfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489064, "uuid": "c41e6613-a5f8-4ab3-b37e-9b7d51a3791a", "value": 89404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489064, "uuid": "7edb50ab-65d2-47c3-9fa7-7528d87695f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489064, "uuid": "f791d572-298b-4543-99c4-ed253955ab65", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb00af-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438831, "uuid": "43925188-81e8-4fd9-a69b-f08ad680b7b4", "comment": "Malware payload (Mirai)", "value": "cfb7acc3dfe0f07fd01dbe1acc5642fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438831, "uuid": "74adbbd3-d23a-4542-afa5-dfc974eaaecc", "comment": "Malware payload (Mirai)", "value": "0b4fc33e78ad0cdd6762bc47c954ba5286738e59cd883ae2040ea77922635f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438831, "uuid": "f9102ac4-4464-4552-8bcd-078e488b80d6", "comment": "Malware payload (Mirai)", "value": "430671187cccfa00f4fb132c0e4dbd9dc84780a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438831, "uuid": "2ba2cd23-0637-446a-b91b-93ea8b1fca1c", "comment": "Malware payload (Mirai)", "value": "e222865d179cab700dba511274f1f69e468aa2d9e720a1672dc92549dfdf9d9695ecdf8a613a23451030dc8b6e0b6ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438831, "uuid": "b7f14d3d-f56b-4b11-ad1f-bdfdec541685", "value": "T134B339C1E643D4F5ED4602712077FB379A32E5B5113EDE83D7A89B727892A51880B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438831, "uuid": "c2ef6caa-e2fb-435f-9256-1bf1bad949ab", "value": "3072:xdAMXLUbFZoVHT3Cl5Sex6TshoSa2EiG47:xdzXLuXoVHDCl5SeiGG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438831, "uuid": "494e3d61-7c50-4424-8cfa-78f536bc426b", "value": 116080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438831, "uuid": "d13cd441-dd2f-4151-945c-903ed29ae567", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438831, "uuid": "689d86a9-43a5-45a2-a4ad-2ed1d8eb26fa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b54de1d-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491322, "uuid": "16663fa5-1db2-4722-a7a2-f6de2f5bd9e5", "comment": "Malware payload (Mirai)", "value": "e8cc82e261f8e1d9278e354aa68fb025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491322, "uuid": "08d6dfdf-549e-4927-8571-f4ece207e96e", "comment": "Malware payload (Mirai)", "value": "0c14a94679e7980eede58cb4b981c8d0ca3049c4cc17300d18548208dd7f809d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491322, "uuid": "eba739ae-d301-41e1-b32b-180f8997942b", "comment": "Malware payload (Mirai)", "value": "d4669d0de2e25257932b496c018dc44c4e604d83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491322, "uuid": "450d89ef-629c-4514-869c-3fab216adf51", "comment": "Malware payload (Mirai)", "value": "c1238cd01d3837440b2400f39576374f02c47f8c6b59d3038a82ceed8456d33a29e08d3165168dc4f531ad85dc53b4fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491322, "uuid": "8403832d-21de-4eed-bf0a-81984768ecac", "value": "T1D043F1F506CDA3A8DEA518B7C22D8604D3C793A663E3708717660CA4B6C709D7BF244A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491322, "uuid": "e6cea0ad-3bb0-4059-ae50-8efc1e60c27a", "value": "768:QooLW/G9n7s6HJSksk90NdPaEnsowcSuKrrLD+W3KYuNFFKBq/NX5mPTC1dXtaA7:gLWenIhjkOPaqSBHaWsSk8P2HXWVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491322, "uuid": "521e9e2b-69e8-4f98-83c3-ad7f27223f0f", "value": 58616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491322, "uuid": "0e8f6198-4ab5-4cb0-b20f-30d6ae46e979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491322, "uuid": "4cc7df16-f4ad-4a06-a598-40edce8f4e85", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e235ae2d-0447-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770484220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484220, "uuid": "d993e798-dfc4-4b2e-80d9-32a9a40e5636", "comment": "Malware payload", "value": "a17dcf576c6fb8662aa0e4e97fc2ff48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484220, "uuid": "4bd95f29-25d0-4987-97ce-231dbf8c4038", "comment": "Malware payload", "value": "0cf0039d23072103ce42cf3bdd8186b79a60c306c381f2990bdc91096ef45c48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484220, "uuid": "bfdbd624-f267-43db-8bc6-c93b43632dbf", "comment": "Malware payload", "value": "c738fa4a974e9df048d726fe6ef22b71f1fe80b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484220, "uuid": "007b35f5-953b-4817-88f5-12587542c2c3", "comment": "Malware payload", "value": "6e6ac49e2fd274d75b2ed31421b1d665054984f745880c6cf1950986f408aac91fd59a8158f1f7219a3f5b5c1595c7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484220, "uuid": "783114ae-5b01-4efe-870b-f8266256b5cd", "value": "T119A6BFCAD16E44D2DC053FF5A8142AC75B2447328A7400283A6FBD899F775FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484220, "uuid": "304f031e-fdda-4711-a7eb-7c0c2cd34183", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484220, "uuid": "bc5a7dff-17ad-4650-8f5e-dffe9541145c", "value": "24576:to8xw386cXfJX+skIhw8XrS7aYGrIxzEfhYDpk6o3b9mov7JJLF4YGtdYJpzkEce:to8xwhEfrkIrWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484220, "uuid": "0f6bb41c-8305-4a0b-b8a5-160b01258751", "value": 10224302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484220, "uuid": "b7b20952-a204-4f9e-99bd-02ce48d93331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484220, "uuid": "cbd79441-5839-4272-92ef-c4b23e0ebe82", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9074212d-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473346, "uuid": "689bc726-fd3a-4d1f-8de6-f487c57caafa", "comment": "Malware payload (Mirai)", "value": "76916e726c641b45c7010cef44390cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473346, "uuid": "361de99a-975c-476d-9ec0-780f0b95590a", "comment": "Malware payload (Mirai)", "value": "0d61a1a55693a124fda76d78b158508cf2a72e862ab6285a615be0f5f29be1ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473346, "uuid": "23327b00-e498-4698-b76a-c1fa845e1f62", "comment": "Malware payload (Mirai)", "value": "1917ac3aad2e24fd4b0fa615e9737a05e0f4ddb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473346, "uuid": "5d71cbaf-c683-4cb8-b3f9-239cf403dcbf", "comment": "Malware payload (Mirai)", "value": "d229f716e005ab884afbac2f1e6ee6cbd6eb2d943b4bfc3be737a383fcf023b544d2a3adbf05d6d63a464afea4301df5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473346, "uuid": "53001b99-3bf4-423f-87ff-264cc0853aeb", "value": "T16A133A59D643C6B0D85740B4367BAB35EB75F9326020CD26EBC47E76ECB1A02D10A72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473346, "uuid": "8a3de4cb-052c-4e90-a98b-dea92b348990", "value": "768:9m8dFB+ieUkUqy2Ox/3RtmKcyLIM3eFSNGglNLMotl7TH9vX:9DPBnbwG3eFSNfKa3dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473346, "uuid": "02fa2c4e-1f9b-45b4-921c-e45d4b8112d4", "value": 41552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473346, "uuid": "be8cbc93-d24a-4ea9-9533-117c726a1a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473346, "uuid": "c7d36c0b-a3bc-481f-869b-32aa3d8dc1ec", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8667bf3-0459-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770491935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491935, "uuid": "3ea56925-77c2-4833-b4d7-187bc048b5a8", "comment": "Malware payload (AsyncRAT)", "value": "66bb5b160dfffb40b22545b70ea7f250", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491935, "uuid": "530df8a6-e4aa-49ca-8a1f-9ab199e23b07", "comment": "Malware payload (AsyncRAT)", "value": "0ddd1f0d9a8a47a0e8a442dce6950ad1ae76633e4788110d0fc06ca1b754f6d3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491935, "uuid": "394278fd-1530-47d3-8783-e9afec5f82c2", "comment": "Malware payload (AsyncRAT)", "value": "1ee637f76a169844308f0a3ecd943b57f5ebd0da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491935, "uuid": "b3e2d5fe-857e-4560-b250-d387974550fd", "comment": "Malware payload (AsyncRAT)", "value": "adea2c79e6ff758ce20d3037aca39996312bea77046ca05163b871eb9848aba41f474f68aa783944ebae9572111b7276", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491935, "uuid": "5fc06d7d-ed16-4373-8c2a-8669a9a86776", "value": "T1E6E326CB2E9582B7D36DFA3054B3733C432BA83E2BC39E0E988B3D561732A8D5541595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491935, "uuid": "9a5402c9-e7a6-4174-8738-7597f4ec0a89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491935, "uuid": "e65104da-447a-492a-98c0-54ce50a9921f", "value": "768:Fu4X9TskvpDWUPlNxmo2qbyJu1rX2/7/p3APIzc0bblvcC2v7NuLaM4A7BDZj62L:Fu4X9Tswb2Ju1Ozp1zPbbB1kEtd2Efx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491935, "uuid": "a6b35da1-4d44-460f-b25f-cbb318cbd9c9", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491935, "uuid": "961c7de8-6de9-4e09-8d1b-7a75b910ed33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491935, "uuid": "134096e2-f769-4919-9525-43d9f4671c2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0d92c3-0407-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770456399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456399, "uuid": "3f119cf2-a71b-44bc-8556-ab94652737ef", "comment": "Malware payload", "value": "6499b6730a6f66092671bd6d3b858065", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456399, "uuid": "7827aa14-396c-4e95-bc8b-c2e917ad3c77", "comment": "Malware payload", "value": "0e4e0bb042ae35320412f272f12ddf3a5975e495f3135f5375d157b9d382bb20", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456399, "uuid": "69080af0-bb44-4512-b862-c3f3d48acdf9", "comment": "Malware payload", "value": "7a094efbbc46522e28d808d0129b38f05237c576", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456399, "uuid": "3069caeb-8b5f-442d-b979-33117ae9ef7c", "comment": "Malware payload", "value": "ff1589193be1a84511e5881d1efd84ff0c0ac2dd71241b702f93ff8b5612842b55bb3ec34212767fbb22f0ee3f4f0512", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456399, "uuid": "61658c45-3c97-4049-95cb-17d9da93566b", "value": "T1F1552301B1949636D4EEA97446DAC674421EBD38FD80A00B371577AF32732F68B673AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456399, "uuid": "0f8c73d7-6896-4c58-aac0-6df76ec9b537", "value": "24576:Vyftwz2JxW+AqNvcOuJolvTEdIqZMwBlFhqP7QDYlD+LGKZEezZJF:Iftwz2JxdAq5huDXVTouYkSNez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456399, "uuid": "259c8231-6065-4693-b502-75e8cfe16a9d", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456399, "uuid": "deecb1dd-804f-4fe2-9c40-b4f04676d805", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456399, "uuid": "dca7e096-1613-455c-a8bc-79a7ca77d253", "value": "SecuriteInfo.com.Other.Malware-gen.86912689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a921606-0476-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770504179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504179, "uuid": "3792f515-a3c7-4c0c-a9c4-89f1a96576ff", "comment": "Malware payload", "value": "357b0ec0fbd81e25f68cbb81444f01f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FamousSparrow", "colour": "#30CB63", "exportable": true, "hide_tag": false }, { "name": "SparrowDoor", "colour": "#D0FF6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504179, "uuid": "be2b358a-857a-4256-bad0-42a07be0f8e9", "comment": "Malware payload", "value": "0e74d57f572e384ad179ad8aa094cbdc92a6abbcc77eeb658fc05743ffd94e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FamousSparrow", "colour": "#30CB63", "exportable": true, "hide_tag": false }, { "name": "SparrowDoor", "colour": "#D0FF6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504179, "uuid": "c18bae19-9c46-425a-a0da-ab5ce8ad3650", "comment": "Malware payload", "value": "cc350ba25947b7f9ec5d11ea8269407c0fd74095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FamousSparrow", "colour": "#30CB63", "exportable": true, "hide_tag": false }, { "name": "SparrowDoor", "colour": "#D0FF6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504179, "uuid": "81877948-b700-4902-9e25-bea8938e17b6", "comment": "Malware payload", "value": "4c9db90d0e862ea33b8d9f6777ae80ac06e61e9e0efd403ec163e90b7877c9fff95c77e8556cce63aa6bdf0d0b3468ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FamousSparrow", "colour": "#30CB63", "exportable": true, "hide_tag": false }, { "name": "SparrowDoor", "colour": "#D0FF6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504179, "uuid": "9827ad9c-0b20-4683-b972-a95a2ad9e554", "value": "T11BB36BDB219012B7D0169B39ECE35B93E7B33C225A318B8D47D9066A0FB7751AE18731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504179, "uuid": "ca302a31-6cb8-4b10-b1ee-ab3e05f1173c", "value": "694294912d57279851e4dff21593aeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504179, "uuid": "caa05300-9c17-4125-8cf4-6e400951177c", "value": "3072:EO1TGTFK3zZXa4CBGxrEDNidd6pgscMc4e:j1TSFK3zpABGxrEid6pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770504179, "uuid": "cb9cec6d-fbd0-4106-8ed7-1a7e99cc166c", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770504179, "uuid": "663a1aba-5c23-428b-a12d-d97b87cbd91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504179, "uuid": "b6fa67c7-f0bf-47b6-b1c2-c405d36a3a65", "value": "FmApp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2e625a-0400-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770453396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453396, "uuid": "6297815e-5b1b-4339-b599-5487180969f1", "comment": "Malware payload (AsyncRAT)", "value": "ead8e9379da6b89e9cc3950555c2dcd2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453396, "uuid": "384d61d6-21e2-45f3-b022-9b9757c48483", "comment": "Malware payload (AsyncRAT)", "value": "0f591c2b4f32a7782c5744e2faf8dad84f54c1a363f42f81e2df40beb2d39416", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453396, "uuid": "15a9a119-8dec-4791-b442-2fa42a5f501b", "comment": "Malware payload (AsyncRAT)", "value": "a86cb6bd40fba2323284eef05651a3f0bdf6f6b6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453396, "uuid": "caa2f0d1-b7cf-4e79-8372-4b0ee85f756d", "comment": "Malware payload (AsyncRAT)", "value": "3af706fc60b7fb33195c31c8c7ab70cde54c4a0f60ec124dbd8ede64b7f033107f179f0e37752733caccc44cb744bc0c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453396, "uuid": "603f51ea-9b32-4258-a176-162890f57832", "value": "T1F7D23A08B3D88561E1FD57B94C7292048775EA5BA973DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453396, "uuid": "1d1e3778-b10a-49ac-a28f-9b980900a39e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453396, "uuid": "76fa790c-b655-4884-9331-df190fa3f00a", "value": "768:eO25RX+6dcAkwg/cIRGqoW/Rb7fB/dT3/+:q5RXddcAkp1ioRbN/l/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770453396, "uuid": "689081e3-2ba1-45be-908d-7ef2ddb6ea45", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770453396, "uuid": "475dfdfe-9017-4644-adf3-a3227b3eee2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453396, "uuid": "14f0b39a-4e90-4f76-881c-71252d346bfc", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71329cad-0444-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770482742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482742, "uuid": "e8066acf-4664-4731-8eae-ec87f50d20d8", "comment": "Malware payload", "value": "9700647410a20b4e4fc122b3e9aa7c45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482742, "uuid": "ce2fd430-316c-4f35-956e-7ab1bb8dc833", "comment": "Malware payload", "value": "1010fd52bc262993dfd8dd9639abf9d40a608f0bc0531bf93e356ad69a943196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482742, "uuid": "8b602831-edaf-4532-bdfd-be26bb718890", "comment": "Malware payload", "value": "a1734dd503fccb9d8af8f8ac67d372ede754d64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482742, "uuid": "f85cfeee-a72b-45e4-9c01-2663b86d2ffc", "comment": "Malware payload", "value": "d929d5a23cba01ada50a18b563f146ec1f1068446e0ce8815bf5b63094ca9b46985636bdb0080ee26f65ea28b8c45de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482742, "uuid": "6d71f0b8-215a-4e51-b3ea-19e93c6137e3", "value": "T1DEE5D024A839D0D6FCD301B177699252A423AF7BCE2C296750BC875CD24AEED053B17B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482742, "uuid": "ad17d921-0664-4bdd-8883-3c4aee87a943", "value": "bbe72e2bf13858c5503f70bc0fd94b15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482742, "uuid": "c7fa9637-f790-42aa-87ce-be9d8e91feee", "value": "49152:5Nqp4PWQBeUj7YU1/K/TDAxupAK/1Xmq:5Nqp4+geG/uTMxu/sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770482742, "uuid": "29aeba5c-19b0-4762-90a0-ff67883d3c9e", "value": 3185152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770482742, "uuid": "5254d5aa-3b1b-4f71-b446-dfd2bc8febbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482742, "uuid": "80a4be06-284a-4527-83b9-d46b8330bf0b", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b034418-0449-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770484718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484718, "uuid": "667574bb-9b7b-4c3d-b0e4-c73cdf62056f", "comment": "Malware payload", "value": "e96b6e825b4ee8580798de6ff607df95", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484718, "uuid": "6780fe3b-d788-479b-96f4-54b5c407d97b", "comment": "Malware payload", "value": "105e15e1a5e5f9be80fd65ccc44884f2403bb31a19d6191a44e08f4bb9d5fb06", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484718, "uuid": "357a13ab-e616-45dd-8e6d-ebd9523850c8", "comment": "Malware payload", "value": "c605b2472dac559a3e51c0bf39bd702051f3c9aa", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484718, "uuid": "383373ce-b728-4c99-9687-a3113817c650", "comment": "Malware payload", "value": "f221b3b4398aa90fc2a1018d01f0040ac8061f08d0635231c14acabb9e2401d7c778038d3e95792670b65c060f4a59ef", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484718, "uuid": "d00c4df9-d64e-47ff-8b1d-5ce2b6fc3f78", "value": "T192A4F7377E296D84DF941EFE8231D5A58DC8E9D391A6C0E1BC400941BEE9BD4F8187A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484718, "uuid": "209588be-8d44-48af-938c-edf645f42df4", "value": "3072:/6/2x6A99US8N3aKOEv3xRStHlP2VCW+3bb4gkFN0GKF6Ch+/CU27qHWMn:/66hgxz3PxRSGVxwbUdFNzCkCUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484718, "uuid": "41787adb-7d44-4ba0-89a7-1448d665e1eb", "value": 458945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484718, "uuid": "5a515153-9566-4261-b806-c557b03b22b7", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484718, "uuid": "92e75ac8-cb07-4b0d-be50-65e6f7262063", "value": "Installer.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad2ea1f-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466975, "uuid": "242157bf-f528-422c-90f7-7c468033bd97", "comment": "Malware payload (Mirai)", "value": "bf283415b41d8f331416f72d6cb30ac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466975, "uuid": "ed4c3da4-24cf-4356-923e-efdb10ad3d85", "comment": "Malware payload (Mirai)", "value": "11d8cd4b559f955436cc99e05a38964c662bd0da3f0a94931fc0cf567dd0ed51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466975, "uuid": "5d4e3a2d-2cf7-4876-9194-7cad5d15976f", "comment": "Malware payload (Mirai)", "value": "42c4300d18ce714c74e310dc9227ab9bbc9a3f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466975, "uuid": "677d50c0-43d5-420a-a64e-b20b0607d9da", "comment": "Malware payload (Mirai)", "value": "df72b6b2e8adc938c5ba4728211462b27e940fc42284efc1831903edd2864250b7dc8579876094aaebe5748c45574a19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466975, "uuid": "fa19cd15-ee8e-4f17-8663-1716a2a68a29", "value": "T1EB937D85FB43E0F0D90609B011ABF7798631DD362024DD6BEB98FD76BD32612A116B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466975, "uuid": "40479afe-3b34-4f94-8276-0582dd747aa1", "value": "1536:EJL99zpFffsRcXhDxDDCczn7FLYT8GmIYqoB8Q3vUX31QUHL6kjymr:EprNsRcx9DDCczn7FLYoXuui3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466975, "uuid": "d621167a-576b-436d-ac07-62c9c6c36a00", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466975, "uuid": "5f2f0fa6-4b59-49d0-8389-9ab6efe37873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466975, "uuid": "677cb308-5daa-42f5-8a38-63166ed9e85f", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c4e1d9-0430-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770474029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474029, "uuid": "e48b35af-cb7f-4af1-b7f6-a54e4965c3e1", "comment": "Malware payload", "value": "fecfb6091ccd380f6eeafb9d2f085008", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474029, "uuid": "a38aff43-4ceb-44f3-996f-5f5eb246a76b", "comment": "Malware payload", "value": "12f3d201846cf967e3e915333a1fbaa8a5c389c4e6c23b709d96484ece82083d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474029, "uuid": "d20f9e53-c208-45e9-a8e2-069ece13bb2f", "comment": "Malware payload", "value": "f29a208ca5ab2d3eb1e3580cd9d7d4600af650d6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474029, "uuid": "3403c30f-866d-4dc0-b9ef-3eb2d1c36c51", "comment": "Malware payload", "value": "5d1cf093ee341e31fe1049a3885813e84261de1d42b36161b20663838be4866ddca1672719ac9a458e3622e1d0bb89b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474029, "uuid": "baecd86b-7a6d-4774-8474-730b4ef2b4fa", "value": "T161F0B4FD135E167E8A88412FD128DAF83F45A096C0826637316D51A20AAE60DAA01B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474029, "uuid": "0cb03dc5-af54-4d92-9a4e-62a13c284baf", "value": "12:sjRf+XEC08ShjSr1q+3qQyFORQsqC6hCHWR3z8:cRf+XIYrckRQsm3z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474029, "uuid": "4871d5d8-2119-4241-9379-d95fb06c40a1", "value": 500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474029, "uuid": "0cf146d1-f263-46ee-a132-3bc00eecea82", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474029, "uuid": "730c9fe1-c889-4233-b064-af262764b18d", "value": "gpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e503714-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438821, "uuid": "58a38dad-92c2-442f-9abc-466dbe64a616", "comment": "Malware payload (Mirai)", "value": "6aabccf9f93289a252494fdff39a092a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438821, "uuid": "c5dec576-bf4e-4124-9009-33a29a59223a", "comment": "Malware payload (Mirai)", "value": "1339592720f03623ddbc41dda5d381266b43e48f09cc4bbc199c302814108046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438821, "uuid": "b330cf5c-2785-46d0-85d1-5119530cb932", "comment": "Malware payload (Mirai)", "value": "7eae5af1a60824b159b1e87f3b840b1c5e1ca9d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438821, "uuid": "9d168aa7-66c4-49be-bcad-ecdf7bf76a8b", "comment": "Malware payload (Mirai)", "value": "3f509bed22f6fc4757b4fcd8cba1e8d364ee6f8364ec7a285e8f1cafabd9a2e0c5026128dc77bc8ddf4f23703e500ab3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438821, "uuid": "b9f599ba-dfa0-4dae-88e5-d52c0f96e339", "value": "T166E32881B8829A27C6D523BBFA2E028D332663E8D2DF31179D215F2537C695F0D77A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438821, "uuid": "c2d08c8c-b31b-48ee-9913-74f23e0eac37", "value": "3072:iCPXfABxdVG2yuOM3ZXJeb+Y34HASl0UrXdW:iCPsV5BOM3Zu+ll/jdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438821, "uuid": "5789a5f1-83af-458a-81b7-64596d67ad97", "value": 150312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438821, "uuid": "a7aa73a3-206f-4256-9033-8c4d89103a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438821, "uuid": "c4235bbc-9d40-4ebd-999d-02c604f5dc68", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf5cb58-0420-11f1-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1770467112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467112, "uuid": "0bd64711-44c2-4b2d-9d79-0b596e922ef4", "comment": "Malware payload (ACRStealer)", "value": "9d89670c1d17a3dce59e9a5f9c35fafa", "object_relation": "md5", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "https://disk.yandex.ru/d/lsH9EXe7e6SDtA", "colour": "#EE920A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467112, "uuid": "bb2e5716-ab11-4938-8df5-c0abcf85267b", "comment": "Malware payload (ACRStealer)", "value": "14e26249514530b7f57a5ab9df99c0f1b0cf0383af94a91c6acc6e08f1dc2b3b", "object_relation": "sha256", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "https://disk.yandex.ru/d/lsH9EXe7e6SDtA", "colour": "#EE920A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467112, "uuid": "cf181a65-1e79-4d18-8df0-9097b40258fc", "comment": "Malware payload (ACRStealer)", "value": "2b6e6358e30a260e6e18b2c8b2cd3a24d87b7628", "object_relation": "sha1", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "https://disk.yandex.ru/d/lsH9EXe7e6SDtA", "colour": "#EE920A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467112, "uuid": "b7ca08b3-056c-48df-a6ab-60112781ed6e", "comment": "Malware payload (ACRStealer)", "value": "b95d8e7780b9a7842f4019c3e8bb043773851c02bcc284b6667036993dab1845a4c70ade46204f0fec3612ca4f8a3cdd", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "https://disk.yandex.ru/d/lsH9EXe7e6SDtA", "colour": "#EE920A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467112, "uuid": "dc6b3427-3acd-443c-9e36-4098edccc5a8", "value": "T162968D30B6A68074EDFE04F660BE95BA5B7D6D14A730C4C398C07DDC0D701E26AFA666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467112, "uuid": "32d57d52-82ae-4d8c-b99c-39437e4a9a16", "value": "17230a6be708ae125261e63d695d0266", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467112, "uuid": "753b9294-6710-4a3e-83a1-5a65477449c4", "value": "98304:ckASbNTWeaqNy1U8+fygZjNR+K5HhMuQf9WdHsBRc8LlvpXQOht:1hUeaqggZzEu2RbRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467112, "uuid": "2758ba01-b181-47c7-9cf5-f9a56facca6f", "value": 8941008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467112, "uuid": "fbd78fb3-0931-4d6a-ad77-d8f8681df2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467112, "uuid": "1acb14c8-e5c6-4d32-8bef-7b00808734c6", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c96d7a3-0410-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770460401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460401, "uuid": "57f66476-6dcd-4bab-8479-de0536524998", "comment": "Malware payload (Mirai)", "value": "1ba247a47a54f5b41643cba972c04802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460401, "uuid": "74f77334-df3e-45c5-81a5-eb11492fc92c", "comment": "Malware payload (Mirai)", "value": "151cf860df97e76948b4e1a19801800e097bae535eb9828c7cc1105cb311e786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460401, "uuid": "f07a5fc0-9dd8-4dd9-a1a8-b81eb2f27d9c", "comment": "Malware payload (Mirai)", "value": "14c4346f2103e3459f80989988fa8fb24713b749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460401, "uuid": "39679444-1a5e-429c-ba8b-eadb1630939e", "comment": "Malware payload (Mirai)", "value": "a8569b518d850850e9831e3aec3cda429077e51ce89695895d4f7f17ed9df4b248cf34efa676386e75bfebd0dba16f3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460401, "uuid": "a6287e37-c94c-4117-b787-e666894a8a57", "value": "T114A5339F726A1FBAB9C0FEE450287781618EAA77D1376F488C5A474060C6CF6C1790F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460401, "uuid": "df04f04a-a5cf-4e61-8844-2831e169d3a9", "value": "49152:QE0aYkI8m2boqjDTbqzJSJTX/yJ8p4DG50vnAS:VlY/rcDyJAL/yJyt50vnAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770460401, "uuid": "1f6de2d4-14f6-4501-b9ef-2a10d4fd0b1a", "value": 2091272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770460401, "uuid": "ac17b652-47fb-454f-9686-e9ce0c9918c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460401, "uuid": "25bd692a-f78a-425c-bb95-cec4dbd07822", "value": "kswapd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c97d375-0422-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770468185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468185, "uuid": "1cf4d6a2-f8be-4d64-b6aa-1f0a846cc5a6", "comment": "Malware payload", "value": "1ec8ad8207f89ba09f05e87c5ce34b13", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468185, "uuid": "d1d38d7d-bf50-4178-8779-7f792ae923aa", "comment": "Malware payload", "value": "15a118de51bf629ea0077103e1110652db96c9ee893646206e005e65d2bdff98", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468185, "uuid": "94daa742-1126-418f-a3ce-bec191b4d429", "comment": "Malware payload", "value": "12d551a5da13e3629973b6c189121c586fed7d2b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468185, "uuid": "ed4bd070-e662-4f52-b06e-e6031d3b6bf3", "comment": "Malware payload", "value": "342cda12783a7ed75c0aac5987cff27f67d8fbcecfcf8254b033bd5885cfdfd55720de3b70aaa9a55b080a3808529442", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468185, "uuid": "b5359ed0-ee53-4e76-bae8-1d09b9cd7ae0", "value": "T11201D4E02134207474F6D8E64A339D1CB085909A3DC72DFC78E6F0DB05D6E10A8820B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468185, "uuid": "7b2f779c-3681-4b41-822a-dbd05dc5d027", "value": "12:YkF1kcClZF70SQHFqHF5HFWfFSx4+FM5gFlfFSD4+FMDgFlA1LRPb:ZDkH/FbQHFqHF5HFWfFeFM5gFlfFQFMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468185, "uuid": "eeab7a87-3aec-4edc-8cba-27714ca8471a", "value": 726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468185, "uuid": "237ae89f-2e83-47a2-a6bf-155ca939d817", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468185, "uuid": "f3d916cb-d847-4794-8543-40091060d39b", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326453de-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489079, "uuid": "ae1c571e-dc08-477e-9cac-a61103bc6c1d", "comment": "Malware payload (Mirai)", "value": "51ba98c75fc7a48fb66915f30acfc11d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489079, "uuid": "59970111-6dc6-4346-8383-9f84fd91aadb", "comment": "Malware payload (Mirai)", "value": "15c6ed7d0b8818254bab99fad8b905d4dd5b4bf5a55b9f5e9658d0da5797c785", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489079, "uuid": "252ddba1-a4ad-4317-a406-5aed80fbf83a", "comment": "Malware payload (Mirai)", "value": "4204b1c117e4b5b5003daa185a963e043c17d569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489079, "uuid": "a0943a72-8300-4f70-8585-d5c2c2d730ae", "comment": "Malware payload (Mirai)", "value": "4f8fb669b00128c13f591d427f53bace6d63833a9d11380e9ce2692f08fe28adee1d8636ad335fab73c10c731bc4e78c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489079, "uuid": "0b1114b6-be09-4051-b0a6-712fefcac923", "value": "T1DE631296D9C138F29F2348383D3F100877B1096E51F812A57CA8B4B2A9F0ACDFDB9151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489079, "uuid": "2e51cac7-535c-445f-b113-cb88819d11da", "value": "1536:eu0i9/LofMEIYCTCwMxvvao4YG8y4UlcoSyvbBp8QrzM:H3/LofRIjqnao4YXobH8QrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489079, "uuid": "2d817be9-9afa-44f2-aceb-9adfba9038e9", "value": 69784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489079, "uuid": "e77efda8-ecb9-40bc-8cd6-481124d4aed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489079, "uuid": "712fa9b3-60df-4db6-b085-6b018078b5da", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999c4056-0460-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770494836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494836, "uuid": "9a97fac8-0c51-48e9-9089-b248fe83f3f5", "comment": "Malware payload", "value": "3ee998e8d1329e32a41f1e2bc102647f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494836, "uuid": "b7751088-62dd-400d-8e0d-9e59e3d411ac", "comment": "Malware payload", "value": "15f8108adce16b5019366446d49586de060a7e5934c5cdf196f9d0d5e3b4d18c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494836, "uuid": "06a071f0-07eb-4c6e-aa69-c55f06234fb8", "comment": "Malware payload", "value": "36b791090ef78d279c5e0715ceb3e0d58d83a680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494836, "uuid": "346c745b-4712-4b22-bd66-526d1ee6fb12", "comment": "Malware payload", "value": "c8a32cc3be71a6f2adf4007630fba435243b8649f0861a774a3111ae0af16b1794c5b8383cdb44245a45c8431167a072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494836, "uuid": "478aa25c-c35c-47d1-bf03-de93e3254e4d", "value": "T1C5735C1AA34328ECD61BC5B086EF6733BA72F8B756309F2F5754DA351D10E902F1A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494836, "uuid": "dfe33fc0-e539-49fd-b21e-f941b873be95", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494836, "uuid": "9ee112e9-d72c-41da-9f32-5d2a1b630b20", "value": "1536:w5l8EoNLDd0E7ccWlWUEvwznKklGgYtRFC:el8EoLJPWgFwWkl22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770494836, "uuid": "da7c5e1a-e383-4377-a860-196b89cd5a37", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770494836, "uuid": "27b47458-45ee-4b74-bf65-5ce423afe6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494836, "uuid": "23ac5042-b47d-42da-8272-8146f9f3a0bf", "value": "SecuriteInfo.com.FileRepMalware.25589793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73596d60-044e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770487041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487041, "uuid": "e378522d-b21f-44b3-99dc-67c31827bffa", "comment": "Malware payload", "value": "c89d602844da0173a9f50b7e29727b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487041, "uuid": "61847f53-b9b0-4e4c-ac1a-913031d0a087", "comment": "Malware payload", "value": "16788394ce3268cfde44286f40c5d17cfa90151532b6b0339f2e27a8ecf0a6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487041, "uuid": "b9105561-14ae-4a1a-a361-a795cd5cf6cc", "comment": "Malware payload", "value": "a9756eb2b924111398c6129c0124e64cd29f7499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487041, "uuid": "3575fefa-9014-40a4-8d6f-cb937c2bf9c0", "comment": "Malware payload", "value": "52e2643eb1c720f725329a4d2766b4088676bc1710f828104c6c4efa4b20d4e5ded4b595e1403fb98e6eb7016f026fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487041, "uuid": "2b312788-d07b-4a89-acf9-76b090a5a57b", "value": "T1F374D50CFF91E806CE2E3D77CBE610004B7125C26F21925675496FFE8B6637658A62BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487041, "uuid": "63d605d3-72c9-45e0-b11f-27b1479878c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487041, "uuid": "3b4c06d3-8abd-447b-9f1a-91b16117f3af", "value": "6144:6IS0SEqTde6VlWT8b9hPbfXvwWBlboZP:bSbPVle8nTXwWBEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770487041, "uuid": "f4fb325a-3db9-47d3-83e7-4d6d072c7684", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770487041, "uuid": "afbabcbc-c8ec-42c6-b318-ade1fbeb8b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487041, "uuid": "a24572ee-ff79-490a-a56e-00e77f895248", "value": "CrackLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83879cd-0429-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770471265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471265, "uuid": "61be2c47-c814-4862-be98-14ee6b838c21", "comment": "Malware payload", "value": "f9e90fe2bd72aed5f91f5fb02bc750f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471265, "uuid": "5362d1f9-09d6-49ce-998a-b7667f91c0aa", "comment": "Malware payload", "value": "16e71c80c657abc64fe317314e1f7499eb6d1c0a9589658a47b0f8551684f5ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471265, "uuid": "fa476dc0-4717-405f-8843-e6faa24a8ad5", "comment": "Malware payload", "value": "e54bab593470fefe55b8fe3488a0d1b274acd79a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471265, "uuid": "2b5a2ce7-55e9-429f-9810-41e897cd276e", "comment": "Malware payload", "value": "4afd314ab10d6a7acfd2a793bb68147d438b64fd405f49ad09f5153e38817608a985882f324165d2243be557cb97a96d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471265, "uuid": "5f749da7-f1e3-4672-8059-802461e1b2af", "value": "T116D0225310100BB03DDEC9F6F3E10CC4B0A66B4A81BECB21F0CC3890804CC08B228E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471265, "uuid": "363ea522-a1cf-4670-af9a-8a8938d1b004", "value": "6:lOnFfl1zoVLUIj1DF3JoVLUIjKUAzGhwQ:iXIJdJIjKHnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770471265, "uuid": "6ef79ae2-0283-48b4-8419-9c9900d16dea", "value": 203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770471265, "uuid": "4e55138e-e3ae-4719-aa6f-e599f630a765", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471265, "uuid": "33cc738a-22c9-495a-8e15-55e34c1cce43", "value": "77.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6a0805-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489205, "uuid": "00388202-9c91-4ec2-899e-79376e02058b", "comment": "Malware payload (Mirai)", "value": "9fc4d54a5d86da63c2a9e9b7cbbdc9ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489205, "uuid": "557f777c-2947-45ad-a768-fc768c282e79", "comment": "Malware payload (Mirai)", "value": "1723c8a8a08eaf194c82129fd7ade88e299c04417be22648db37de89459b9714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489205, "uuid": "065fc3a0-d92b-4561-9803-15a7d87edf3f", "comment": "Malware payload (Mirai)", "value": "7c633667babdb2443a6d8967928d8130c87d6a1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489205, "uuid": "67a8f6ce-839b-4b7d-9c71-8f8bd575517c", "comment": "Malware payload (Mirai)", "value": "383d8d949f4863882e01e9ab5d75663c271b5c4b1cd009c5731eb89e076e092b2e18039901e77e2c0f9d50791467490b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489205, "uuid": "f6a0463f-be99-4c67-9b60-d4a68c73bbfc", "value": "T1F3534C02B30C0D47C1671EB03A3F27D593FBA99121E4FB84691E9B869271E325686ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489205, "uuid": "c959717c-28d3-4158-81c2-1fdbe8523a3a", "value": "1536:kDcWV0yF29H83KZK1VIZQbpHuZ7gP6alM:PyCc32SVIebcRalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489205, "uuid": "8cd0a3cf-b1a3-4b59-99cf-4cc9ea253766", "value": 64428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489205, "uuid": "cb9eecf5-4a94-4ed0-84f5-40bb8c110c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489205, "uuid": "80c5bd06-d26c-4e4b-9eab-974382de9cfc", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f2c58e-0451-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770488386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488386, "uuid": "58ddace8-c747-48ae-8592-449f99a27495", "comment": "Malware payload", "value": "fae91290b482e79cf055ec7c2693f7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488386, "uuid": "dddd6ed0-3f4e-4cc2-9635-35ce9d8369f9", "comment": "Malware payload", "value": "17ddb020555f8fb5646ee7e1dd4125bc593738bc5f6a470d2997a2e93cb55042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488386, "uuid": "d0d5fd5b-2c13-4502-b333-3bf41b0b5c5b", "comment": "Malware payload", "value": "c80d0057c8ab00aeac5460e23365837118532512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488386, "uuid": "42b733b0-13ca-45ab-b2e9-f5f6075e9046", "comment": "Malware payload", "value": "0848772e0ace479f66ca0c5531ec2fcdbc84a2b45463d4d1b144d485f7a2ed9c97a2f22ea5b3d36261ddfd1a6c9bea62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488386, "uuid": "effcb8fb-109c-4c2d-a942-904781bd6677", "value": "T184F529426CDE58A6C6AEF138949163917A723C6443703BD30F8969B78D76BC46F3E708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488386, "uuid": "ecdd49dd-4254-45b4-a51a-6f8b46c64144", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488386, "uuid": "4fd42b64-6d82-4dc3-95a4-6829ff658791", "value": "49152:mGpm/l30uBa8H5dm+IT9APtV9tsJ4o6nK1/a:Al3HdaTWPVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770488386, "uuid": "6e263a4a-d28c-4a84-9e2a-6b1cea885622", "value": 3588608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770488386, "uuid": "aea6a4c0-6d43-4360-99e0-b409cf24faec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488386, "uuid": "9fbdd5bf-2e3f-4cb9-8a82-52f2fb9d8773", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d421c4b4-0424-11f1-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1770469164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469164, "uuid": "dd5a3952-dda1-4ba2-88ae-61a34a19a476", "comment": "Malware payload (Blackmoon)", "value": "e887075e89eb6d936aa184a531d5642f", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469164, "uuid": "ee06de35-d5e3-4c01-90c7-c087f00a40ee", "comment": "Malware payload (Blackmoon)", "value": "17e9f884298e3e5869de025f256d115f3541db637b33fb492fa1709ebdb7f2ef", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469164, "uuid": "87d106cd-dbb6-4463-a1b7-e494f768cdc6", "comment": "Malware payload (Blackmoon)", "value": "a95a10d977b3aa40036d4afcdb92a71f9eeec776", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469164, "uuid": "087cc9a0-a7c0-4c0b-a927-8d708c5420b3", "comment": "Malware payload (Blackmoon)", "value": "de9edd464b0e44e7f50ca2a77dcd7fb81e69de9757c520f7f3d626eb10d61e927cbf5cbf96b80dd2f4ad3858d0e77955", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469164, "uuid": "f4919338-b3a2-40bb-83a7-39ba4b502136", "value": "T1C5E62320A3CBC636E16D0577D82EAE0E91357DA7033141DBA3F4B99E2E318C1567DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469164, "uuid": "7653d3ef-d702-4a4f-801a-31929fedd9de", "value": "393216:Mv2TEj5Ef/twngQqTw761FEr4p8B7aLU8cdMhW+6mA:MvZjWfWgQTrrh5aLias", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469164, "uuid": "9a4ffbdb-8120-43fc-aca1-b7c0c120afe3", "value": 15253504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469164, "uuid": "d3c320b4-f1c9-444d-97f9-1a2132658c33", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469164, "uuid": "42bf7f97-e5fb-4cd3-b012-8bd64ec7696f", "value": "Hrybdgg.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f4ab69-0400-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770453414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453414, "uuid": "c2e99f00-c4c6-47d7-9c03-fe507fc583e3", "comment": "Malware payload (Mirai)", "value": "74124d2745e3ddee96c45e407373d07b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453414, "uuid": "28487077-eeb5-475a-962e-0c4a688a2681", "comment": "Malware payload (Mirai)", "value": "185928c86e2f3c1a7ba4f90cb682c170398cc53cd0306cf48075aa8dbfaf9b35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453414, "uuid": "d32b2a43-d19b-4244-90a8-8c43501a1c2b", "comment": "Malware payload (Mirai)", "value": "10452e2b6a15c8cd205e0e02ee176930643af36b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770453414, "uuid": "3a2d21e2-da71-4fa7-92dd-4fd32041ac9f", "comment": "Malware payload (Mirai)", "value": "8c2672d686cff61a1852817c332073f7052fd78a4afb866b097ab262a0d1faaad8607f8147b0941becf7b996a35ae71a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453414, "uuid": "ab0c3edb-c67f-42df-9aa5-48582637155c", "value": "T180E0205A31224A7329DE8C7F63E641B63084245B0CC5D630759E28654F9E8007251149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453414, "uuid": "2eb6067d-0ee6-4264-9144-3fd3f29e4135", "value": "6:h9OnFflRYED7++TnIAMxnKIekdVJcs5p8CorTuHgSW:GbT8nKIXcsXDofuA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770453414, "uuid": "6f13a5c8-dd43-413b-8846-b068379575c6", "value": 356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770453414, "uuid": "db71509f-52e6-4e8b-8073-75048ef5291e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770453414, "uuid": "de5f3bc6-067a-44c1-b5b9-d92841c004a9", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9acb5f-045c-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770493207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770493207, "uuid": "f29157bb-d087-4c70-a2d8-47f301c6a3be", "comment": "Malware payload (njrat)", "value": "58b26fdc265b06e5aed255169c49ed3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770493207, "uuid": "6bfb94d2-9c89-43ca-bad4-6a20c38bd15a", "comment": "Malware payload (njrat)", "value": "18e50046c90c6d2f2cb9c882511ea268a2687a653812901380e040eb1b39fb23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770493207, "uuid": "3ba319c5-94b0-404a-a87f-fc6c02130801", "comment": "Malware payload (njrat)", "value": "ddf33f1a855539b91bfc064054dd7a9cfb242c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770493207, "uuid": "52723f55-3f96-4db9-826f-bc4bacfd80e2", "comment": "Malware payload (njrat)", "value": "306a9c5a5fdcbcd12da3de187f0b2811d0165b90def49374d57163413d102eea4f884a66bfba719c99c83088568ccde6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770493207, "uuid": "3f45a855-5e86-4868-a763-152652040c93", "value": "T10FA2070B77F48215D2BD66F889B303254772E3478132EB9B9CEC94CB6B636D04645AE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770493207, "uuid": "9519f2ae-f9ba-4f91-a847-cce34f4c830c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770493207, "uuid": "82fd7ae1-32e7-4005-bb8f-3c9294bd150a", "value": "384:+5gGAhasGBLACn9NSmTTdoZ3TtsWTrzNmVebtHFC3cux2:Mvf9NXiJtxtoLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770493207, "uuid": "86517e92-2d92-4b95-ac71-576526b769b3", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770493207, "uuid": "6331656c-5608-4107-9648-7b66c639b8e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770493207, "uuid": "33644699-32fc-46a3-8ad2-24599ea59e59", "value": "58B26FDC265B06E5AED255169C49ED3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866b4c69-0453-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770489220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489220, "uuid": "9eba5c3b-e59f-400e-9c36-a4356783e43b", "comment": "Malware payload", "value": "fe60d35c9ea39ed0dcecd077ccedb134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489220, "uuid": "32749744-88ed-4efa-841c-cbb807cd6443", "comment": "Malware payload", "value": "1974c75a8009c84626a53a1651b99be84c897cfd088d571f7f7c4db1ee4e7b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489220, "uuid": "affedc7c-8fed-4699-92a4-7a89d084fe77", "comment": "Malware payload", "value": "b746a97de79a4dae98432742c9fb170826f6382d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489220, "uuid": "ad3c48be-d5f4-4e35-89a4-63ffa9cc04ca", "comment": "Malware payload", "value": "ce7e113a62a2a02e4b79ea4c5db46cc85dc4a015822da7f6b46d8f62959be5697d128dfabeb0a06041e323b851dac875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489220, "uuid": "e1774150-a0e0-4f5d-9ed2-54fcae4de2af", "value": "T161251947E2A354E8C92FC17487B69772B930B46942387E6F1A94D7321F20E605F6EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489220, "uuid": "37fa7799-2e78-407b-a2f8-19452fd9e652", "value": "611e198dfa2982f0a0307df353394f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489220, "uuid": "c2025c66-fa35-40a7-8bef-b4b5dfd7f9f2", "value": "24576:HoslfX+BeL9g2+hhrQSwOePtxnaOiQM4M8O:HoslfXZL2hhrMOeVBaOXMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489220, "uuid": "6f5ac12a-bdef-461e-af35-fb005f202303", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489220, "uuid": "ba653b4a-a77e-4c6f-a95e-7d064244141a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489220, "uuid": "93c33f0c-0cb9-4579-be64-0ffd4cea6619", "value": "CarboraneAcid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92573ce5-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468195, "uuid": "841c4d02-b7ba-46ba-99b5-517ba1112b94", "comment": "Malware payload (Mirai)", "value": "ec31b531eba94a15d8b331f8db18fbd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468195, "uuid": "967c070f-e6b9-467c-9ad5-a5ff23768035", "comment": "Malware payload (Mirai)", "value": "1aa13646c6dac09a980aac3ed93ea01d215ebc5b39d7f5f135753581f0e5aa81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468195, "uuid": "c76d55ea-2c79-4a30-bb46-6fbbf7d244bd", "comment": "Malware payload (Mirai)", "value": "10d50d7939f0800c7e49e7bc72792f6d537d2ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468195, "uuid": "e6ad9cb2-607b-468a-9ef2-c38396022131", "comment": "Malware payload (Mirai)", "value": "714a52ffceee8bf013d797359603c849e142b265b93ed91095b4c106e4835568a2f142facb8da187487f126f55a6a211", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468195, "uuid": "1e820bf3-2b02-4ca5-840b-1c7015e57428", "value": "T108834956BD919A12C6C012B7FB6E418D372613A8E2EF3203DD256F2433CA91F0E77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468195, "uuid": "8bc8729e-0895-4c0c-a1b0-79f1597111d1", "value": "1536:9dDsaIbVCFREwwESOtcNjrM/350Nm52P7+oCn/6n5AbGgB/AOWE7Vjdl5zvVud:9dwbbVmRbZcFUymg7ngS5qGglAO77FPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468195, "uuid": "3be211ef-b208-4887-ad16-a48db4bb053c", "value": 84268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468195, "uuid": "0d5bc291-4912-4424-8c98-6d676ce98ea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468195, "uuid": "f6c9aa1a-7a6d-492c-996a-de28c3385ebc", "value": "binary.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8735aefd-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468176, "uuid": "f9518af0-9c1c-4283-a091-4377946b77d3", "comment": "Malware payload (Mirai)", "value": "f344fe6e373086fbe0b0e6b847f8fdb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468176, "uuid": "e10409c8-5d3f-4694-88ba-a644e16fdec9", "comment": "Malware payload (Mirai)", "value": "1aeded4ed55a6c1a230c0b462ddf89ef482f68fe38850a40f30df82222be1980", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468176, "uuid": "a0225c02-c53c-4d71-890e-fed38893b75a", "comment": "Malware payload (Mirai)", "value": "b3da60ae4bdb8bc74e9a658ae1d041f79ec46e33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468176, "uuid": "3add5e2d-1aa8-4dd3-8a81-1bfeeacda476", "comment": "Malware payload (Mirai)", "value": "2941d77299ea749950c6daccc1922fac9461945a5d04439ec658d9d0e0afc3b5f4b88065e1af10fae1cd81f93f50f305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468176, "uuid": "ca33da06-590a-4966-a628-bb27099be7f5", "value": "T1AD141906BB210EFBD89BCC3B45F92705248C582622E9BB36B934D918B54B25F17E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468176, "uuid": "190dce80-3048-48eb-8988-cb0daf121fb1", "value": "3072:TFi4H5Nqdg7xqpP/O9AfxVO3+SfCux8Xq66zQXYVeNSMn9:TFJH5NqdgaPGn3+SfRZ66QXYVcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468176, "uuid": "33019170-0c57-4001-903d-b2da3bc6746d", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468176, "uuid": "a438f039-d8bf-4ec9-b917-57a46976cb42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468176, "uuid": "6b5d012c-8631-4c0d-8109-040d9968d873", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a679f6-0424-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770469088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "669a3512-e975-40b5-bb97-434c8db3badd", "comment": "Malware payload", "value": "688966262ef023a8a9f6abc420371665", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "8c7fcf82-b2c2-4405-922f-e5cdc9bf6812", "comment": "Malware payload", "value": "1af75b43a7064d451778e9e932b40542a829770df72f4464f7ff06bdb94a9ea7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "ad167b69-bb54-4833-8623-e30098465a11", "comment": "Malware payload", "value": "706e1d13029a46e108b5943a96d685af06899cb2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "0c0fc429-0465-4493-baef-d5f4f4a7107e", "comment": "Malware payload", "value": "7c30550d07e3d4432f8f7db1f05da98180db50032c67d1cb157cd5c28a8e677a63a50fdb9f875f076d6ecb25d52f52a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "d148dbba-18b8-45de-82a9-4b0cd7a1b7d2", "value": "T1A4F0E5CB25D6766ACA2CAE48702E860C5444EBC430B2CFBCE44D14B3AAC7D15F115FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "722aa1d9-fac1-42be-95d9-afd887a47dfc", "value": "6:aSWJjQ9BySWJtY6B2QNJvaa0LKi6BySWXICBySWKW0XBySWgTnbEIMBnUn:dWJQjVW4q3NFf0LKjVW4CVW4VW4fAUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469088, "uuid": "abb08953-129d-44c9-98ca-4397b5d40f38", "value": 442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469088, "uuid": "619c5696-5bb7-4bc3-ae4b-bfafdeb98e55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "dd520a94-ff9a-43bd-9e64-dc991e5c9eef", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3dc572-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770491569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491569, "uuid": "3cec7f06-c8d0-47ad-9762-2191c5eb6dc7", "comment": "Malware payload (LummaStealer)", "value": "99ef093212c596e80f8720c7d418f07c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491569, "uuid": "e702e056-5ae6-4052-aa93-921969054652", "comment": "Malware payload (LummaStealer)", "value": "1bec2b03944d2db172002c0e9bd69bc53ff93da50c0adbbd28e9e047846e3a4e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491569, "uuid": "f2bb3c05-ce7f-42bb-a05a-913c00563a59", "comment": "Malware payload (LummaStealer)", "value": "9004f15089694dfaecb32096abdf33e63ba08722", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491569, "uuid": "768b24de-34ed-447c-a265-b555d8a1824b", "comment": "Malware payload (LummaStealer)", "value": "2456b3d107558d8a0080fb165150faf4d012166d022b8284541c160c7b8fe79a9c65b5c6927ae560e97f204856fa9486", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491569, "uuid": "f515fc4d-4a7f-470b-b561-0991084e95ec", "value": "T19495BE10DABF7A52F1EA2171D0A431171C7FBE5C0AA4809F33547CA93E7F183696A7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491569, "uuid": "8ac00be6-a60a-412a-845f-8650e26eca72", "value": "9a1c9fa2e77f12f22dafcdcbaa4c9e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491569, "uuid": "42b0ffc7-b400-4d6f-81d3-920e92fa5d89", "value": "49152:EbiRFd3lS/q4TCzAlUnKi/S6QMiDuRIrCAUHdYr:EbiRb3lS/bGzsAPS6QD/rCNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491569, "uuid": "58a7129e-3803-4565-a3a1-23293522dc9e", "value": 1937952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491569, "uuid": "a282bab4-5066-4e27-b680-778fb1fd42d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491569, "uuid": "ceb7ab42-57b7-4b53-8b14-b16149cb2664", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a872cc-03d5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770434888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770434888, "uuid": "be9f4cbd-706a-4e28-a98d-0e702b7d96be", "comment": "Malware payload", "value": "4a920507160aeb6a2b017a2584d616fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770434888, "uuid": "c75fe9c7-550d-4642-81b4-60d4b3bd9db3", "comment": "Malware payload", "value": "1c1c60188b688bc3e6602cc5f3639ed22d2bc8f8e18bca58572a40daa2f63611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770434888, "uuid": "69a75f00-540a-430a-b8c9-0f77fc5b1fee", "comment": "Malware payload", "value": "bad4c65c8d6d6f348a06f5688aed62aab18473f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770434888, "uuid": "79cf2cbd-0b0e-429d-9603-2ec29fad0969", "comment": "Malware payload", "value": "5da7d26d76ee586baeb3990a4e55d9f64df31d124748440267ec263f963702efb82f4624dd2beeabecf2af563ffab9ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770434888, "uuid": "26c01bae-6383-47e8-b5db-ffb79c13ace6", "value": "T1C0647D15F7A514FAE9B7C13CC9424906EA72BC4647A1EACF03A04A973F276D05E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770434888, "uuid": "40bb8124-a8fa-43bb-a304-d812e6e28e9e", "value": "34950e4497933a77b75ff76c00957447", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770434888, "uuid": "8c68428f-aedd-421f-8abe-67c67e9dbeb7", "value": "3072:2+Yh7Sf+daQbgBCj0J6JgK5jKOpbQFX60fwaEiza3Kn09XsOKXMtY/NDpu4yUynF:2+Y27c0JRK5jKOsqMw203uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770434888, "uuid": "770d71cc-d58b-45eb-8449-fdf257b44d19", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770434888, "uuid": "12b697cf-2416-48e3-81cd-3e0ceb296744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770434888, "uuid": "923cd8a0-6c6e-4d5f-b4f3-2fd16be72ba4", "value": "hi.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e5456f-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473353, "uuid": "24d0d2e4-c121-4830-8b11-81d9cb76918f", "comment": "Malware payload (Mirai)", "value": "caf042564f8a006a7ca5a1f3dcf78544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473353, "uuid": "057b6745-f1d0-4df4-a804-134e864fc86a", "comment": "Malware payload (Mirai)", "value": "1c1e5c727032a364caa21383e7989ff9733c1660eb8549289ae5797261175f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473353, "uuid": "3f824ec3-27d0-44a2-b392-7a62d04d1c73", "comment": "Malware payload (Mirai)", "value": "113d697e3d48d59ecd87b69eb5dd119a90255359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473353, "uuid": "4d5d13ae-5b43-454c-af87-a91bb3433511", "comment": "Malware payload (Mirai)", "value": "f765f0e876a31b86e2b01ede8df2e5cc7471dbb538efd16dc2c45ef19d9c156261c6f5caed2298985cf787987033fa53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473353, "uuid": "aceffddd-4294-4448-b14e-8cf172d5b948", "value": "T193934D996FA03FBFD81ECD334194DB0A229C99195399BFBA2B74E404B64710E59D3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473353, "uuid": "1636b151-2934-4f52-831a-b5d87750cf40", "value": "768:IxGipDHe+8VjopcMd7WMVDT2hHhjrzWb8wktbDrM3T/zlcElFX:AGipkMdzDSNJbDr2TxcElFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473353, "uuid": "516fa65f-cc35-4d90-99c3-7562ae7be693", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473353, "uuid": "6d19c1a2-e446-4652-b4a5-b18d421c62bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473353, "uuid": "1d929b02-3766-4f9a-93af-389d8c8b475f", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c926180-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489204, "uuid": "aa20c970-90d9-413e-8b17-7611b4d8810c", "comment": "Malware payload (Mirai)", "value": "b60919def1deb9a69fd11eeb80200007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489204, "uuid": "33401799-6273-45bc-9a55-03d7da120514", "comment": "Malware payload (Mirai)", "value": "1d4e873e677c767dcf19d3bad1cd36fdcb4229f4f45083e475a25a5ee8bfe121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489204, "uuid": "84bf2d09-9902-4303-be26-c9407f9c458e", "comment": "Malware payload (Mirai)", "value": "cb58b3320df1a91f5084a864ee0bd1e77ee9bdf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489204, "uuid": "fc7b6299-272c-43fb-8ef8-2af651c4f4e3", "comment": "Malware payload (Mirai)", "value": "895ceacd84beee184c8b57654869813d1869653358a3f3aeb85096e0d3579f60cd0e2c79070cdda99b858e34b97992c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489204, "uuid": "fe2649c2-7a84-4fbd-891d-445bf0a37a31", "value": "T1CE3359C8E643C8F5FD57017511B7AB334772F13E106ADA83C769E932ACA2501E62A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489204, "uuid": "8fd62fb0-8fd0-4563-bfd9-9f0b51ce131d", "value": "1536:VckZCvWvh2+oscC4Gnfg2rH/FwCd1WY30Ey4TuSm:VckZCvGdotC4M3/Fbdgg0Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489204, "uuid": "a3f2ce69-29df-4fc3-b4f3-9ab8f6007571", "value": 54900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489204, "uuid": "7b94ec85-7cfa-4fd0-8f0a-60b36fbb7fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489204, "uuid": "33804899-2222-463f-ab43-0181ba3884de", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde1f593-0425-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770469557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469557, "uuid": "bd220a26-d9d7-41af-8833-9b724970c81b", "comment": "Malware payload (CoinMiner)", "value": "498c8c41fc33e30b43dc7a3c063cc0ec", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469557, "uuid": "3bf8dd10-aa74-45be-bb24-ec55e26f80d4", "comment": "Malware payload (CoinMiner)", "value": "1eb86f440903f1b5303320c4b662ba0e2f0048c896759916b2e226701e58e9a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469557, "uuid": "7cbb62e0-e93e-452c-8dc8-d8da98e0d044", "comment": "Malware payload (CoinMiner)", "value": "4bc61ba67d8cc39ec8a32ee429f0dc97adb0f21d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469557, "uuid": "11862e44-a521-4118-8dde-eec0d6c6577d", "comment": "Malware payload (CoinMiner)", "value": "814c1e68ee84a6ad740c03abcd8cdc8d58ad19b292ad0086d57e6f2f080965a5a10cddca0fb4650325999d9304c7a2fc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469557, "uuid": "9f4f1c51-8a3b-4d7d-afde-eaeaca665f43", "value": "T1C896AEA9F6B800E5D86AC17CC2869217E371785543B0A7CF2BA446F61F63AD45E3FB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469557, "uuid": "5afcb74c-3b6b-496a-948a-3289cdd7b31c", "value": "476557c673fe68fc3fef07de50950ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469557, "uuid": "d7dc631c-b1fe-44d7-a081-2830dbd4dda6", "value": "98304:r7Q5o7+/cBbSt8jNR7tMQXfd5IRY0ZR2olqXlp+PvqKgy+x7VFlKtOGxUH27:r7N6RY0ZlqXlp+aK3+VFlKtO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469557, "uuid": "e36a9b82-3cbc-41b0-becd-51a05bbbdba8", "value": 8660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469557, "uuid": "cd9f3ece-6a61-4aae-947d-ec2aef872f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469557, "uuid": "ce7f859b-254b-4c44-ab2b-33cb13f8fee1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb82ef12-0426-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770470009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470009, "uuid": "a5d638bd-93ef-40ac-b727-d5c858519ba6", "comment": "Malware payload", "value": "7b39713bc5544a913875b3283c8ca28b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470009, "uuid": "5a69cac0-9eee-40e2-ae64-adeb614948e7", "comment": "Malware payload", "value": "1ee014927a77140541f9d786ce8883eb9363617330ba99e5b33ea91333791563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470009, "uuid": "0b6969a1-8303-4f6b-97eb-3f7f48a67943", "comment": "Malware payload", "value": "b297908a37c2a0c1c263033dbc32b5bc879bad84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470009, "uuid": "90f09fa3-5223-4e34-bdb4-177b462975ff", "comment": "Malware payload", "value": "a29ec648b3bae4c252231dab507fea725683af1f8a96ecaf0c2b03012b30f5bdd2f1adc0836a60d7ba468838d03515d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470009, "uuid": "791e112c-ce62-4d14-a5b6-92c9d3888647", "value": "T18C8633ED5358E3E8F815FF39878E4E5523D47B80F4D8365B6189116C8ED72928C2B8A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470009, "uuid": "9464f365-7d41-42b3-9b82-5d1bdc0b4f3f", "value": "3eb37f886eb04c5759817c09d5b258c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470009, "uuid": "6ac37c2b-8c5d-4ee0-8ff3-186dc6d82f13", "value": "196608:Rj2b8/UyddHZbrvrzCaQH+FXa6mzvVQay+D4Q26K0AjfLidVF:F2evhLzZMPzxBDD2CAIVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470009, "uuid": "a75fa1d6-ca58-42af-9faf-9282aa898eff", "value": 8031232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470009, "uuid": "abe7b56e-e895-4cc9-bbb2-6272e45e43a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470009, "uuid": "b4c2c701-f328-4983-9190-65b2602d17a6", "value": "00KBVp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c9d03d-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489114, "uuid": "d910d07a-9b33-49ff-b229-5eec2f0e8563", "comment": "Malware payload (Mirai)", "value": "150f890e28f4196ae821c9e4f97738f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489114, "uuid": "e56ac15e-607a-47bd-9c5c-6f7bc3ef47e4", "comment": "Malware payload (Mirai)", "value": "1f059d8ed5fb9dedc72227e4dcb15a00b94c0b76444b60e55e41aec611b230a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489114, "uuid": "76200fd5-c0c5-4a40-87bf-5408aa1ed0e2", "comment": "Malware payload (Mirai)", "value": "3aa430ef41311c9e7c134c7a4fd15a9fc0bba729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489114, "uuid": "8a34adbc-8a42-439a-8c8d-231d6e762e4d", "comment": "Malware payload (Mirai)", "value": "97636436bbed439297b28809cabfa6f3cd4243fee0688f1defaaa92ae3352aae52eaaa6599ef76cc0ed404a0ebfd7a17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489114, "uuid": "7ad44654-278b-480e-a97a-87586d4d49b4", "value": "T130141846F8C19B11C5D012BEFA1E228E33131BB8E1DE72129D255F61778B8AF0E7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489114, "uuid": "850f6712-dba2-479d-be03-2e7571e94ee8", "value": "3072:VimeCbf6WjUO9iQ4sqMyU8BvijX9zmga3aYihnYHwQESAjbutxB:omeaNtNAMy7gjXlmgoa/wwQujbutxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489114, "uuid": "1defc208-04e0-476d-9c2a-76f17c062aa4", "value": 199644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489114, "uuid": "3842e901-7ec2-42ce-914c-3f3bbcf36814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489114, "uuid": "55ccab1e-485d-44a7-8ff9-e82c76e4fbd5", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ddd248-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461673, "uuid": "b3fd8e4b-093d-463f-9f03-97c733e08268", "comment": "Malware payload (Mirai)", "value": "2ddfe2144ad054718d6b713a64785b4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461673, "uuid": "f203b8ff-f254-4b48-896c-024a0ac4c7d9", "comment": "Malware payload (Mirai)", "value": "1fccd11e21e0217411f00edd60bb086b01df61944202764b1dedb15e7324b412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461673, "uuid": "1fcef62d-8479-4f93-b53c-9255958cab43", "comment": "Malware payload (Mirai)", "value": "6ef4409e79b0cc889c0316a79e916a46030f7299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461673, "uuid": "927eae4d-18e0-4997-9c7f-4a5887eac7f7", "comment": "Malware payload (Mirai)", "value": "049b71f1c66981cc524cb8e8192323b97d06abe33047a385afb6d38174ca99d10682babd43b8335746c970d4b2af8049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461673, "uuid": "357e07d9-a1a6-4ecd-9af0-3c43f467c272", "value": "T1C89533A2E1E15853C80F79AEA921D8D2CDD8FB93963DB0105092F126A3B9F5D4131F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461673, "uuid": "f826488b-c5f6-4d02-9e0d-fe698609fa3c", "value": "49152:bMji5Nm0t5thNCa2l80ID11PqfRd5PgZf9ZMB:b7Jt5EnGqpQ5Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461673, "uuid": "3d2557e0-a518-4d18-ae43-4d4c3d00e6eb", "value": 2011320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461673, "uuid": "76519e24-865e-4dae-91ac-e888557a7653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461673, "uuid": "28ff94f3-c1a7-4135-9a98-8f095e00c5cf", "value": "kpsmoused0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9332e63c-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473350, "uuid": "1095ae65-65f0-4c3c-b84a-83120dcbd9cd", "comment": "Malware payload (Mirai)", "value": "466a9b9b7f9a81062efddc23f0a2fcf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473350, "uuid": "16986a8f-e7cf-4965-be50-c762f41c4303", "comment": "Malware payload (Mirai)", "value": "20170610bc7a9adc7bd88e245977129d15372e2930f1320e375b3d33824d5e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473350, "uuid": "074ffe45-e087-42d1-a47b-be8d5c2def7a", "comment": "Malware payload (Mirai)", "value": "e02101b457f4111dec5aa3837873ecda81e2af6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473350, "uuid": "d5218c76-617b-47ec-8b98-6cbb308318af", "comment": "Malware payload (Mirai)", "value": "c5ed2282ffebfb47d24fc693539b8783af134dd2515d039d78ee9ddb117d2990a706b014fe4c3af9304212924cf9c4dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473350, "uuid": "1a01561f-e7cb-4e2a-970e-2eed2b5980e6", "value": "T171631B46B8819B22C5D056BFFE1E128E33131FB8E2DA32029D156F303BDB95A4E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473350, "uuid": "ea69173b-487f-4bd5-9065-998262075b5c", "value": "1536:B/nCJ7G5Zfy8AKpKr7uVwd1ILIY1IvAou3JA+HY9BOdYLLYIDQDdJrR:4J7w7Kr7uV01ILpH3JAAdwLh6tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473350, "uuid": "8a37e84c-c9e1-4caf-bb6a-a87978358d2a", "value": 70436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473350, "uuid": "55021135-abc9-477c-a864-88fc545675f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473350, "uuid": "e4c720f8-983c-4f8d-b65d-4fc25c4f4739", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a61f3f6-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461686, "uuid": "1012bf26-a604-4dca-a4af-df6fc47c66c2", "comment": "Malware payload (Mirai)", "value": "bcf156b684db12e175535ff99ca39904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461686, "uuid": "d734e602-8e5c-4932-a6bc-503bae38fd24", "comment": "Malware payload (Mirai)", "value": "20fea1a8ed2893dbb3d6c54e96dcdf352c1578de0a1ba275ba1fd7437ad3a363", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461686, "uuid": "75de0186-1eef-479f-98ab-ca7ddffd9114", "comment": "Malware payload (Mirai)", "value": "f0a829f0d41bb38b040b240e0408f3284834bf67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461686, "uuid": "288cd38c-4d04-4890-858a-54d745c15ef0", "comment": "Malware payload (Mirai)", "value": "888c694c1cbf939f993a97128638b417b4ce7bae9161e394f6413eeb35dfb256a3ae57b08487e11b50011bcc7814992a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461686, "uuid": "646b6b25-bf28-4cf2-8560-f120108345b7", "value": "T1099533135CC3562B88366FA6BEC1D0227BE5C872214B6B2160655D7BE6F0CFD8BDA074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461686, "uuid": "e6214c06-e897-42a4-ba82-6a692e4c5f7f", "value": "49152:pzIweDITakFwagLUlmGxwu1QY9hLDWY7FGwHiUdP5N:pzIweMTakFwagL8mGxwUQY9h/jQCisN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461686, "uuid": "e37c16bd-22ee-4713-8bdf-fcc52e6b5ea1", "value": 2060692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461686, "uuid": "5aee95e1-fcd0-4bfd-b854-fe4b05f6c31e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461686, "uuid": "4ecac5c8-6bfc-46da-a2e7-5cec35137c99", "value": "devfreqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a799ff23-044b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770485840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485840, "uuid": "2abc9dab-cbff-4385-b73e-6cc0217d8e07", "comment": "Malware payload", "value": "509b0a9f5096e913b271ccf066021c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485840, "uuid": "2ad1fb10-a3d6-4800-a205-fdc19fd43ffa", "comment": "Malware payload", "value": "2143cf7edff1acbd7920bb892f7a1fa7302a3f9e743b84b57073abc29a0394a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485840, "uuid": "3a7340ed-8d7b-4d9d-b234-12f182b759c6", "comment": "Malware payload", "value": "c05868db78a606e44219571794af831ac9e96121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485840, "uuid": "d3469297-ea07-406d-a312-dfb75b5a6161", "comment": "Malware payload", "value": "ba219f483932aacb5da22c1f0fcc0926f886212902f232893c92e0f78f53655aba9ccfd5128f253b01258c4525d75e5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485840, "uuid": "0b0eb75c-5f8e-42e1-a52a-2432dc74a03a", "value": "T156A6CFDAD16E44D29C053FC9A8142BC79B2447724A7400283A7FBD899F774FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485840, "uuid": "e25b64b4-22d2-4090-be8a-c8570a8426a2", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485840, "uuid": "119597d4-b9c0-499e-acf6-c320ddd38d4b", "value": "24576:rwkdko/Huh+QJqquMeUEQAItaD14HVichrvEEJplaC+QkftZO7TxVR2aIEfPNSIE:Tko/2L4JRZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770485840, "uuid": "1e9c13ca-883f-42a1-8b2d-e4bf3420d648", "value": 9679417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770485840, "uuid": "cd864dbb-96e4-4631-8738-096336b34e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485840, "uuid": "95e62f44-a61f-4577-921d-daf398168df3", "value": "MultiLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2a5cc3-0406-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1770456211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456211, "uuid": "0577b43b-b51d-4464-877d-fafdef21d3d7", "comment": "Malware payload (AsyncRAT)", "value": "6ab3d66aed4b2c80fa51c5e97b25e2af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456211, "uuid": "38539a05-a10b-4bc8-84cc-d4f658b069be", "comment": "Malware payload (AsyncRAT)", "value": "21ceaf2cba0005cb81f58f109e0d67344e48dac11d50522d85cfdca449313836", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456211, "uuid": "493e16e6-1d0e-44c8-8768-dff7e30174ce", "comment": "Malware payload (AsyncRAT)", "value": "ff4233d72708b0089091a1131d737a5e857f0602", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456211, "uuid": "3f9b14f8-f6a5-46df-86ee-800b800c34b3", "comment": "Malware payload (AsyncRAT)", "value": "9e225261bc3af0d81456d13f1402b335947479b8ca55d3b2dacc9fae71764fba6bc44b125861c5ee9a08e9386589c268", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456211, "uuid": "b523c5db-2bf9-4d8a-888a-0951e1d1e62d", "value": "T12BD23A08B3D48561E1FD57B94C7292048771EA4BA973DB9E2FC445AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456211, "uuid": "b1a2ab1b-f2fa-4171-981f-d895f02bdcf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456211, "uuid": "928ac567-663e-49d8-b44f-2d9734286c7b", "value": "768:DIjQRX55TOmqsg/cIRGqo+/Rb7fB/dTM/+:0jQRXHTOmqN1iwRbN/u/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456211, "uuid": "d8d929e7-1d67-43f3-a008-60bf03c93200", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456211, "uuid": "1658822d-3c66-4cc2-9d2d-a4bda691432b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456211, "uuid": "49de57a7-61d1-4f9e-aab4-0e149f017372", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fec8b44-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438824, "uuid": "6520016e-0131-4f62-ac65-113bc7083e00", "comment": "Malware payload (Mirai)", "value": "ace43b2f83e24a1f231501d75a8c9161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438824, "uuid": "fc61dacd-b5c3-4f56-8fff-15da30b28878", "comment": "Malware payload (Mirai)", "value": "23d6befa4e1f2b9dc933827a4c3f50eebda1d059e0481dcbbaf1ecf728950ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438824, "uuid": "0a6054e7-eb32-4839-bc9c-3f98fe021f46", "comment": "Malware payload (Mirai)", "value": "9e9ae324f69eca373af5756f52d62d9303f439a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438824, "uuid": "9f11f052-fc93-4fc0-a16a-561b4daa5465", "comment": "Malware payload (Mirai)", "value": "33c54a08afe6bf912bd2d0c7c28ffc55db85a2e8ef3c78fc9be9d4440e316b067d14e54a4ac4a6909c316c3e414a34fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438824, "uuid": "6531ee6c-b09a-4fca-98e7-0394f746a00d", "value": "T16FE33A85B8828A22C9D413BEF92E018E331367A8D2DF7213DD205F2577C756B0D7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438824, "uuid": "574d691c-bd86-4345-82cc-36072605a3d6", "value": "3072:lFja2in+qzpH1Dr5XsAQgGXLOWNplH9a6oOEzxXSds9ckqk:y2A+mpHxR8PXDpx9adhSdNkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438824, "uuid": "01922d1c-783a-4969-934a-098e35e56a04", "value": 157300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438824, "uuid": "f2f87ad3-2782-4ba3-aad7-31633c4058f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438824, "uuid": "42b6f081-0d95-41eb-93f1-ae481b32adfc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c253fad3-0447-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770484167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484167, "uuid": "598f2666-7b7f-4003-98e5-907ffb3de32a", "comment": "Malware payload", "value": "f969adfd080b0a48a7718f162fa1b46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484167, "uuid": "ce7543fe-1d53-4af5-b062-6f297d84ee6c", "comment": "Malware payload", "value": "2484a47385727ddde233600c28dfc34befc2eab654be9b0c624f780cc7a69558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484167, "uuid": "0f250cca-dade-458c-9f7e-69118aa01100", "comment": "Malware payload", "value": "61bac768333a95e167df9c92b46835479193eb4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484167, "uuid": "a4ec5fa7-a820-4357-8773-5fb419b6f2ce", "comment": "Malware payload", "value": "59b8f88534a45e1c3e3028440343828429763ec8893280775a83e0542daf7020941b858b2db7e89a356be51981045dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484167, "uuid": "4517b8b8-969c-4aa5-b1c1-9b166a003d35", "value": "T1B476D0CAD16B40D6CC067FF598142BC39F3056324A34046836ABBE585F779FA811EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484167, "uuid": "a3bcff16-e425-47b0-a356-4105ad94f495", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484167, "uuid": "02afc71b-31ec-4caf-bfb9-6bdf2490f99c", "value": "24576:chdjCOnn42rjefqP/gwqn3Vc17MT2riCbRqSblfbBhSdCHFR/Rzu8R6op7EoomGS:YJ2VH/NgOO5HqiL/6nmDgo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484167, "uuid": "98e996d4-8c84-4db8-a057-9d84b23b2415", "value": 7192064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484167, "uuid": "ec422300-946b-4236-9cf1-c6430b2cd8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484167, "uuid": "66f13ceb-c664-4484-bebb-177e5affe78d", "value": "37KKS9R5AOV0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f59a80-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466810, "uuid": "0b1ffe92-ac3e-46d2-85c5-116930487791", "comment": "Malware payload", "value": "957e3a1f6668fb0b477b68d5ff43475e", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466810, "uuid": "6ded873a-2a1d-4cd8-a471-f5c8cfd5a457", "comment": "Malware payload", "value": "26a706f0060a2c8c6871caec0d6aa84c032a3d141ea727720e0886725178f577", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466810, "uuid": "59233878-fbbc-48fa-b57d-6737d831dcb6", "comment": "Malware payload", "value": "60a7bdcbf7bcdc667991be0491500c9a4ee8a2df", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466810, "uuid": "405ccec1-b364-4102-a9ba-930d5751263d", "comment": "Malware payload", "value": "afaa0cbaa4e3138bcf8af2d70e201923957b87810bc5ad2aad539ac39a064539d60feee0c6c82a7081d9aa04c9f08102", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466810, "uuid": "e88b4e7a-b445-4655-9d8b-6497563390c3", "value": "T1DD4733C6E03D99C3DE63F03601946213FE67D2E0477262A494DB2BC3659FEF1A0B5621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466810, "uuid": "cfc667e3-abcf-4023-b3ae-1983428d7b1a", "value": "393216:Qqi/tT9RSe+Qjh4U7Ge3H/ctAs8IHS2Qqx4S7nzyKzZ671SqbAD/RVjj9LwYhPxj:QqeTorQX7P30tScQqx4S/v84wArP9Zh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466810, "uuid": "1eb86ad3-8dac-4853-8946-d3671f035648", "value": 25064179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466810, "uuid": "cdff51ff-0cf0-4fba-8b86-2000ff44e57f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466810, "uuid": "e356d7e5-06c7-4ca0-9d28-a1d68ef79849", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432276f5-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489108, "uuid": "00fec49c-6bf3-4773-9fe0-0a480087bff5", "comment": "Malware payload (Mirai)", "value": "e4dec0a7d078dba52b36672e462d24a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489108, "uuid": "60ce771c-b5fb-466e-b32b-6073d629bfe0", "comment": "Malware payload (Mirai)", "value": "27088a9718e161c269b44ef62f2fcfd2bb7581e49e53011e80aac79517873f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489108, "uuid": "6c03708c-9008-4af8-8836-41a489ab7b1c", "comment": "Malware payload (Mirai)", "value": "949dc528b9ee6198091dd23febd568bccb6d8d6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489108, "uuid": "ae5976f0-2580-4b87-b106-9681efb91187", "comment": "Malware payload (Mirai)", "value": "be1fb4752cd511e174383dcd73b6a8cff7a32f652b8c1e270754273be58b9c493a6aecf341bdc91ad4ae86b4814d00d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489108, "uuid": "9c12a9ed-49ee-4da2-b56e-b5b4c0444114", "value": "T143E48D98FE4E3D42D2C7E33C9F8987A1212B75E5D32392B27981025DE4DAEEDC6E1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489108, "uuid": "457bbb70-3e66-456d-90f1-3f6b1d47979b", "value": "12288:wIr5YzEyv/6eftzNWFtID6UUTHoDhincrrIs5s1LFe:wI5YzJvvNjD6UUrSh2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489108, "uuid": "994dca6f-20bf-408e-b5e4-95aae550a101", "value": 719264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489108, "uuid": "a6e47e93-e81d-4869-82f5-1842d3c6e320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489108, "uuid": "dae18bb6-52cb-4790-b653-70163f6c44e1", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885cb1d9-0445-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770483211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483211, "uuid": "c30c653e-54bf-47c3-8122-4bc4f2f822ac", "comment": "Malware payload", "value": "b08954afbcd3794a436e034420f2a21d", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483211, "uuid": "a7be01f1-21ec-4742-9bb5-ca617513d3b3", "comment": "Malware payload", "value": "2918032e6903dc2ec091d7de6e1a300944bcef478c3f5373ae105c69f2c1bb5c", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483211, "uuid": "695e6c10-d275-42b7-907b-dbbe39849209", "comment": "Malware payload", "value": "2be63c828566f65ea9d2fd53214eaac4b9c464a9", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483211, "uuid": "f6ce4e45-d21b-42f8-945e-915d03c3bb20", "comment": "Malware payload", "value": "688fa5950f82ec1b0542bc007eaef44ccd271b1b4664e90e59370d3ffcd7b6e53f1a7aefebcdf3ba403a4f56b58b716c", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483211, "uuid": "5d1a57a2-4aba-497d-99a0-a2af4a82ec8f", "value": "T1454633B6C3DDB4DAC97A0BFCBE2A453C529F6FE8E50A7B500074924993CE160A89D315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483211, "uuid": "6c06d0fd-3685-4e6d-966b-2fbc5a560538", "value": "98304:zSzM9NXdnrL+N4gga16AOUPlxcI3ReHm3wuLuT/z58AdMwFogw6IP0u+xAB6:4M9LrLFpA9N/cGAuSTN8iMwZgMumAB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483211, "uuid": "20f883c0-fa0a-4d81-9bef-6147c408432c", "value": 5508064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483211, "uuid": "247b96e1-efa7-44c1-968f-643d2091175c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483211, "uuid": "1189aaa0-d66e-4472-93d2-4a4b8ac68c12", "value": "\u0412\u043e\u043etst\u0430\u0440\u0440\u0435\u0433 v3.40.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0237dda-041d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466151, "uuid": "7c5d9bc8-ba32-46a2-a87a-444f8da66c77", "comment": "Malware payload", "value": "94077459985fe0fee73f4d2653233e46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466151, "uuid": "200e17cf-6f1b-4204-8c6e-e4b5ac06f72b", "comment": "Malware payload", "value": "2a5b15845204697f5e7ca6c518b3c9b8e398d6f4d843b7b76608e0f830f56e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466151, "uuid": "5b75b8ce-1e45-4f22-a8ed-0e6d4969f651", "comment": "Malware payload", "value": "62e6c2c0f8ffd9d35644d881275b5bc377e01625", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466151, "uuid": "9b7f9cb4-f5fd-42a7-8128-519b972ec5f2", "comment": "Malware payload", "value": "52d67773a7e5c96fe768cbd5f89717d1e66b8c512ae735b284cc74f8587269d639cb953bd68e55c74d68a9ec88eeea9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466151, "uuid": "74a5eb6a-b8c7-47a6-b2f4-ae609fd0912d", "value": "T1D3D56D0DED618B61C79003BA8AF816841371AD035BCB571A9334B778FCFAAD4DC896D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466151, "uuid": "3938aa18-5f26-4574-85e0-a6a74d0081b2", "value": "24576:Y/H8Uyb7bspzFOuCeY2tBE9v3EljntvRohexPPRa1kYqU2hpdIn:Y6beY2dRnPRTXdIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466151, "uuid": "731a50b5-253f-4c1e-8bf7-0570fe4349f4", "value": 2887847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466151, "uuid": "fc4f8464-e728-4be7-822e-5de34cce0029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466151, "uuid": "6578d0af-a3e7-498c-92e9-78f6d6ea1958", "value": "bizy.riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbaaee0-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473345, "uuid": "2b689d7a-c9fa-4f47-b87b-3b366dc5fc55", "comment": "Malware payload (Mirai)", "value": "d49749669d6776e193a398baba7cba7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473345, "uuid": "bf277628-a39a-4b8f-aeb9-55e8a0b32e48", "comment": "Malware payload (Mirai)", "value": "2b0081eaf8caa5b78fb46d6ee3c1cba53a525ba7f68764b70b7f4e530bb150a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473345, "uuid": "eecdb3eb-1334-44a3-aeb2-b70a051d37ce", "comment": "Malware payload (Mirai)", "value": "f582a2f1d8dfab6ec8ea272712da5cbb7c521d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473345, "uuid": "41630d49-69a2-4fc4-b474-5d724fb7b11e", "comment": "Malware payload (Mirai)", "value": "206e7a70caace87cace9f76a0a6dfc442290ebd4559eb085f7c57b35f108d7eb04319bf622009930d79b9610b2966fbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473345, "uuid": "f83cbf4e-a752-462b-a741-39f6148f72ca", "value": "T1A4233941B709050BC2E35EB03A3F2BE687ED9E4220B4B2497D5EBB459271E32504AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473345, "uuid": "3c8ed5bb-f180-42ce-b38b-318a7d55d511", "value": "768:8uJ6bHXrYQHnlT+dFKTSMirkvJUg7XOfQyp4jsKqNbGj94+QXRhTwyHbSBjjuNgJ:fJ6bUDKTSMirkvJUg7XOfQi442QRbAu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473345, "uuid": "16105e44-41ff-474e-afb3-005e78e823fe", "value": 47052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473345, "uuid": "ed8e359d-f776-40b0-873a-232819c0b41c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473345, "uuid": "8fde129d-8dca-46c2-956f-fd9707091716", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b23265-0412-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770461434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461434, "uuid": "ac769a13-1228-41ad-94b1-7c8f440212a7", "comment": "Malware payload", "value": "734e7204df7253826f9afeddd4094fc0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461434, "uuid": "f7954ae2-8b9e-4fc8-9526-e556aeba444a", "comment": "Malware payload", "value": "2b930dbdcbdbbd3a61be96c8f43782bbd86d55aa958098a728bc77057e21ff8a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461434, "uuid": "6e1bf97a-38c0-4bf0-a7e3-e9ea74c90001", "comment": "Malware payload", "value": "de456bca0d7d60b035b067c38bad8793816024b9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461434, "uuid": "39d20847-77a2-4bff-873c-60af84b3ec7a", "comment": "Malware payload", "value": "25268cae664ea9a80f6cf98f5be73e9d2dfaf5f88e1caaad05de65770fa067d531090be88181d4c9eb5373ebc966bf26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461434, "uuid": "1c33c608-9cf4-464e-91d5-0ee423e24823", "value": "T105D0229900B431B898E298057AE68056C040EDD258AB3FDCB9ED48B8808C428F3013CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461434, "uuid": "82320e65-ba02-4689-8df3-2e9f4bb280b9", "value": "3:hjKVBi+lTLTeURJU6d3dUzOdyeTR1LzeURJUvWwlVX3E0PsvyIDvYq+Sn4jKYN8b:oVBimfs236+RNzLsvWwuHNbRYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461434, "uuid": "774277e7-8c13-4ba4-b9eb-0e5976563aef", "value": 203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461434, "uuid": "4ecc10c5-a81b-4ab3-80a5-499eff3ea730", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461434, "uuid": "f91df81c-6862-45a6-a4de-ae930274d56e", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65628db1-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461677, "uuid": "5b13d7de-5dff-4d1b-93f1-543cccbb0184", "comment": "Malware payload (Mirai)", "value": "93098f60b1dd4320ac1c3ff05bb3016d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461677, "uuid": "aefbb216-875e-4245-9e3f-73969477d23c", "comment": "Malware payload (Mirai)", "value": "2b956e8f27ae6efcea89c14debe8f72500ef3ad69eecc3699a2759be2db6884d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461677, "uuid": "efd5fd26-a8d7-456b-a3a1-50a07fec2226", "comment": "Malware payload (Mirai)", "value": "7f9362588d818cb3115b64874fa7ac79514ac763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461677, "uuid": "47cf0994-9655-4ec2-b998-eaf015c42a08", "comment": "Malware payload (Mirai)", "value": "21ab19f0d4434f24276471c257e3dd5a510160cfa6411e06027aa547cff633888b7e91426d32efac7fdac3d5779d65ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461677, "uuid": "2d6a9f79-c9f0-4115-84a4-885553cb2605", "value": "T186A533D5BBC22E8B51F51D84C88C8C65C083AAD36C5AFC9396A6FE4E5D8127277700E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461677, "uuid": "f2a7a1d1-9dc6-4cda-887e-c7dacd9deb38", "value": "49152:0VNb9N2pq6gn2xx7n2K4btNSlJPVghJe9:8NbIqUxD6btN+JP99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461677, "uuid": "00aa509e-f7a7-4b87-b1da-85c4ec21d105", "value": 2086920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461677, "uuid": "ddb9fc83-9d08-4085-8902-283a8c7a0965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461677, "uuid": "caff49d2-30c1-4adc-9864-978e5f2c01f1", "value": "mdsync1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4dd1cd-042e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770473341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473341, "uuid": "73f026b0-ee5b-43a1-af17-73464af41f49", "comment": "Malware payload", "value": "a2415deba480779fd826c3a090d704f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473341, "uuid": "de6da9c0-6d1e-4b39-b27d-cb8318ee5140", "comment": "Malware payload", "value": "2c66263aaa59d8ea3bc0c80541c514f8d442447638eb4966e2ddd892898be1f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473341, "uuid": "7d9637f8-f179-4f38-8751-3115f689bb5a", "comment": "Malware payload", "value": "f8587b5832b783a1c9b7ae4aa6002f91c67bf06f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473341, "uuid": "134ff253-af1a-4518-b131-b4967aae62f8", "comment": "Malware payload", "value": "feb93af4a116a60f19c278886ef53f34ee09d49f2ad4a8d89c57ade790aa263de2e1a814be56879c3fc71ee8a4a2189d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473341, "uuid": "cb5b6b07-2576-41b9-b0fd-a1d28c808ed2", "value": "T187F04C6F05E26077BCCF90FAB706624E484592BEEAFC4A90A653347B9D3A50430E3A00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473341, "uuid": "45807dd4-4d9b-4b59-bcd8-90cb1737a94f", "value": "12:CGKUsFhjrM3/66N1Q2FO/daFFoY5girv+wFF/qFg0Lmr9FHGLG0TWq77:CGXk23C6N1Q2F6qoYWzwFF/+gOi1AJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473341, "uuid": "2ec4d976-20de-4b4f-badb-9989890fb530", "value": 561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473341, "uuid": "7e195efc-29ad-41f3-8198-d695076c4af0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473341, "uuid": "cecae64c-2839-4ec2-980e-d1d383adfce5", "value": "load.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e53f41f-0446-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770483435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483435, "uuid": "00324c85-3573-4d6d-adda-46fee3d5c181", "comment": "Malware payload (SalatStealer)", "value": "061f96f041508aa1b85f9122db1066c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483435, "uuid": "f9af49ee-253a-49e0-a78f-ed2a0aa0ad96", "comment": "Malware payload (SalatStealer)", "value": "2c746440fdbc6b811caf076055923969edd042bc9ad3fe0b819b2d98440a8009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483435, "uuid": "3603070a-f938-401b-a8a3-c9e488bde93a", "comment": "Malware payload (SalatStealer)", "value": "2284b8e6f6154e3ae73db3135ed76aa761f573d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483435, "uuid": "28f191de-88f7-46c8-98bf-15c53de1656f", "comment": "Malware payload (SalatStealer)", "value": "f075e6fcae3a4a0ecf9eaa695ba88eec4fd1d101d943e1db7f2894c23520c7a8a97d0bec58eea6dbd28b5358815ec10a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483435, "uuid": "53f32589-19e8-4167-91bf-d66ee4a12ad7", "value": "T10AE533B6FCE64354E9ED0534A4E2118854E3EAB5532AD0DF33BADC07782187213D96EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483435, "uuid": "e11acb22-073d-4adf-b1ea-e61c22a53a17", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483435, "uuid": "69252187-bcd2-4aae-98ae-f1f6b9ba9495", "value": "98304:X5vxkRoMzC10SYVgD9p2vh8LjPdP3szg/4mkbQ:hmRFe1IA2vh8/98a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483435, "uuid": "67df57b8-188c-429a-aa6c-0972bb45a3c0", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483435, "uuid": "342677bc-c882-4f44-bd20-79b6b0407cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483435, "uuid": "f2e28c5b-20e3-48f5-9683-9a16cb330077", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411b1e70-0440-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770480944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770480944, "uuid": "cdc8f968-ec25-4202-b3e4-d2e8fe895c95", "comment": "Malware payload", "value": "2682c661b8b2e7cb051974843d544842", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770480944, "uuid": "7ba9488b-350a-4291-96f3-92674257c571", "comment": "Malware payload", "value": "2c7db9d7977e0de038fe6cac5d224553322efd751c301305f82e61bf50c7100c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770480944, "uuid": "9e8bf913-dd73-4d67-a31c-c593df98df33", "comment": "Malware payload", "value": "13894a76eac28af01917eb9fb886b127f2b2f9ee", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770480944, "uuid": "47eed469-f791-4545-b63b-05764ed66db4", "comment": "Malware payload", "value": "93fed087a7b7bbd54eba7c1eafb839c7595b7cb0005418e70dc97d0e48c7ec491adcd6a26bd713dbdf148d993ed24655", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770480944, "uuid": "a3af5805-5541-410d-b89b-8e143d8feff1", "value": "T106E501DB0C9606BAEB0DF93060BB7B7D972B987C2BD7AE0D914F7C98033254C4A15885", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770480944, "uuid": "745477a1-a5cd-4a10-9eb1-4c79b9979fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770480944, "uuid": "66c334bd-de3c-4d68-9c22-ff35b678179b", "value": "49152:2y4BodauVkc0sEGv4zPs5mBfjz4xmjptSEcsD75UpyilUG7ZL99OdyoIWza:j4BodnVkc0sEGgzPsYjzDjppcQ75orlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770480944, "uuid": "4c48c365-0df1-4207-91c8-879711a64a13", "value": 3059200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770480944, "uuid": "2cb6579f-e069-4144-861b-d91996098025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770480944, "uuid": "af8b6b0f-f324-4629-aac1-c5d43b9cf416", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0b487d-03ec-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770445072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770445072, "uuid": "4f95ed2c-1219-4310-ae51-aada027c8b3d", "comment": "Malware payload (Mirai)", "value": "953521df65e8a370d3b837550dff766d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770445072, "uuid": "fa79d7d4-c3fc-4611-aa75-ec64638b9f75", "comment": "Malware payload (Mirai)", "value": "2e5677abfe0d9bad34ab3cdc9f88e8bf936137f543db58b7359e98742c8b16b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770445072, "uuid": "17bf3210-bc6c-4585-95f7-103d2b53ab76", "comment": "Malware payload (Mirai)", "value": "47466379864184dd0453e37354caed83b1e6035a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770445072, "uuid": "3ed2da09-4407-4d1c-9c76-f44f5e405596", "comment": "Malware payload (Mirai)", "value": "c926753d18143c3d3648ba95ad440370bad25fe1fd71497bc42874c1d7a5103123fab018e2cb0ccb5a0f74a7524fc141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770445072, "uuid": "ebde7083-2628-47df-acc5-e0d08d7a398f", "value": "T1DD11104E32C109B709A9483B27F202BB9545484F47C0C474BE9DD1E5FFCC4B2BA999C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770445072, "uuid": "4f895812-1068-4c2d-8049-8d0983407c11", "value": "12:0IuTY4X1S84DyaB3Kb+P6m4vOJ+ug8KIY29vrpRXCZSD3oxA8ghZS4xuutJijgN:0xTYg1S842aE+cGww9hrrWSDYYS0uQPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770445072, "uuid": "2b1757fa-ca9b-4f0f-b1ec-32806182825b", "value": 986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770445072, "uuid": "43009e07-293d-4068-a7aa-e53f0f26e653", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770445072, "uuid": "1ecd5406-65d0-4d78-a47c-3694747eb200", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733a24b8-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466854, "uuid": "c7b53b38-f682-4607-90ba-034153325183", "comment": "Malware payload (Mirai)", "value": "69147bae010b3bbd1a15a0cd2fdc1e89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466854, "uuid": "803de84a-69fd-496a-813d-31160e4b8195", "comment": "Malware payload (Mirai)", "value": "2edc3ec169ec70a840664afed3ed249dc7c7e665f9c8bd9e1f781c6d9b9e8982", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466854, "uuid": "17188bd1-69dd-45cc-83c6-a551ef437a6b", "comment": "Malware payload (Mirai)", "value": "88d6ade2d80d0b6615436459733d8647094dc4ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466854, "uuid": "0a701da5-3597-420c-8647-7917c501c65c", "comment": "Malware payload (Mirai)", "value": "a9136cf10d627958772b361aac2520a5114dbe0552b5397039ff051ef85baa33747f73d41d8429c2fcfd03e07e5943d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466854, "uuid": "c46aa574-3d52-477b-b0d1-b852843022a8", "value": "T1C8934B13B9C480FCC889C13047AFB536D923B57E1279B25F63D4FE167E89E512A6E680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466854, "uuid": "0cff2f0a-c16a-4b1b-8327-51fdf174ea55", "value": "1536:ZlxxYjnaT6lTu4jb4iWFtyEyBAgul1R12OsJRGn55PqOlaJHGav:ZWjnaoT7jUiWryBol1R12Os7S5Pq8a4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466854, "uuid": "417679b8-0759-4f5c-8752-6b4df7ef0b7e", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466854, "uuid": "3ec377d1-2359-428b-bd36-57acc6d3d0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466854, "uuid": "56aa1559-fb25-4b89-9974-06c3701f7c35", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313e52c0-0407-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770456436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456436, "uuid": "889ed90f-f52e-4516-a188-428f5a6af2ab", "comment": "Malware payload (Formbook)", "value": "71b6942c29f42bb75d152e46ab81017d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456436, "uuid": "a2de6f53-a4ce-4653-b9b1-37eefc6a9300", "comment": "Malware payload (Formbook)", "value": "2fde3e4edf441c75f98cd62373bb39882c1f5b1412f4e843a5e095d3907d2d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456436, "uuid": "857d3d78-b1fc-4216-85f1-42e316acba1c", "comment": "Malware payload (Formbook)", "value": "743e2d2bd7f8b14759323088b36102b804d7b8d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456436, "uuid": "ab7eb3d9-8fe8-4e5f-9514-43e544485621", "comment": "Malware payload (Formbook)", "value": "7ccb34336864fbc1053aea93f536c943c435998e9d92cdc7dc2b6c21404da6c827d1f29e66ff9d9aa4fe6d6b675a3a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456436, "uuid": "dbf0d1b7-1445-46ba-936c-a9fa859f2871", "value": "T10D45CF0273819062FF9B91734F56F2215BBC7A260123E61F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456436, "uuid": "fdd51d2d-20b7-45ff-8237-6422d6249c5d", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456436, "uuid": "814bb921-163f-450c-8071-5764635cac39", "value": "24576:P5EmXFtKaL4/oFe5T9yyXYfP1MAXDz/gpjapY8gU/Vpwe2+u:PPVt/LZeJbInGiz/a0UyVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456436, "uuid": "75710142-da89-4772-845f-2943e23ed836", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456436, "uuid": "1d8dbd20-59e5-4dad-9e18-c90fc18a671c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456436, "uuid": "f9ad08ee-248b-4496-b5cd-6a80561a7b90", "value": "SecuriteInfo.com.Trojan.Inject6.25253.18879.19097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c7efd3-03f4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770448256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448256, "uuid": "58251a90-fca9-43d7-8096-0ce40f61a9ee", "comment": "Malware payload (Mirai)", "value": "e5456cd49260ebf4d6c16f1e02af1bbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448256, "uuid": "c656a5ac-4079-4a37-86ba-df71f9abb6f7", "comment": "Malware payload (Mirai)", "value": "309fecc658eee10436832b982a0468a248f46caaa18e001b8fe1bf60bb9a5f87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448256, "uuid": "4f4931ce-f23e-41bb-9790-57a519319f2a", "comment": "Malware payload (Mirai)", "value": "fada342b6bbfe7304c2529a29403628b54b18ee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448256, "uuid": "74ad3b22-9646-4915-a19a-29791326fe72", "comment": "Malware payload (Mirai)", "value": "1660b9eb22448b34fb61ee22ed11e0a5feee2219a7a169e5c9af7bc390e0d60f8c816ffb99cd9ea78623dc4a5b8c3c33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448256, "uuid": "9a7d4c02-557f-425d-bf22-ad63ea370f10", "value": "T10DB30846EB408B13C4D51779B6EF42453322EB55A3DB73068918AFB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448256, "uuid": "0b3b7bfb-4025-4384-b36d-285f320b8a80", "value": "3072:r7st1KSBgE3Q3ihXXrPlGI2X26iM/9E5m:r7st9BHg3ihXXLlsX2PM/9E5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770448256, "uuid": "c3f68507-d34f-447b-b7fc-737cd0d43b48", "value": 114187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770448256, "uuid": "af3d69c5-3cb3-4550-8705-bae50eb94278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448256, "uuid": "e735416f-30da-478d-a20c-89646364bb63", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a920701c-042a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770471669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471669, "uuid": "a13c3abe-fe81-4139-ab8d-7d2df53e0d75", "comment": "Malware payload (Mirai)", "value": "d56308bf487c0242820edf0aefe33f16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471669, "uuid": "2b7af947-6466-44c0-a623-7346b1b6dff1", "comment": "Malware payload (Mirai)", "value": "317c7fe5b3fbe20f3b15f1749d0cbd399bed012c84860a645cdad536477d003d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471669, "uuid": "87c8b93e-ecab-474d-bb54-50596b8b7951", "comment": "Malware payload (Mirai)", "value": "6460158c0c7c464031c53c657e1e5d6d2b5e5547", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770471669, "uuid": "0bb52f0b-6f88-44b9-82e3-a6973482ece3", "comment": "Malware payload (Mirai)", "value": "d0c3938d0e8e70a994876737994b6a32142267feb77582cc9fd9bf503854273887d93e02b9ce42f017914448ee32f2dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471669, "uuid": "4a718c17-893f-4823-ae7b-d8ac5e20b79f", "value": "T1CF61F1FC50E0EEA3CC45A90CBE698351930382E7AC71FD7C5C694676488071A39EB7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471669, "uuid": "adf016c1-f20f-4a2c-9f77-d350b07df8fb", "value": "96:mwKaAAtgBIC+8Yy8O5SZYz0zmk24SuMS4k2wSQ:UQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770471669, "uuid": "229e7ccd-699b-451b-93ad-ee26b1db4692", "value": 3241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770471669, "uuid": "dc439371-1405-4107-9da3-80e979b052f8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770471669, "uuid": "fbc09166-aaa1-45dc-9425-0787131512d5", "value": "mao_http.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d61c511-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461691, "uuid": "a470631c-63bd-4fac-939c-7afeaeede468", "comment": "Malware payload (Mirai)", "value": "9509da458bf067564a057a6bcebc3fea", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461691, "uuid": "fbfe8ce3-4090-4cc5-8334-230878f22c7d", "comment": "Malware payload (Mirai)", "value": "31d837a7404819b3c5ec42eb2174f087747ee305ce8130e992e783be6ce12ac5", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461691, "uuid": "eeb3aeff-d91d-4024-958f-71095abe79b3", "comment": "Malware payload (Mirai)", "value": "33e17d83778ac8bc5b7cfae659d5710d43fa76d4", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461691, "uuid": "d4964012-6211-4cce-b07d-a8c097722779", "comment": "Malware payload (Mirai)", "value": "3787d25e45f13ec385193ba362c627f1c1161106ec27eb7d31b5680159bd10361d6fa3b6bf312963d12525a20772dfba", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461691, "uuid": "30a30739-514d-410e-a68e-9354f2d4a458", "value": "T12F962A51BDC65B26C1DC037884FE625972A43E055A95032363F4FBE83A77B3CAF5A848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461691, "uuid": "902c9005-b599-4416-b0ba-a2329c3de322", "value": "49152:6wPquCLn/0T+GxSt//7nA5Y/XJmf7CHVx2uQT78yvYPq+9bW4sXC7g5EX:6yxCjMT+Gxs/7nALTcbsXCOEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461691, "uuid": "3ba1d73d-3e15-4a73-b703-d42cfbef2568", "value": 8913080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461691, "uuid": "43575b12-e92b-4de5-b612-b3c50d68345c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461691, "uuid": "f6f27f4b-a778-407f-810c-a06cccd07cb0", "value": "biosd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a011f3e1-03eb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770444596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770444596, "uuid": "aa9fbb52-3418-46a5-98c0-4be7975cd3d5", "comment": "Malware payload (Mirai)", "value": "4587160621f002b318b71a60d86b876b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770444596, "uuid": "c31faaeb-8b5b-4e77-a0a7-c32233f84462", "comment": "Malware payload (Mirai)", "value": "31e9e337bad2ad58ecc00d3056047e61f6df5d09be02df5e73118d1834ea6cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770444596, "uuid": "c05621be-d6a5-4d60-9240-74f09fe14d9c", "comment": "Malware payload (Mirai)", "value": "5ed66bea47b1e5b07571827a95cfa2529f36df5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770444596, "uuid": "2971ec99-350d-4a21-978b-8b785a69a7ba", "comment": "Malware payload (Mirai)", "value": "488354acf26e4c2778985ed5e99e45cdff6533feff1d0acd5d553e31e3a7337e7c6d8c98d1dcb76124e3a98b75519351", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770444596, "uuid": "22c829e5-a701-4d92-ae14-726a05f0f7a4", "value": "T116D44A55B8419B95D1C06BBBFF1DA34873132B38E2EFB1069D186B246B9BC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770444596, "uuid": "f0a99731-fe97-4c39-9be1-f7ddd8402932", "value": "12288:r+tkWziqHcEdgyAgXJHC3oSvEaK1RoGB5gCpWPI6VQ0nfajyAsm4bfKjC88G8h2b:rurdgylJHCkEGBOI8Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770444596, "uuid": "85928008-f62f-429f-bad0-12c08829288c", "value": 605596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770444596, "uuid": "c89fb498-58eb-498d-b6e9-ecf46e6fc17c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770444596, "uuid": "9d4906e3-e849-4ae3-a951-859540247070", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0efba67-041d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466153, "uuid": "af916c6d-d775-4797-94bf-b056307716c8", "comment": "Malware payload (Mirai)", "value": "b64422c0748ddd63f5bd646d9ebea461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466153, "uuid": "bea4db3e-8416-490c-9d6d-e877bf1988b9", "comment": "Malware payload (Mirai)", "value": "320ab7af5ae2d01e2ddbe6b097711fb2f08794d9298a686863f44003d9c3549d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466153, "uuid": "f4330c60-3141-44e9-9a36-90134663ee48", "comment": "Malware payload (Mirai)", "value": "75978c02ec1861fa86865b857ec985afd818b965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466153, "uuid": "f0291c9b-3cf0-4c20-aeda-e1f7f5533d40", "comment": "Malware payload (Mirai)", "value": "96d0c6ba573a81421c6b28f880ca2e8f4c0185978623d8b4e0ea38c24511857b6095821216c39f0ded623f4f83d160b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466153, "uuid": "6110e316-4b2e-4bba-8b45-08efde2556e7", "value": "T11D63189ABCC5C202C5F0A1B2BB1F55CE375643B8E3E2B147CD196F29674B8A70A37251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466153, "uuid": "fde51e69-fd12-42b4-89f2-bba1a3996e13", "value": "768:/0ou07m5xta0/zTplkrSVhpdLrdpcQpxbCqjQA7uKS1bJuix3Xrp1TtFih0g0klN:ZpjkrNKV2l1gkRHgt4XeX5TaLNe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466153, "uuid": "1aba14e9-25f0-470b-99af-875b6d14b6c9", "value": 71276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466153, "uuid": "1270b809-b118-4b72-9c34-0af7f66fa251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466153, "uuid": "ad86616a-a676-46f5-a231-0ab791633da1", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67141876-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461680, "uuid": "3464906d-3b16-463c-8be7-dbca7d4d907d", "comment": "Malware payload (Mirai)", "value": "7269c1ba93d554e183b39a5b31e3aea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461680, "uuid": "f53bdafb-d02b-4303-b23d-481ce83618c4", "comment": "Malware payload (Mirai)", "value": "337b3501a8e5c0c935204ab5382717f41f3d97eb0b1d8c09884f8126220b0ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461680, "uuid": "2377b01e-2425-425e-b74f-f45eb54115d3", "comment": "Malware payload (Mirai)", "value": "2ea1f454660a4c556d0b87c1aaf628188a243675", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461680, "uuid": "8736b23b-6a70-4f2d-b6f0-4c7c51985790", "comment": "Malware payload (Mirai)", "value": "8272fa4fdce3789f00a069619eb8d9c02303b1ba6f8f5f26966e42c6c24ac74be022a99ad215781608e8e4b03588effc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461680, "uuid": "ece7235d-ba7a-412b-9389-b3f09c90d6ac", "value": "T1C6A533EF410337178B2B9A75054252FECB0DBEE7CA76A2A49E29178ECD3235D2C04791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461680, "uuid": "36561cc5-e861-43ea-815c-344066ab720e", "value": "49152:RrVLWf0+oVeZaSBhjmnXupr9r3rY3QwrWW265rg:RrdW8+6ABhjuupJrY3rT2gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461680, "uuid": "7f80f403-ae93-4ee9-8259-83a63911d4b0", "value": 2077504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461680, "uuid": "64053531-8929-4c8f-b293-7b3f9233b79d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461680, "uuid": "2d52d3f3-3348-4412-a55d-d0e7aaedf43b", "value": "ip6addrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a604ace-03f7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770449687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449687, "uuid": "a1311827-347f-49aa-bf9a-4435b88b0d3d", "comment": "Malware payload (Mirai)", "value": "84f58af6888cac4b249c5966522a6a1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449687, "uuid": "1a2d7eca-90c0-48eb-acd3-5f70f2621825", "comment": "Malware payload (Mirai)", "value": "33a3041d5f71b196b0de6ddb450b0be216a93f0b297765160fe345c3c5b03d0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449687, "uuid": "16ba23d5-1acf-4a6c-af47-580c53001c72", "comment": "Malware payload (Mirai)", "value": "ac512ff0d8f4771b67348718d2eb4e4ea4d3b4e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449687, "uuid": "db31ed64-67cb-4a4f-90a2-35f2cb89bedd", "comment": "Malware payload (Mirai)", "value": "b4745671f73e5712a2625a6f81fb90d63dce0cb275118171e61754f882cefe983d9492421873b59bd8e3060297c5d0b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449687, "uuid": "c8f3d2e0-74a1-4d10-ad18-1b260727a569", "value": "T12F335DC5E643E8F6D8574131217EF7339E71E1F82238EA53C364AA31BD52A81A507E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449687, "uuid": "d1d932f3-5206-40a6-82df-5c011b297491", "value": "1536:0BillLDUzYvdm+bv3OCvSk9pOvRLD8LCS/:AildDgYvdjbv3lvSAp8GLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770449687, "uuid": "5f861faf-b752-4986-868f-22aa274755bf", "value": 51792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770449687, "uuid": "e8b2dbb5-3fb9-4c3c-b483-97584b19dbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449687, "uuid": "37252d19-79c6-4995-a6ca-04928449e0a6", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91671698-0410-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770460463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460463, "uuid": "6cbec584-5029-4c01-944b-b87a42de1415", "comment": "Malware payload (Mirai)", "value": "c368d4a8e993427ba9022ac438006b52", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460463, "uuid": "27e6f9ab-419d-4508-a200-5ce0f015861f", "comment": "Malware payload (Mirai)", "value": "351a8fa35e76b7a0f8363fe0267730f8f778d31886b0473876a88c09731884ed", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460463, "uuid": "4a52aa6a-399f-4bf8-b931-6950837886d1", "comment": "Malware payload (Mirai)", "value": "b972a707f6713e2d329df14a0f7f8e1bfcbc3a75", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460463, "uuid": "8e820960-2f9e-4b3f-b904-24a623dd47c9", "comment": "Malware payload (Mirai)", "value": "2a9f22a9f797be95ad74332d3dce010270b05b34e08e423d7b91e00524df7239a6b979424340c112ed734a02331f31f7", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460463, "uuid": "aef6a0d3-23c3-4a74-9ac1-5326294044db", "value": "T13C861947B8924982C5E83A37BCBD80C833631EB99B8756566D05FE3C3ABE1D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460463, "uuid": "70105411-610a-43f6-a9f3-8cebf2ffeeba", "value": "49152:SFoFXXVS/v3g8tNXdS/xmWl4NONsUI7nTC81IgDWAvdEZ9HnTl+g5Ed:ko9gXQ2REmYckAvdEZtTlTEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770460463, "uuid": "77157ca8-251b-4245-a961-a5f4bfd68aac", "value": 7864504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770460463, "uuid": "7f55d215-a78f-4d46-ad21-f28db6d1d288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460463, "uuid": "d1a906f7-6b6c-47b3-8874-2f2910f4293d", "value": "kswapd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c951ba-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468198, "uuid": "bebf240b-bc7e-455c-8f79-a857bdcd639e", "comment": "Malware payload (Mirai)", "value": "7050f374e95074f3ad0d41cb27d5d86c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468198, "uuid": "e557d718-e751-4e28-afe4-33d9c28f68d7", "comment": "Malware payload (Mirai)", "value": "36638edf2609401f1c62191b689f7fb99fbc56c0dc9ebc642f09210a99e36d7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468198, "uuid": "be952f5e-7adb-43ab-b433-ff128605c9cf", "comment": "Malware payload (Mirai)", "value": "2ec8d483e23fe5e4b26cced516aaf5d15a63afd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468198, "uuid": "cd5448c8-6d66-42a2-9c59-7ed1eac5d9fd", "comment": "Malware payload (Mirai)", "value": "62fb4b5e8633a4344a1b36f005beb9791aaba41f0add5514baad7210654c2c94762b252b9ab23a263b93e1797bec9af1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468198, "uuid": "da08ddaa-76ae-4bf5-af38-5d9d17eabde5", "value": "T1C8736BC5E683E8F5EC120A75217BEB339673E13A1069EA83D3B56932ED40602B51779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468198, "uuid": "5d09ddb9-dbca-4cd1-80cc-0a493374858c", "value": "1536:49nVHs+ycR8HzzuTG39jIsqd2TDBxIe5M8s6W0kw:etF3R8TzuqNjVa2TtxIOjsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468198, "uuid": "ec2a7881-0d78-4e66-94ea-31dde1718553", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468198, "uuid": "06f247f8-e92f-4fa2-b47e-03cbb46e7f11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468198, "uuid": "e9c98b6d-e86e-4361-b309-8bcd14647806", "value": "binary.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2bbb02-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461689, "uuid": "bfe16b3b-7f69-4a89-8957-9724818c8595", "comment": "Malware payload (Mirai)", "value": "060c7a0d225a481dc800f8cbe00445d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461689, "uuid": "2d0c480a-7b1b-4251-a651-26b58368f38a", "comment": "Malware payload (Mirai)", "value": "36a1f476383b061b49cc48bfc8fa14c117269daa82f856540a3b325df1d6042d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461689, "uuid": "959551a0-e1bc-42ec-802e-80e803fdec68", "comment": "Malware payload (Mirai)", "value": "5475a14799173820dc82244db6373f6a0f377650", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461689, "uuid": "c120e096-52b5-4ada-af4c-3054b58523d0", "comment": "Malware payload (Mirai)", "value": "5fe6ec337f5b4265647a190c480532d8f6009eaa3e6f9b70c614e2b471a04f23c39acd10047d09fce0e5066fcf2a0d96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461689, "uuid": "7292c36a-7ba5-4b92-b6a4-036800b29963", "value": "T13FA5332082056096F157FCF1BBB8571942F9251C58344326AC42861AB9FFCAE6FCE36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461689, "uuid": "9ed5249f-94b9-4a92-9080-6d32e050cd1f", "value": "49152:z+Yq+1KTnoAS31ByDneQQHts/J1ZvPi4dsCMIzFaZeMeNoM1:z+Yqlr5DnymJ3vPiKVRZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461689, "uuid": "9c2b37e2-58af-4f6f-8251-b972971a2450", "value": 2228888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461689, "uuid": "f6dde91b-7b78-430c-9568-8b0f7786944d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461689, "uuid": "7ac212d1-2120-4e9e-8f78-058471bab3c8", "value": "kworkerd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e886f0-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770467025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467025, "uuid": "4a40d214-493f-45bb-a373-65df1b9fa57b", "comment": "Malware payload", "value": "78ee11678b802687ee6339b750e12ebc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467025, "uuid": "d97da84b-c8a2-47ef-82c4-ef4b7ca15ce4", "comment": "Malware payload", "value": "36b2366b6f498cb36327c001f0ce3fd4d43de45464d6da57901e9e977798b9a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467025, "uuid": "de0392a9-2786-431e-9dfd-fabdbd585c5f", "comment": "Malware payload", "value": "3afa7dab7c01dc1ad3d9046f9f0848f491b56c1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467025, "uuid": "dc0900ec-14fb-421f-8dda-b3da48bd97f8", "comment": "Malware payload", "value": "d6efeba6f7a4274d73c0eefa0ac3c5d6e04ad161e749a9b4beaf4d6f2ebf3ba25fe74d6f7ffe4b79f448799d53c8c240", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467025, "uuid": "48d158a8-348b-4bcc-b5e8-c67077e20f5c", "value": "T177567D30F5B68469ECED00B1A2BB59775A6D1D04773484D3D8947C983CB01E2A3FAEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467025, "uuid": "0611dc4a-bb78-4c30-994f-78f412fd8f7b", "value": "41c32693477d1b5435c0e09bb2654b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467025, "uuid": "59c3fad5-84ca-4cae-9a44-b3e25a6dee9c", "value": "98304:sn+YvvybTDhTSSTSaQz+fAWBfVrc5r4HeMeGq6QBeX+CxAM+wdU:snbvuhTSSIc+YejfaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467025, "uuid": "07b73139-fa2b-47df-815f-da31a71c1c28", "value": 6153048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467025, "uuid": "c0e9df2f-25da-4389-9cf2-234321e33286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467025, "uuid": "933b45c6-fc5e-4aac-883c-0c0cb0a5915f", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa49cb4d-03f0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770446760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446760, "uuid": "de6cde70-c1c2-44f3-b1c1-5c1eee1577f3", "comment": "Malware payload (Mirai)", "value": "de18071c97042cca46aa22aab48a3192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446760, "uuid": "c4aa321c-cccb-4e6f-b673-18499eaa0f64", "comment": "Malware payload (Mirai)", "value": "36c6e3826fc94e5c986f7e3430aff1237e93af5e58d92dee9e489f6333b88b22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446760, "uuid": "2d4ad704-590c-46a0-85a9-070410111c7c", "comment": "Malware payload (Mirai)", "value": "19a4f64f830546e403811588caa26fa01e0ea578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446760, "uuid": "9ba71bbe-a39c-4a6c-a73e-fe93df8948c8", "comment": "Malware payload (Mirai)", "value": "0e2851e2df42fa55738f3352d35150f58f8a618729b887b24173da0a807fecab542daf0c195e734441c54e77aa3930c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770446760, "uuid": "aef253c7-ab54-4d18-84bd-47fd62ef31c8", "value": "T11D032886F8019D7DF95BE77F90534908B5717352A0830B2B17A7FE937CB21A85D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770446760, "uuid": "885701f1-04f4-4dd8-8efe-51b30721e088", "value": "768:qReAxG68AvP6mgbvs/SCuKUBTIJY6hNyez+r6uKQ8Q8A0Tq0zyApyjql1meMr:UNxG68AvP6mgfCujb6hNyez+rjKQ8Q8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770446760, "uuid": "029bedbe-494f-454f-bad6-67f139d07b06", "value": 41072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770446760, "uuid": "c7c0acd9-5ae9-47a7-a945-73465be0ffc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770446760, "uuid": "173159e2-b3ca-427c-941c-5264c02b4266", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7b7a04-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468190, "uuid": "8e2f6999-d984-477d-801b-b97d9f63c442", "comment": "Malware payload (Mirai)", "value": "a1ddeb0f16f8d4f588ac4edacc6f46ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468190, "uuid": "4eedadbe-32c6-4ab6-88d0-b7561c249be9", "comment": "Malware payload (Mirai)", "value": "381601ab25b196fbaca0c28a9d4270a498b7b469d33af9d4f0572e1dda79aa04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468190, "uuid": "5076aa66-eacb-4c16-9be2-03c0a07fc844", "comment": "Malware payload (Mirai)", "value": "ba98d44f2a0389707076ea5ecf9805b13f274bc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468190, "uuid": "53a029af-96af-41f7-b237-61e3b8389b27", "comment": "Malware payload (Mirai)", "value": "7c260f91f313a814adf5a5230278e4b333c9b3f08c02a1ec108cd103caf82096e7ee1ce09917b8495ecb9da0131eff47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468190, "uuid": "e68ddcf3-835b-4b95-8d97-8ab64ba9fa57", "value": "T1FFF33B46EA818B13C4D62776BA9F41453333AB64D3DB73058D28AFB43F86A9E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468190, "uuid": "9ba6b61b-891b-4ca9-bd95-8dc868ddf976", "value": "3072:zE4dpDq9QwpUhaEdYTofOOWhvDCSQ8E3rC3lM/9wOU7gFv:zdkUhaEdYTofJWhvKP3rC1M/9tFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468190, "uuid": "7933dba0-615a-4ed1-ad14-3b2f5edbe54b", "value": 167000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468190, "uuid": "db8e5e30-b4e3-4eda-9437-99b890430a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468190, "uuid": "fbb11ad8-d4a1-408b-8271-12516ca9f5fc", "value": "binary.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4380f2-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491321, "uuid": "569a72fa-6a8e-46c8-b911-9548a1c41cc9", "comment": "Malware payload (Mirai)", "value": "9f3da8b96dd16fd91f47861c94ad10b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491321, "uuid": "371a7ac1-8d32-41ee-9e59-071bb17c9b85", "comment": "Malware payload (Mirai)", "value": "392bbbe8ed4fd4a33eaac57a3f2f95f6bb2e83f1bc64f1558ec325761db8328a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491321, "uuid": "5aeeacd9-552a-4889-8fc2-de3398c162cb", "comment": "Malware payload (Mirai)", "value": "e0ec84e28a799c79d986183126fb563cf3520976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491321, "uuid": "54c1da19-7f1b-48a5-b163-78c73aa7aa13", "comment": "Malware payload (Mirai)", "value": "35a23994d3b7f1ee32321bee347707cde9579df3b572104b97975412b9a6afcdc7f4f7255192ce7b916dfb84dc6fabf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491321, "uuid": "61b0c140-7dfd-44bb-8472-92fed7b626c1", "value": "T1477302523C112B6AC4F5EEFA9D7BDCC8B24BBB690F4B814D9044A1BC72694D143335E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491321, "uuid": "238e16b1-ce19-4877-920e-295b4e8e67ae", "value": "1536:agjZnTJXO+lwwyrYyIAW4z8uC+I0tT7G3iNYJGCO+GuUvLyvSoDn0:Fj3OG2lIAWl+dt7wiyJGC8uUvLyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491321, "uuid": "755825d4-a02f-4bf0-8e3e-176374c3e6c1", "value": 78900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491321, "uuid": "c6c69703-f5e0-4b18-a375-f355ee1171da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491321, "uuid": "125e9a7c-ef99-48d0-9a65-3e117fafe3eb", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3741607c-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474485, "uuid": "21337850-6818-495e-ac5d-52d41f590ba2", "comment": "Malware payload (Mirai)", "value": "6c820f69d9dbeda5d3ef0bb746b2bb70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474485, "uuid": "2ba480dc-a664-4dbc-8f43-8ac2317dcdb8", "comment": "Malware payload (Mirai)", "value": "39a45b885b06dc8837acd0d5218f1d96a8670087042b67d3c58ff6c22bdfd76f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474485, "uuid": "9b9e9a2c-7630-4070-9a72-eb2df4992c43", "comment": "Malware payload (Mirai)", "value": "a769d648bd43146be722f6ef7c339260c5507296", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474485, "uuid": "47ff9082-98aa-43dd-ae43-257f0aae193a", "comment": "Malware payload (Mirai)", "value": "92479c73858ddef6d0476281139335c57e2ae1392cf11fd3d7b09fee6b305905cf8fc58002257f7f20ad47f33cc85713", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474485, "uuid": "d78e3e98-f82c-4133-81e0-e323bd30c85c", "value": "T1D363B506BF614FB7E86FED3709E91B05248C541B21A97B3A7E34D818F64B25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474485, "uuid": "a87f0ca3-d10f-4772-a072-f894e02943d7", "value": "1536:xic5msW0d/JnzwIFIzUP8UTtDOPHtb3cRS:xP53DlEOYtIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474485, "uuid": "c9a41b86-17b7-4cf3-abe5-eddbd5fd4c28", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474485, "uuid": "0b194f7a-179c-4af2-ad2c-fd7347b650c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474485, "uuid": "da6b92e2-f096-48a1-b6fc-0211311f7e53", "value": "Owari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bff208-03f5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770448628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448628, "uuid": "b1e99619-b864-4526-9462-2daba7bfe3ae", "comment": "Malware payload (Mirai)", "value": "d4ff6223c62909b5b0f2065b8b2452e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448628, "uuid": "639efe1a-0cbb-458a-9a83-a0b64378afab", "comment": "Malware payload (Mirai)", "value": "3b87a28e6591db2f6542d2fd7141dcf67177923a0352247c0f73c964b08bc870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448628, "uuid": "05bff2ea-ddce-483d-b3ce-049007236039", "comment": "Malware payload (Mirai)", "value": "5f83dbe68715b62b384ce8f1d794b8f0b6991c4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448628, "uuid": "db40c0fe-fd03-4846-84ac-2298e7f89358", "comment": "Malware payload (Mirai)", "value": "48803ce4f56a3ff197d83f85161d86e4c3aac754919590c7bce71d3de9d3e0dacb900510b7f2e185e768aafe46601e8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448628, "uuid": "e09e0a54-a4fc-45dc-bab2-5138b96d8cc6", "value": "T157F2D691BC81962BC2E4237AA6AE018E337177ECC2CFB62BCC115F14768596F0D67B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448628, "uuid": "501e434f-ddc2-4996-803c-445914b0cfad", "value": "768:jmQGvVxptgG58LFSPQzfqa4eHHWCLJk1J92z9Df5Bqn3Sq/NkA:irxpCG587fqnGV88L3q3Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770448628, "uuid": "2b3d9ef7-7f18-4cd0-8bb4-e26c77fc2c09", "value": 34836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770448628, "uuid": "6f159199-6959-4ea8-8983-8b1113d8afca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448628, "uuid": "60c8a0c2-3ac9-4238-b7ab-e330f110b168", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b93b243-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489202, "uuid": "64965ba9-6869-43a6-b22f-f7a57fb2577e", "comment": "Malware payload (Mirai)", "value": "967a52df64957feb84d1d7ebc27d6d05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489202, "uuid": "f2a3f21b-dde6-41bb-ac38-82a2113acab5", "comment": "Malware payload (Mirai)", "value": "3c1f8124b4f844c14df43a1d48d0bf62ec591dcf05bb38df6f02b05dd2361aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489202, "uuid": "a89b6a85-5f6f-4719-8c2d-7f780f8eda00", "comment": "Malware payload (Mirai)", "value": "5b037504be7f9c09bca7b01dad6f8726132e37fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489202, "uuid": "9da6805a-c377-443b-93b6-75a7bb4812d2", "comment": "Malware payload (Mirai)", "value": "830201f3e8094b6cf9bf4afc2aea21940f58de0e49a17f9ce9c5e54d95d46a1bf4667d2c017e624e845fcaac3379e9f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489202, "uuid": "694163c4-4f9b-42c0-b66e-29601a609aec", "value": "T15C83D506EF550FFBDC6FDD3706A9070225CC665B22A93B3A3534D928B55B24B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489202, "uuid": "ea2e794a-0587-4011-8e5c-a93e1b5e332b", "value": "1536:D3qYhpgNaGTcS3hYY4Z20uc8c3/aZ0U214Vl93yrY3Y82Iz0Q:D39hpgvTcSJTc8ia/XGb82q0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489202, "uuid": "799a8e1c-4334-4736-a481-b3538dab0951", "value": 85300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489202, "uuid": "2a39816b-eab2-4da5-90c1-bffc34199b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489202, "uuid": "0950a30b-c16e-4b05-8c2a-3cde2e3bdea9", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a868da-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437381, "uuid": "b8c8a2de-3ce2-4510-8d01-7ca3f54a15e1", "comment": "Malware payload (Mirai)", "value": "e13dd90e0152549e9e050bab19a0bb9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437381, "uuid": "6d2e5fcd-2062-4261-a94e-cbec666a10a2", "comment": "Malware payload (Mirai)", "value": "3d3d30f069b02dea02ead11e8dc9160788fdcfd955fe63e2a0b819414b8bd6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437381, "uuid": "a3b77ac6-de6b-453a-93e3-63ccc26b2cfe", "comment": "Malware payload (Mirai)", "value": "43b09fcf04320019429efc8530afcacde1672799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437381, "uuid": "37801305-a514-4907-a5c0-06ec1a5a1811", "comment": "Malware payload (Mirai)", "value": "4a235f734efdf27742b833e42f7bd7bb92d003254cffd6ba5c820bb187591e2644d89aee3e5500ffb2d5a060166f6d2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437381, "uuid": "2757e027-72e6-4ea3-8cc2-3ad535552381", "value": "T106C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437381, "uuid": "b316d628-56f3-40e3-9fb6-a58bb8f66a0e", "value": "3072:/f0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU4uqe:/f0tJBR4NSALD7rnCrheiNqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437381, "uuid": "22ff151e-39aa-4cc7-b236-d736926b7cf6", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437381, "uuid": "2b6998b9-6bbf-4d7c-a84a-cd182f08f80c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437381, "uuid": "bb132a04-95c7-4b67-b950-7147e91d5554", "value": "israel.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fa5aae-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1770466940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466940, "uuid": "9f9109f5-9c80-436e-a2f7-5b5f3e47d98d", "comment": "Malware payload (ACRStealer)", "value": "495a69bdafc6cae5e8021e8f401819c2", "object_relation": "md5", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466940, "uuid": "5ff68788-cd63-4ffa-96a2-72880ddc5c4c", "comment": "Malware payload (ACRStealer)", "value": "3e1ad7131429cc738bb6bbf38c0ea1a37be29bf19e74b22134a6d0e64e952f37", "object_relation": "sha256", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466940, "uuid": "e03c6793-f9aa-4bef-8196-1ba4ecf81e06", "comment": "Malware payload (ACRStealer)", "value": "3dad9de236c7bbb9e44f855844baccc97cfe4e1d", "object_relation": "sha1", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466940, "uuid": "5d0f0878-1cd4-4357-8027-5469168b29ab", "comment": "Malware payload (ACRStealer)", "value": "19a1894274629cdd01c485365a19c477471a994430d4876bb5eb09c9c1fe8d98e4c6c79e14b9b6dc37db34a253031192", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466940, "uuid": "c492fec9-e576-4fc3-bfa8-1ad9f6ac5b01", "value": "T18D0733E7F3150C69D04DB73A64AA0213F8780A94A1B4364E4F5062F15DC7F5ECAA2B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466940, "uuid": "1b411a06-2dd2-499f-9938-b1b0fab34ccf", "value": "393216:GOX5qQjBVxC8k32GKTNSr3n+ay+OtCX3lmxg5m:GOXRVVxZw29TcX+ay+GCX3Exg5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466940, "uuid": "92ff4aa9-e6e3-4a99-aa45-251e80c55b5f", "value": 17523751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466940, "uuid": "a5194ffd-82b8-4b3a-b196-a84c2f3b834d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466940, "uuid": "1d407811-61c2-485b-9451-647ca76dfc67", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e067974-0424-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770468966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468966, "uuid": "6db19431-ece1-4898-983f-ed8777704619", "comment": "Malware payload", "value": "3bf65c1300fda8ea2e084eb6f376f1c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468966, "uuid": "7522a156-edfc-46a3-8f70-3166df6b33cc", "comment": "Malware payload", "value": "4067a6a2113010ab9d5d20700aca243bb159a12175dce9577901abd76342538d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468966, "uuid": "7f26e474-31b0-402c-8740-8ec8dcbb94d8", "comment": "Malware payload", "value": "4ef8e63363732e3e7151fdd013bf300f252c29ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468966, "uuid": "a419420b-9694-4d0d-a236-55da8fe3a967", "comment": "Malware payload", "value": "4b5db50aa18c7dc1a54b92bdb6a35993f21074020dde0ff005ac9d3011d0ceea07b8008ace1eba04ffb8548e9a3c17cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468966, "uuid": "75c7d1df-5bbd-4cb4-9d06-aa552143fd5c", "value": "T132E06DEB54D3F645CE3E9E55625648006005D68420F3CF79E4860A37E8879067054FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468966, "uuid": "cac59d52-8fe4-4467-9c91-076690bb9f34", "value": "6:SbSWJjbAGGmSWJtSA1hSWJvaa6A3hSWDAABSWK6AA5SWgT1Azbw:HWJbRGWyYUWFf6nWDqWpqW41kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468966, "uuid": "95f8fb8f-d829-42e9-a41a-bc50b4665746", "value": 370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468966, "uuid": "19e180b2-4ab0-4e0b-a7c2-49d0ff536077", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468966, "uuid": "0b94dc5d-3f78-4d09-b923-84b0404bb72b", "value": "nvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325993d2-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438828, "uuid": "004451c0-3415-40bf-b918-7c75b18cb5fc", "comment": "Malware payload (Mirai)", "value": "994d1168ccc21d59c68ebb03e6d1dce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438828, "uuid": "1df56a4d-b190-42f2-8c79-81a69bcf58b1", "comment": "Malware payload (Mirai)", "value": "408dba26b5bfc930ecdace16b73c21a5a48234ebac99365aa56555c46d17ff65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438828, "uuid": "c37fce1d-906c-4ffb-93d9-ca11814e2bc1", "comment": "Malware payload (Mirai)", "value": "f7b9555d028799405cab0907bf7f8fe1009b91a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438828, "uuid": "c533272a-d7ba-4fa5-8a48-0b8325f6d604", "comment": "Malware payload (Mirai)", "value": "4b51a394fab6c5916ad82ce02a3f55c8ac540388b3907b58dcb774d9ff2381c1aaa642523ba39e46020440ff8ba1c2a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438828, "uuid": "b0a29dc1-2255-4c68-a037-0ef6a2ddc5d6", "value": "T16A04C41E6E258F7CF3AD833547F79E21965833C726E1C546E2ACD2105E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438828, "uuid": "9cfa6b5d-8cc9-48ac-b147-41c7608cc179", "value": "3072:xKQPPTxS8ePhD3mlZhiX7O5U8iAv4VJpYnLOolUTQbFpeDzMKag7+H7mcFhCYeM0:xKQPPTxS8ePhD3mlZhiX7O5U8iAv4VJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438828, "uuid": "7d0fc8c0-3c30-434c-a98f-57913774dea2", "value": 184464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438828, "uuid": "1a93c9a5-7a9b-4a04-b3b1-09e58dcc449d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438828, "uuid": "427792ca-139c-44b0-9ef2-662a7b74ac6d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e62dc6-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Smoke Loader)", "timestamp": 1770491419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491419, "uuid": "7b2c1afd-1cd0-4e0a-b04d-6e901b6027fc", "comment": "Malware payload (Smoke Loader)", "value": "71311e52bf0495b67f98b63964e364a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491419, "uuid": "c9243226-0455-4792-bb7f-fa78e28c5d7e", "comment": "Malware payload (Smoke Loader)", "value": "410863d42dec8855da40cbe8f3039888f84b575bab2b20dcc4ef2e8e2653f6dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491419, "uuid": "be32f011-a882-46ac-9aea-2481123d51b6", "comment": "Malware payload (Smoke Loader)", "value": "df3481f5f3a2f23da80f96882dec2c1e96af7db1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491419, "uuid": "fdc202fb-ec0d-44ad-85e9-4bf9b80f7bc0", "comment": "Malware payload (Smoke Loader)", "value": "c224b99b6ce5665b4a9e89838ee5378ff36c038d5afd04391144ea2d0ff16b7a8c5adf55f64c8eae7a38ddb92fc4c188", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491419, "uuid": "562cba34-ea6e-4bc5-846f-ecc5b249159f", "value": "T130758C112A696BD2E0F7A1F09CEE3907EB68FC7406F44319E6516D290C3D74D3E2A627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491419, "uuid": "c2ff0949-3fd2-4003-8885-6619378760f1", "value": "e3758d506ef4137681a17b4f0dd72cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491419, "uuid": "a267fe50-60e1-41c3-9887-c03fb758d2f2", "value": "24576:yCDJkuiCWJ5gaXHyYGzG5/0wncSLwwCp79XJppPVum:XJsjJ5PXc4DcSFm7XppPcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491419, "uuid": "92765737-c632-4d37-8e3b-872a6cc6c912", "value": 1696800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491419, "uuid": "d085a876-4862-41ee-a8d8-2043eed133fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491419, "uuid": "e6679719-b3d4-476b-af2e-42c32249555c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a2c87b-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466744, "uuid": "5e8c1e1c-a785-40db-a005-736164513d58", "comment": "Malware payload", "value": "228a91d911742f8ca5cd45d3e343eb7a", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466744, "uuid": "67b65cf6-c17c-4b8a-911b-ea34b404d26b", "comment": "Malware payload", "value": "41d26eea4f7b8290f16e931e5c1898eceb8230425c4e60882462c88ff703e092", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466744, "uuid": "53a60c2c-062f-4503-8051-872486577971", "comment": "Malware payload", "value": "07460a498a0ac9b350029a2da8243c7e8d78a6db", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466744, "uuid": "ee09c323-863d-40c0-8b37-ef89903ffe01", "comment": "Malware payload", "value": "aaf676201b7cef3919d0adde37f612928309ab2a4af6ce97015c10235e6a2fe7a8aae4fe8c227b7888a1b68bce2a8df0", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466744, "uuid": "048cf045-babb-42f1-b737-9f92e6f3042b", "value": "T16D47338696746610F9CBD835ECEF7B4BECB851C5D07D4A6DE0AC52C3188B2E2FA35502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466744, "uuid": "6dfe4587-0831-4597-95ef-ce0cb88da3e2", "value": "393216:BuNSwhz7jufGLa6f2OavlQXwDflR6C5kr6hE6ZpBLopRT+K+bmk02dDqXXghJL9l:krhz7jFa6+zdj9tE612C02aXg39+Ovyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466744, "uuid": "94e4dbf0-a04e-4b0e-b3c0-a7029dbbdbe5", "value": 24681837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466744, "uuid": "1285bded-1ef4-42ba-83cf-0a11541f6a6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466744, "uuid": "f270b5e0-433f-4939-bc71-ec378a542ea6", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d832e76-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466737, "uuid": "7fcc850b-9367-4e2e-9c9c-719d3b58c52c", "comment": "Malware payload (Mirai)", "value": "f5bde768c0bc6527172e82b34a5f729c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466737, "uuid": "713d2fdd-3a8c-44d6-aba2-8dab48ad046f", "comment": "Malware payload (Mirai)", "value": "460f555629b78c5c7d965c7c1dbda17bcbaad0f7327207662a198bac2a47a6ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466737, "uuid": "918920ab-152c-42a4-bf8a-7d0a70add367", "comment": "Malware payload (Mirai)", "value": "4fc4ba3b258fd1165a8d90caf86022abd56cf908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466737, "uuid": "ef3c08eb-ce37-44f4-bb3f-99175c3ea863", "comment": "Malware payload (Mirai)", "value": "731f9ff062e42048d1d61838e75c36afa358f3c6ba569f0ffebce68cb1f7f41e53694afccb1a5d15647ac65d6c9ff22d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466737, "uuid": "2a1bdb48-8ad3-4168-9e87-94d616fb13de", "value": "T15D256B57FF1C5422C8564EF05C7F13E5F320794211B861267B0E6B2B2622F79AD8B78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466737, "uuid": "f9617405-2567-4173-98f5-136759a2b69d", "value": "24576:c+PYz6Qc9PXiZcno/o0BK1hpowB+KdbqwBtcYkThdr22:TPY2Qc9PXiZcuq1hpowBNJqwBtcYkTK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466737, "uuid": "3e9df6ce-876d-442b-b563-6680a623b9ae", "value": 1027236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466737, "uuid": "e5e83c06-b15d-4200-8f39-3a9003fbf51a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466737, "uuid": "7d145996-f579-4db6-88d2-02c88200f611", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739647be-0443-11f1-a129-42010a9c0007", "comment": "Malware payload (Babadeda)", "timestamp": 1770482317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482317, "uuid": "7d0f4e8f-5ae9-446f-badb-3c5e16e9ad4a", "comment": "Malware payload (Babadeda)", "value": "8c6eaf248b4e033ed366dbcd119725d2", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482317, "uuid": "d113c716-7ba8-457e-9594-7d3947ccedf4", "comment": "Malware payload (Babadeda)", "value": "4650a4652d78b4adf952fb1188b69361c5adfbb6dde8ae730c267b5395c54166", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482317, "uuid": "e3b6861a-6cff-4410-a940-b8f19bfd4772", "comment": "Malware payload (Babadeda)", "value": "823b2fbfdb7a3e2f8a1730f09225ed79f4906d1b", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482317, "uuid": "9d25e609-31c7-46f2-8237-9478219906c1", "comment": "Malware payload (Babadeda)", "value": "32ee7e39d65dbdb9ffa86bfb403fe12e8e85dc61c1f9a80b1a1a4ff1926b469129f3663eb3c99c306ed476321cb14b17", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482317, "uuid": "545267f6-3287-4924-aed4-a61a6ebc953b", "value": "T118D41281BAE601B2FDF2087119EBB26EA7766720573064C7C35C3C56E9615C0663A3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482317, "uuid": "7f5a23b1-4022-4402-b25d-194228bd77bb", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482317, "uuid": "b4e42666-3612-4144-a090-b9b1bca75dff", "value": "12288:ocv0NTuzhoD+dAgrjovkqr1VABTHw746HsXKP9XHb5fnnHW:ocvkTudq+dhBqJKJHg46c+93b5fnHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770482317, "uuid": "1116051c-2507-42aa-b119-3d18b1dbb0d1", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770482317, "uuid": "7996abc9-a324-45b5-84d1-e442eefc9e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482317, "uuid": "bbf6515e-1237-4679-ae7e-f1aef6f74d8e", "value": "MicrosoftPhotos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1ecd3b-0421-11f1-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1770467651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467651, "uuid": "b29ce2f4-28d4-4b1c-a68e-34586ea84f47", "comment": "Malware payload (EternalRocks)", "value": "e8aa85313d7aad0e9554086bf5c9beac", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467651, "uuid": "203b99ea-ad4e-45c8-83e6-3b66abcf994d", "comment": "Malware payload (EternalRocks)", "value": "4679b6adea4aae9614bb538695064ecdc49c5e698208a8b803b4fe85efc53eb9", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467651, "uuid": "aed154ec-c44f-4c4c-811c-5f92ef913fed", "comment": "Malware payload (EternalRocks)", "value": "09135e0eee3a7f79819890e2caf0d36240d5104c", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467651, "uuid": "d1a7cb84-c09a-4511-9f9a-3ca881e70e6d", "comment": "Malware payload (EternalRocks)", "value": "a9d2a1124c718c73f0b2c536708aa6928056f45556fef9e39fc9adedbb75086d6a29027c11017d16b9a84d36b32a6464", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467651, "uuid": "e03f5bc7-f4dc-4def-b906-bd0d32dc5f51", "value": "T151A55D51AE079CA603B466C2C767D6C4DD2CB1697226F5C83EED82883079E7F03949ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467651, "uuid": "47ced916-1092-4d97-82be-79fb7f36d7ab", "value": "12288:D6KLB0qnTWdnk4cZmmv7yVgLm3pjo7iwlGqkjIaBeVrWe5wCA1XOmG/mZ3Iogk5f:D5LxnVN9Dl97iwleK1We5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467651, "uuid": "d6e86f60-d2cc-4da4-bbce-d0933cc739d2", "value": 2161440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467651, "uuid": "6559f403-8026-4afa-bc00-c2e1d38bd79f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467651, "uuid": "75a740f3-9031-423f-a31d-06bd4e7dee84", "value": "malacca.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04965b62-0429-11f1-a129-42010a9c0007", "comment": "Malware payload (ShinobuClipper)", "timestamp": 1770470964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470964, "uuid": "2d1d3b2f-658b-46e9-9bed-67c8299945e2", "comment": "Malware payload (ShinobuClipper)", "value": "6f133087b9e769e521abce2cdcca4bd9", "object_relation": "md5", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470964, "uuid": "d738851e-0fed-475d-988c-6e8f685494b4", "comment": "Malware payload (ShinobuClipper)", "value": "468c7bc4c01e21ddc276a3c1746e3ff3645d9496246b2f240c50eea8da4a03ec", "object_relation": "sha256", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470964, "uuid": "d1ef4bee-d17d-4f07-bef3-a9c2bd783514", "comment": "Malware payload (ShinobuClipper)", "value": "dd4ea341709dbb1faf0f1715f0348b9d46e2fdfc", "object_relation": "sha1", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470964, "uuid": "d5c61b77-6170-4317-940b-d242ad12d101", "comment": "Malware payload (ShinobuClipper)", "value": "27934132b5c7c9b1a20a21d1628595c731481dbf500555a2f329713d95c6c303847df279b7302ed9be29896f34971932", "object_relation": "sha3-384", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470964, "uuid": "ed0aa916-3df6-49cc-89dc-3b851e677881", "value": "T1DC824C2D63E6C7B6CEED5BBA486361811772D30AA983FF1E8DEC807714773400B62614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470964, "uuid": "4fb94980-eae4-4828-98c5-a81b0448ea2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470964, "uuid": "807541bf-68fa-41e1-a1fd-7caee1ad0b61", "value": "384:B4DI1vq5xVyxSjdto26g2S0olp6NaUkBq2Ci55Saz+kz:mDI1iTcG/6rsYEJSkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470964, "uuid": "c3f3ae3c-66c7-49df-b4d1-ec177cc2f7bd", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470964, "uuid": "370b8676-d281-4e77-ad65-eca4d212dd9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470964, "uuid": "aa4d01d5-1bee-45b5-a93c-36393d5f8ed0", "value": "sonic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dc0cca-041e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466530, "uuid": "3e01fa37-bd66-457f-a158-294e79fb0cd3", "comment": "Malware payload", "value": "ae23088ba7f5b000fc13d9f5bfe0f0f7", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466530, "uuid": "c0d28b3d-e113-45de-b9cf-0dd7aced88ba", "comment": "Malware payload", "value": "47594796aac04ec99713eef7c8648eed222d8f9ab43a69d5bcd055ca405a1e07", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466530, "uuid": "b3c03d36-2c28-446d-9dc1-d9aaf10eb690", "comment": "Malware payload", "value": "a741353f9d957360e27626c1f6fd0ba4fda9a199", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466530, "uuid": "96af89bc-d1b8-4c90-a3f0-d90915ba6669", "comment": "Malware payload", "value": "534b849127f516294efcfd67641e87910dcf3f50461c3c4d9b9700e69345e0ebe4d8039b83ae25dfbede536155f4e801", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466530, "uuid": "eaa07193-7f45-4f80-bfc1-7b168e2c2ddc", "value": "T1BC4733F1722CF967EC6FCD71B5DA7DCBCD8143AD20FA494E734B12BA81562405BA8602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466530, "uuid": "6b65cf3c-18cc-430e-bfbf-df522e82d244", "value": "393216:HKIZgmH80i9ubHPqVmHOIgftmBrMliOdUxKhMhSmQCKLGRkbQy11xo:HjDvigbHHHOLtmqiNoqS1ZLGRYQyPxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466530, "uuid": "23492d95-3601-4b0e-92a2-cce89620f2d2", "value": 24833489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466530, "uuid": "4a531536-08d7-460c-a3e6-65f9b09bea8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466530, "uuid": "07ab4fc2-b97d-42ed-80e4-f0662597cd39", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c5ce72-0425-11f1-a129-42010a9c0007", "comment": "Malware payload (Blackmoon)", "timestamp": 1770469300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469300, "uuid": "798b46c9-9c2a-4726-b110-e40c3e15c172", "comment": "Malware payload (Blackmoon)", "value": "c59bf2cff278eceb33f48029f81823bb", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469300, "uuid": "f62834b0-178a-404f-ad99-5b6fbd649b79", "comment": "Malware payload (Blackmoon)", "value": "498023716c80c02997b19f75db14d71156e8097478f9cba5153726894d202726", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469300, "uuid": "0c0105c5-10cc-44c9-ac49-76378c24930a", "comment": "Malware payload (Blackmoon)", "value": "cafb5bc856f53ece78341bd32457d792e563093e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469300, "uuid": "ad479657-5689-4add-b7b8-a3468f7c466f", "comment": "Malware payload (Blackmoon)", "value": "2246b5c7316681c5717f2e5fed6bcbb51b80fd4bafb9fe103e447890e19a0b59ae73b08e5b0eca6a5237a5fa5e5425ab", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KRBanker", "colour": "#52C515", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469300, "uuid": "0a37e014-56b2-48d2-a91f-6e9dd566c1ec", "value": "T123359D73BB01CAF3C95609F959295E9FD33C729B0B118CD3E6D40929A9B51C36632E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469300, "uuid": "df7416ea-b5a4-48d5-8447-a76515d9113c", "value": "a36450ff7dbb7f82e847c7fab9494e95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469300, "uuid": "08361442-83bf-466d-a6dd-f2de250776b3", "value": "24576:hJ2XSvkRYgQs9THR6fu4/yyCiVzEN6YKzk+ZlufEW7eEzlUoB5VWJ:hpvk+gQqHR94VC+EnKzpDeEGNhpB5VWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469300, "uuid": "fe13665e-7b40-4a63-b0f6-525cb18d6577", "value": 1106928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469300, "uuid": "1e20c26d-bce5-4572-b1cf-cfa9b9edb2da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469300, "uuid": "c3d1b568-4be0-4b76-a392-8a97d742f7de", "value": "VM_bm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b954287-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491189, "uuid": "dee0cf05-8737-4642-a657-577b19ea9320", "comment": "Malware payload (Mirai)", "value": "220bd441f9a0bda35b9fbbbbbe2f8692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491189, "uuid": "fc07845f-07d6-4c22-bb34-f24a076b6615", "comment": "Malware payload (Mirai)", "value": "499bcb0d78dff3de816a53a21209bebb50f16e7239453ff89e7b9855b6e2edbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491189, "uuid": "c5ddee11-1690-4ab9-97da-a0e8f7559361", "comment": "Malware payload (Mirai)", "value": "a9c72da2aa9ec229d875fdc556268a249932357f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491189, "uuid": "832961b3-6ea8-47b2-8066-6e12120e2e2a", "comment": "Malware payload (Mirai)", "value": "ba8e1209da830fce9f9d20a744fc0779868b74ca9b1c91f02e8c46e3307521cf9ec25f4810b30e26d5c70299a40c29f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491189, "uuid": "3b90aad2-3767-4769-bcc3-644532fcd66e", "value": "T1D1931855F890DA62C6E4267AFA5D428C33631F78D3DE3106DD14AB3477EB95B0E3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491189, "uuid": "643eeaca-dafc-4071-aead-52835aedee11", "value": "1536:AN2I7gvH800SxuSGoqy5KMgIb5M3OFLaz2aK+MvpqPQp6iBlxcSOMYvmHIr:Y2Ikf800SxuGqy5KMH5azoLqotPOvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491189, "uuid": "3b50a984-483b-4555-8315-b5c6621eba23", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491189, "uuid": "2c52afcd-8cef-4117-be20-d88f00a4a791", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491189, "uuid": "c1af3219-6880-4d9d-9f2d-7bd7e4d9f7b5", "value": "catgirl.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922df907-0460-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770494824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494824, "uuid": "1d816559-8c4d-4d70-99aa-f9750571b784", "comment": "Malware payload", "value": "0ca1190ba2c66904f2638ef227e4ee0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494824, "uuid": "5ed30354-71b3-481b-9d57-0fe36e220044", "comment": "Malware payload", "value": "4b16bdb9ddbf73974be1be790a6e6222f7fe89546f5d22eca6eea30810142f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494824, "uuid": "e2bcbfde-532d-479a-a71e-b741e8572fb5", "comment": "Malware payload", "value": "fbe8b5efdcd29df709706f2b161aaacc9afe1d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494824, "uuid": "afcc2b02-e2ef-40ed-8140-29d4e20bc79f", "comment": "Malware payload", "value": "23972f72038266bccb3906afe4052204c41066ee5fd1d17e9e464442538ff0a5562ee7f9671ef7c28db0edee08e23c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494824, "uuid": "8317865c-cc82-4d31-b76e-419c857fd72c", "value": "T11D03E1536742B6FCDC39D93689E70285D31F38055B1F97BE08A8253A2C763419F23B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494824, "uuid": "dd6fd995-e786-493e-8851-57c1115c5608", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494824, "uuid": "fae66a07-271a-4299-a002-74279d529614", "value": "768:/nyJHubAUnDU+QA7EhPdkvSe5vSQE3gncL7KgXLbKwwVmusqhzLYXAH:/oObBZQA7Ehlkvh0bgcLGobKwwSA5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770494824, "uuid": "ae1b84df-1fc1-4a25-8af8-e1b6e38e62c0", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770494824, "uuid": "40e7ccd5-a636-4180-93ef-335035888837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494824, "uuid": "9d106933-8e33-4655-87c2-8f9e9c8a6641", "value": "SecuriteInfo.com.FileRepMalware.25589793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27963a8e-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489061, "uuid": "76c06966-81ee-42c3-ae18-12446e0ce9ca", "comment": "Malware payload (Mirai)", "value": "55c61e2affcd3bc239ee0d05d6908d0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489061, "uuid": "48c4c57e-8aa2-46a2-93ae-eda3c9b5f3a0", "comment": "Malware payload (Mirai)", "value": "4ba4dc55b4153c701b6637b837be43c48a5adf26d99d9715e9850a0dd2179d4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489061, "uuid": "201cf269-f391-4446-8bc1-3161fe8e50f4", "comment": "Malware payload (Mirai)", "value": "06192184b38ab53a2cc3cf9e83d62482be49ee69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489061, "uuid": "af090d07-18ef-4af8-af17-37d625e7e0ef", "comment": "Malware payload (Mirai)", "value": "fc856b7cb266e611d4f3eecdf8dcc5ce99df981a85a9214ecaa3f607c6570bb391acfc6ff28cca0c332d0b0737e93b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489061, "uuid": "403c49bb-8be1-49fa-925c-210febbd17df", "value": "T1DFF2F134943E2EE0CBF4D875D53EC50717974BBC215ABF586A44271A4FEA09134B8ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489061, "uuid": "d84bd6df-985a-41db-836c-8ee44554436b", "value": "768:nkpEr7Y0UnmDrp0tYvGwOEqKWoB1vIs3UozA0a:CEA0UnmDrp5vMEqKWoBV9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489061, "uuid": "278bfb00-0828-47dd-9237-1581f81bfc12", "value": 35608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489061, "uuid": "2f93fcb5-8d3b-46c4-8d6c-af4d30f4c018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489061, "uuid": "58ba010f-6ef8-4cb6-b1ec-7bdc84512d30", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88809559-0422-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770468179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468179, "uuid": "2a7d3f81-cf62-454c-81a9-67ca0ff198e2", "comment": "Malware payload", "value": "4c1158b25245abd594e63b5f076ead43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468179, "uuid": "80eef800-b7c1-4c5a-a085-349784b970e8", "comment": "Malware payload", "value": "4d58aa66f73228fbf12b925c214d5d44de568071f629e7020b3720669747a7ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468179, "uuid": "aeced68d-0bfd-4742-ac27-80e08ba9cf39", "comment": "Malware payload", "value": "62b03c4c72d624b4e45a10cfd25342ed98784471", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468179, "uuid": "59475bc9-6ab3-4ce9-bc6a-b88ae7a53f83", "comment": "Malware payload", "value": "39cfc519afe017a3cb2ec23f91343cbbd44d88e4173e65a92f832053423d41652d90381b80de27e9d1cf20d6409bcbb4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468179, "uuid": "f6ee07af-d527-4a20-b8a0-3fa83fcf6272", "value": "T10FE1714BE0D16531AA505D5622A7743F38D190DA8ED64EC63AFE38B4E1ACEC85E60EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468179, "uuid": "e29dbce2-4b68-4bf5-b540-4a75f9d176ae", "value": "96:v8fCL2LGLuLqLWLOLmL+rLYfKjosaglaO5rbmIAIA0g4YkrKe:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468179, "uuid": "f41a47a3-8343-4e2a-8c03-3cfb01c711d6", "value": 6777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468179, "uuid": "1e6c92f2-cd78-4da9-b93f-acf9b1bb38eb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468179, "uuid": "5b96d3f2-c50a-4778-beda-b3d7b4a13985", "value": "adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e64c956-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500669, "uuid": "7b0df782-fc60-4150-863e-f3aa8cc1f761", "comment": "Malware payload (Mirai)", "value": "fcab42de5b414342a19df4121aef149a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500669, "uuid": "fd12dd34-39e1-43d3-a22c-91627fe7cdfb", "comment": "Malware payload (Mirai)", "value": "4dc25d6a9ce69e2a2a6b04ac5c6f4cd7bb7dbe275e3aeffc3eb5c01950b4d2cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500669, "uuid": "50ac8e21-d57d-40f0-adc0-80f80aab0c75", "comment": "Malware payload (Mirai)", "value": "a133a422f574ae658a6644e7d52bfbb96aa85680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500669, "uuid": "bc1bdf10-52eb-4547-946f-fcc7abd302b6", "comment": "Malware payload (Mirai)", "value": "3dfba79934e967a64aa138a7eb499bb52f0f80243aee0b3a112ee5bcfbd88d0dab6a4b10ce8fc4a6ef124f7e201b0251", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500669, "uuid": "16ac4f6c-47f3-432e-be9c-d8e0aa07bf92", "value": "T1CB041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500669, "uuid": "eaa374d2-1fe7-438e-bd78-61b8f4c7e231", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMWEzvQ6WJ9G2/7ZiYlTBVmJTP:J3CTRdrD5GFnrPU1sNzZt0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500669, "uuid": "2f0358c6-2fdc-4b71-8ce2-e53e4db889f2", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500669, "uuid": "ff94cdaf-1b1e-4e0c-bbde-eae44865337d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500669, "uuid": "d7ef8db8-f7cf-4120-a687-78a2f50d2c50", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c47fbac-0411-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770460857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460857, "uuid": "59fa6e5e-d722-445a-8b3b-0fbcc9f8ee0b", "comment": "Malware payload (ValleyRAT)", "value": "12f05853d800771f8366ce5cb6de3be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460857, "uuid": "daf01274-6f0f-4ee8-9018-0d906c681ddf", "comment": "Malware payload (ValleyRAT)", "value": "515a914e7d9336fa5e0feb6fb24e302884c0a0fc8e18aba333b59cdc5594a155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460857, "uuid": "180d7494-c7c6-4bc8-945b-2e9d66d1cba4", "comment": "Malware payload (ValleyRAT)", "value": "46dea2219d0334c983120ddba1cb45aa19faff4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460857, "uuid": "2c59d746-cc57-4978-8c08-61888d7a7244", "comment": "Malware payload (ValleyRAT)", "value": "8621b6e914e3751cfe1889efeaeb0f018c2088a3687d14d005248773ebd5e489adee433426b8734b98583c415310832f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460857, "uuid": "a142751b-f209-463d-a5a1-4d9756b85490", "value": "T1218733B3434FCCA6FF985C3689DB02DD3C35776B2D449417391E6A44E82228FE9B5922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460857, "uuid": "ba21740f-9076-4f6a-9470-6b1bfe02da1e", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460857, "uuid": "9150efa4-95a4-4972-ac87-81769e8ca57b", "value": "786432:/1iLLE6v+IOr+dgCdZavYhKas8oCi4Q9K6jXknSMUmS6w3ObQvqJe9:/1iLY65XdgCd0vYhKxJ95jXkSPGw3Ob+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770460857, "uuid": "3c75ebb0-c9f7-46e2-9fcb-01d1a35abf13", "value": 37929246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770460857, "uuid": "d5d21bcf-f96b-4e1f-8043-dd0809f9d33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460857, "uuid": "f5448f67-6051-4e4d-ad62-793499e689ce", "value": "LetsVPN4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2873ce23-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489063, "uuid": "2b52fd30-9eca-442e-959f-e13085faac14", "comment": "Malware payload (Mirai)", "value": "cc615954150009f530e23665983c1bdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489063, "uuid": "70d111f3-caa4-465f-9ceb-57b420b085f3", "comment": "Malware payload (Mirai)", "value": "517cb7367a73f9d119f0a97ddeae02e86853252e6a1ef3d77157972ae2cf5d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489063, "uuid": "4d0c7e2c-813b-4b3e-b0c6-bbed776e0552", "comment": "Malware payload (Mirai)", "value": "e1205b217b807020c302dff38287840c0257cdbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489063, "uuid": "e788e11f-0cc5-44ea-9375-86889f22ab37", "comment": "Malware payload (Mirai)", "value": "27ddbd4d756293ea530e2c23f0759f8c2543ae2af2d01e760eac30e02db13855375b11264046099cd2674fe73f67c595", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489063, "uuid": "c4a5bdec-0b37-4989-8d9b-dad1b0caa880", "value": "T1D66302E2F06AE9F4E66B7E303D240AD19F55380346065B9B85C093FDD9BB54A0C627B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489063, "uuid": "d33b1c83-a272-4ebe-bba6-f615dddce8d7", "value": "1536:hzGqP0009djng1Em0lnHrQGT7nxi+6tfa4/EJbt99eS60JQ0Ict1JYuCp:VGXrdTUEmerlT7xX6tfT/2bLESpetJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489063, "uuid": "49b98295-6680-47cc-acc3-eeb23bf6d304", "value": 71844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489063, "uuid": "4932fae8-c34a-4b3c-be6c-91e15c12489d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489063, "uuid": "dadc365c-475a-410c-80c7-ead6dc697289", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3968ee09-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474488, "uuid": "9fa0f4b9-503e-4b07-998f-a0a523c2d719", "comment": "Malware payload (Mirai)", "value": "5e5e92b2370e736bfa8bd23fec22f7e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474488, "uuid": "69761acb-35f0-471f-af19-e38dc2e160a3", "comment": "Malware payload (Mirai)", "value": "533bf88efc2f6999603395a8c061268e414c6eb31e2d06269fa4a635225ad2a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474488, "uuid": "2910ba5f-477e-4078-a07b-91d830454f46", "comment": "Malware payload (Mirai)", "value": "c9e3250e9295770cb7f75a3d4421cd747f87161f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474488, "uuid": "b9c8327b-7b40-4ae3-9387-84de8e0c1ff2", "comment": "Malware payload (Mirai)", "value": "ce037081cc7d6ca529b72b1f2c546531221ba4c8df171449b79a31635631ece879fc3710bbc422c49c5d286bab987e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474488, "uuid": "75552441-4afc-42d4-822c-742d00404429", "value": "T1A753F886B8819A25C6D117BBFE1F018E3316975CE2DE73128D141F647BCB95F0D2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474488, "uuid": "d97bd825-5c6f-455f-9282-220efeaf0148", "value": "1536:4dnd2Gvoqc/Ljzazt9otOFzVLp1pvCMLZIticljoQ6/:bVqGXzst9QshLpPWljoQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474488, "uuid": "0f6da13f-ddc5-47ae-8304-80c81d47bbe8", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474488, "uuid": "1510ab96-b54a-4f00-b321-449cf3d364ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474488, "uuid": "d9dcf732-b45c-4ab9-b01f-04306e1c8c78", "value": "Owari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca82fee-0447-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770484238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484238, "uuid": "a166f4d6-97b0-477a-9d09-6e30cf55842c", "comment": "Malware payload (SantaStealer)", "value": "eef7f3d0a3034ac5307bb2fdc6413eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484238, "uuid": "712cb109-0a06-4755-8a22-930844fd0ec1", "comment": "Malware payload (SantaStealer)", "value": "554650562de7ff4b0a266857cdd8bad5c3445dbe23816c7898eb679d34652391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484238, "uuid": "d0d84387-2b48-4701-9092-9f83233333b7", "comment": "Malware payload (SantaStealer)", "value": "fd0c6acaa8f5010aa7df85e650a7e501f38bb034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484238, "uuid": "b4886736-a0aa-41a7-920f-b26f9bd34805", "comment": "Malware payload (SantaStealer)", "value": "7ba280c8a9c0bbb8fc0b7af0336b6dd05e01b85c0269ca44f020f2fe6705bcee16c32399562e2d3ca9f0d95ed3a7c930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484238, "uuid": "42c3536e-bdc6-4ba5-818d-0b1ca03a61e5", "value": "T11DC59E0AE15349D5CC6BC0BC838F7131EB357D79CA283D9B17D28B613A95B806725F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484238, "uuid": "29c06a2f-acb1-4b89-a27d-e5457452095d", "value": "d6d4019539ab1757eb53b82c6691b682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484238, "uuid": "3203bc94-8f7c-4c8e-8a0d-6e30829ecb1b", "value": "49152:lwLgW0B2MXHteGLzCnx7Rt80JjIGr2yXEJmgS//cEIu0Z:lpW0jteGLzkx9KAjcyTxU+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484238, "uuid": "0a272876-9eac-44ce-90c4-ec4a384b9cae", "value": 2628096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484238, "uuid": "104355bf-0c5d-4ae4-a4b2-957b7fd0a732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484238, "uuid": "7890923a-f2fa-488a-929f-9e8835f7e9a4", "value": "x554650562de7ff4b0a266857cdd8bad5c3445dbe23816c7898eb679d34652391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172083dc-0407-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770456392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456392, "uuid": "23cff05e-c960-47ec-9c88-e30f288fa9b3", "comment": "Malware payload (Formbook)", "value": "f7f19e394a8b277cf6a297b16adbb5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456392, "uuid": "9122dd9e-4f4f-4156-ae94-add0876b022b", "comment": "Malware payload (Formbook)", "value": "55bb1768ab26a31ebf5d19a43d2d5dbe0a88f7dbdca77b4d8fedcb26289cd6f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456392, "uuid": "974e1a77-e2e7-44b0-9639-b2cf976d3ecd", "comment": "Malware payload (Formbook)", "value": "e0e8f7c858bee2719fcd2275a17ada467a1a6d47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456392, "uuid": "888e0360-2f99-41fb-9a38-098b7b45dff8", "comment": "Malware payload (Formbook)", "value": "cd4ebe01952763bc62e451c0ff4a1471e87840b819e97598aa1e033f0e6ba3a93c1bfd02617bb715a0358e85ef56503a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456392, "uuid": "1da20075-3e4d-4b92-9a40-8290059d48eb", "value": "T17CE42396F7923788C441D7774D22C530C97C35B11A23E24B827DCCD32DB55E8ABAB2A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456392, "uuid": "0a8458db-c48c-47ae-9c44-fb97d1bb979b", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456392, "uuid": "ccefb39e-00dc-47d8-8ea9-506a18fba4c1", "value": "12288:Kz7hU5I5yuNHIgzSFKxWltRohBfSTso93UypubWpyaapYx8zgU/XbefEqCfe9Re3:Kf+iN57Gtene3dlpjapY8gU/Vpwe2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456392, "uuid": "e4e6bf55-8e80-41ea-a689-4a334a0ade0e", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456392, "uuid": "c666c9b7-b70a-44d5-aa2d-7753d49ff465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456392, "uuid": "9ccb7789-94e3-4aaf-836b-23b3f4df3495", "value": "SecuriteInfo.com.Trojan.Inject6.25253.18879.19097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd2517b-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489099, "uuid": "15709e03-099e-411e-a38d-c130a2efa542", "comment": "Malware payload (Mirai)", "value": "031e77b4bf6428f146596b79186b566b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489099, "uuid": "1e10aae3-17e5-4fb8-bd5c-307ac5e7c365", "comment": "Malware payload (Mirai)", "value": "56779ab1be4a837557ef612544862af75f06aa76351cdd6dd4a6d26a58068a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489099, "uuid": "9a4f26a2-2f97-43b2-8e48-1b42f035ea54", "comment": "Malware payload (Mirai)", "value": "dbbf52687aa48bfb42183b3836fdbc2ec81859e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489099, "uuid": "3114bd4c-6e60-4ebb-aa6b-f616b52688a9", "comment": "Malware payload (Mirai)", "value": "3f7d00e7334ef052c9fbc23d69f938d14e358aacde1eb12c68eea4a614bbd2eb71e92254b09c02c54f780e2c863e9fd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489099, "uuid": "d97b39b5-2e78-49c6-9d3e-0f8c6ab0c29a", "value": "T173E37CC1E34FD4FAEC4219712077BB269A72FC39513EDA83D7A89A32D893981D41635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489099, "uuid": "83afdce3-a808-420c-977c-ec64fd668a72", "value": "3072:ZaE2Q3FrphP9UJQDiOJBdvbRwXat6jjC:ZaE2Q31ZiyyKyjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489099, "uuid": "29a78e73-7d8c-4396-be01-dabca1cb1ee7", "value": 143436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489099, "uuid": "0e27c12a-8be6-4d7e-a9d3-8c99a882f0f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489099, "uuid": "1aa29daf-9d19-4b72-90b7-5e0253f12162", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d8a5e5-0421-11f1-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1770467614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467614, "uuid": "ccf28b3d-129e-4390-bede-81847291759f", "comment": "Malware payload (EternalRocks)", "value": "a24f37e6e918371d357aee386a254b0e", "object_relation": "md5", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467614, "uuid": "dfd78dd9-6ba4-4cbb-8ce9-03f7326792a4", "comment": "Malware payload (EternalRocks)", "value": "57713032536e7ebe5bd2e15501f75d50cb1b899cb40e89a5d08c5ec3697ddf34", "object_relation": "sha256", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467614, "uuid": "9f93a199-1405-4bd1-b146-8b39d88bcf6e", "comment": "Malware payload (EternalRocks)", "value": "16292eca8afbafeff64da53e402cd34d2fe27c06", "object_relation": "sha1", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467614, "uuid": "ee66b179-3589-4a60-a4e0-a784f8d01e71", "comment": "Malware payload (EternalRocks)", "value": "a209d03a85c32d0b246364e021638da077eedec1563ff43cac6c2f251439252cd64b730d9463281e0fe1b2214c90ea52", "object_relation": "sha3-384", "Tag": [ { "name": "carlessclapped-com", "colour": "#43D115", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467614, "uuid": "94e287cc-ee5e-453f-b55d-49f1d14cd996", "value": "T16CA55A40EC07DAA3F19133F29B97A70FDD20929E21676BB831EC849835ABD44D27D95C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467614, "uuid": "7cf558ca-354d-4a29-bc56-dbbb724f7cfd", "value": "24576:u4fikpN71zBaG+EunQi3ZH+RORlFWOG6ezd4bAgFkHQ:u4fVzLPOJ+IRjWLxxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467614, "uuid": "6ee01f78-040a-441b-9aa3-f32b45bd386c", "value": 2157877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467614, "uuid": "76cc7e3f-0737-4577-bf99-170bb3ec92e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467614, "uuid": "fc999d8a-16d9-4df1-9415-f409cb6c9b60", "value": "froelichia.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45df0c4f-0464-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770496414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496414, "uuid": "ea1b15cc-7398-4800-94d0-9520ff608a43", "comment": "Malware payload", "value": "f11d56f0c4a3a5f2867e032756d917b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496414, "uuid": "1b0f1cfa-e974-45d1-a075-7430d13cb696", "comment": "Malware payload", "value": "5807a2670ffb89cc2bb9cbca9d95ef9a9ca45eee963e0ce25a3e3568abd249cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496414, "uuid": "9d666cd3-1166-430b-b788-e55b726a2163", "comment": "Malware payload", "value": "62b01d0ae111d411965cba179c1fdcdbf1221c90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496414, "uuid": "d648543f-b1b4-4125-9e3f-e7803f3dbd6d", "comment": "Malware payload", "value": "f2a94ad9288d212f10e426680694d8082ae656de9a1037edad481f2a15c8d8805d0d65fc27da3beb1b4b72f782e78e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496414, "uuid": "79fc20b7-6d29-4198-824c-524097033e83", "value": "T194D73341796AB5E1ECDC7174628209B8B34FB85D0353321FE5DAD24DAC7A8043B8E5AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496414, "uuid": "56a7d693-a558-4fbe-9055-2292e7a04c20", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496414, "uuid": "78d31fa2-88f1-472f-989c-ea7eacc54762", "value": "786432:lwJkhNkt5AlAssSzbfxsbVUkTnvHgDpYCHyav1YdnVENyce9Ryclge77k3VOhiyI:lwJkWyJsW4/ip6Y1YogNmefhiyXlNQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770496414, "uuid": "bd62f0ad-92b3-4a4c-835a-11c0d7181762", "value": 59731915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770496414, "uuid": "79f1ebdb-1c7b-4007-9617-b1301b78946d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496414, "uuid": "adbd89a3-8a7c-436d-b8c9-97e9b2b68cb9", "value": "MeltedFN-0.0.0-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae50e7f-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474491, "uuid": "ddf9a744-a170-4275-bcbf-c34db106aa3e", "comment": "Malware payload (Mirai)", "value": "0fdaa78b6c7f22009b62c3fd6f033542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474491, "uuid": "74ad345d-e948-45eb-afb2-430cf79ca9d6", "comment": "Malware payload (Mirai)", "value": "582dd16ae6f2671813f30f116808eec3f5bd97ceaf5d8edbfcf4d018b6b5c273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474491, "uuid": "899be90d-1750-436f-b666-03e4b5dc9741", "comment": "Malware payload (Mirai)", "value": "36c93c9a2767aac7c5ffa091dcacfb44fd70a964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474491, "uuid": "3bb049e4-5294-414d-bb2b-11105f244ebc", "comment": "Malware payload (Mirai)", "value": "4c86b947fab054b9debd4ab874199392bb55ea2266ce0340eb049753d0db3a387fde95ce8382b3625bd7af41772dbf74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474491, "uuid": "51890a4d-f749-4621-89e1-992e67aaf341", "value": "T120C33B42EA409B17C5D61777FE9F414A3322DB54A3DB330689285FF43F86A9E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474491, "uuid": "b9772336-852a-4373-9a3b-2bd42b1b691e", "value": "3072:tc/BCltnde5hLckPBrPDVpN+Gt4TmxoWM/9xM/:O/BCltnAcErPDVpgGcmxjM/9xM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474491, "uuid": "85930265-20c4-408b-845e-2e98c024417f", "value": 126644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474491, "uuid": "008767ec-8585-49cd-a930-e4201139d095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474491, "uuid": "8c2a62cf-b713-49cf-9479-d427a926a357", "value": "Owari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf296b4-0448-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770484478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484478, "uuid": "e09035cc-ed24-4f9b-a589-3ac0b679f7d2", "comment": "Malware payload", "value": "f3413645618cef6c4d2bd2a9d71eb1a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484478, "uuid": "0a4d69cf-32a6-4210-bd18-7caebd92d7b4", "comment": "Malware payload", "value": "586ff0ff4b5bb490e12ac550b69964f32a915000bfdff8fed93ca7d483330813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484478, "uuid": "3c56e8bf-d8ef-4d3f-a8b8-1f040914e1e9", "comment": "Malware payload", "value": "716999540d2215bcfaafe168e41153a700749483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484478, "uuid": "bcf6e02c-cc0d-42f3-8ee5-233377cfb126", "comment": "Malware payload", "value": "fba53ab96b376d824ccacfbe3cf6729b50da34ca5213f0b98da7804e44635cb4b88ab4e5cf06ebd8c8254048cb532696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484478, "uuid": "00d31ee3-d440-4907-86aa-e05c19dde7b9", "value": "T1B1A6CFCAD16E44D2DC053FF9A8142AC79B2447728A740028366FBD498F775FEC05EEA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484478, "uuid": "c9682c00-7466-400b-9a11-f01a31706225", "value": "fcc736760ffc18b2096bf8dc1a972ac5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484478, "uuid": "ebe8ea69-9a48-49ec-bf0c-a6650915eced", "value": "24576:jo8xwcCTjZc9/7tmUImJY79fPuS2FP3LuX8kpuj7iODa/Fz4JW5w4JvHrGl5nipl:jo8xwD6C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484478, "uuid": "c697a58e-2bbb-4c50-a6b5-db9707fb8ae1", "value": 10088777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484478, "uuid": "49f61007-c0f0-41c7-8d3a-065e507cff51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484478, "uuid": "01b68661-0a59-462a-bb6b-b6ac521cc7e9", "value": "xQ4gNK9auvFo4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5dc564-0447-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770484182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484182, "uuid": "55677c80-1ce1-409f-af8b-3bd8283d0930", "comment": "Malware payload", "value": "204fa4b4ebf3a18e2183462eb0c87da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484182, "uuid": "3c08c4ff-11eb-48fe-a1c2-b0e3648ae515", "comment": "Malware payload", "value": "58aecdc00cecc0a2601fbaab0023a0e125d972769fe9a3e04c24e8333ac55400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484182, "uuid": "7ecddb5f-a883-4386-9e5b-792119acccbe", "comment": "Malware payload", "value": "3f8c0aafeb95c8569c16ed067ebadf420bbb90ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484182, "uuid": "8ca3a4c5-25d4-4600-8869-99e1008dde7a", "comment": "Malware payload", "value": "c07a7c8cd86e423f4e09baa3473f503133377794e45d1d4771e1605d9d8253a913465f97d5f70f8764b0c3a398ec1e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484182, "uuid": "cfc9583a-f0c5-4633-9d43-8c04a9022b31", "value": "T1F9D5AE0AF25349D5CC5BC0BC839B7131EB317D69CB242EDB17918B613E55B806B29F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484182, "uuid": "9fc51b82-92df-419e-8bba-fc2174a7defc", "value": "1e71a6dfe71991a69e79c1243f113f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484182, "uuid": "aea2e2d0-0261-4115-94f1-62ec71dc0c16", "value": "49152:YNGZEXurRHg9orH/oKCQOydhYMJucKK6q3MqCc/9kye8:YcauTH/oFQOyrYMkcKzjw9kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484182, "uuid": "3e710666-4e53-45b2-9a8f-9db63269b947", "value": 2982400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484182, "uuid": "c55b17ef-824e-4f73-9492-9ae0dfac80db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484182, "uuid": "8cf9054e-e8b7-413f-a065-6f22dfd2bfb4", "value": "KeyGeneratorPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ab9f1e-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500658, "uuid": "dbc7f21d-d817-481d-81b5-10619bb47844", "comment": "Malware payload (Mirai)", "value": "b85e49d97557f964412fca5b8d5f4467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500658, "uuid": "13778dad-efb2-40e4-9d62-5b8fea1aafa6", "comment": "Malware payload (Mirai)", "value": "590f5bca4e6acde0e5bc16af42b42ba6619d84bfd6625bb1763acfb0c875fe47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500658, "uuid": "a89b9874-643a-42d7-8e66-c8aed4733436", "comment": "Malware payload (Mirai)", "value": "b1e1acd8ef467026541fb24c9ce7b1fbf88974cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500658, "uuid": "3e6ce791-e2b5-4413-a0b1-ab51e745bb0e", "comment": "Malware payload (Mirai)", "value": "938547b1fdb12e87be0a919d580be50bb9aff2e2531049e5481673d9f7cac2f8866e6ef1a2a8547b10cb741463f00855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500658, "uuid": "750fe0bc-d593-4781-8bc2-d918c77c2a01", "value": "T15DE35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500658, "uuid": "70096281-fd43-44f8-85f5-0cc8b4b1e904", "value": "3072:7oDlIyA+oy+ZGiT6/lZoEhH5lgLOoe97dlJ8jd4:1Dy+ZGaEFxoe918jd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500658, "uuid": "cecd6a88-1350-40b7-a8fa-d3d6ad7c071a", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500658, "uuid": "d15de5cb-d8b3-4980-b830-8652596d059a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500658, "uuid": "b405837b-5b44-4d75-8c65-8d6c416ad43f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027acdb6-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770466665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466665, "uuid": "4b209d48-e18c-4ad2-98b5-d137cc2d91a9", "comment": "Malware payload (LummaStealer)", "value": "41eb1f6ae2632b94423415d91e62a473", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5079", "colour": "#32D617", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466665, "uuid": "c32d716f-669d-459e-a58b-11b535111a44", "comment": "Malware payload (LummaStealer)", "value": "5a35fee6cf40115046f5472085be6b769c7fdbe74d6246a9f758ca5e3e4c7662", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5079", "colour": "#32D617", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466665, "uuid": "70b68b13-e752-423e-bc23-4c39e75cd116", "comment": "Malware payload (LummaStealer)", "value": "bf805b59da0072c2b2c72006660c30bdfb1c28c3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5079", "colour": "#32D617", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466665, "uuid": "7154c9e3-7d2e-4d76-927b-ec7013a87391", "comment": "Malware payload (LummaStealer)", "value": "3cf6f2e1fb1d99667b2dc09ac5152e4ca52bc3e231de74251e91b1f0a0144225abbd76c5945740dee44fd55fcab4bfa9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5079", "colour": "#32D617", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466665, "uuid": "7c750fab-8f2a-4bdc-bad1-3876e92432f2", "value": "T1F1F633D14AE063EADD9E4D1E5E3E4C6092FC268A1843107776A67FD537252AEE33B301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466665, "uuid": "f3c08dca-b366-4e01-bdcf-e39ff7234f1e", "value": "393216:LQGJmc4cWv3kv3EyX1GOUZBfyc2+r/DuJHsmv:LZdzW8zl3UL72O/DuKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466665, "uuid": "d06f4c52-400e-4e41-b1e4-b83ef6ff30da", "value": 15323987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466665, "uuid": "34591132-8054-4dbf-9ab7-ace1add343df", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466665, "uuid": "10affab7-81e6-45a0-aa08-47dc29aa0663", "value": "cx-programmer 9.1 free download Full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9602377-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466972, "uuid": "1c186ce7-a575-4242-b9a3-38a72ac7abfa", "comment": "Malware payload (Mirai)", "value": "9952bb91b0e6343fd367f7e989a97fe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466972, "uuid": "5ee59a36-0918-47ae-8c4c-f6c5cc6cc62c", "comment": "Malware payload (Mirai)", "value": "5a6cb1583cdb6d5042807eb54bf796f6a990f4d8a653b504352381936a5a1b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466972, "uuid": "f05949db-8f58-486a-bb8f-1eac9460ce06", "comment": "Malware payload (Mirai)", "value": "d1ee5f093c2464755ed748c7566b5f3c9e04d3dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466972, "uuid": "fedcfad6-b2a4-440f-b0c1-27200f45bd7a", "comment": "Malware payload (Mirai)", "value": "3628f569d2e4bcc0c5d943615833ae46fbc7fc0964e9412b3c7c4de82a1105023801f16cd163f2bb08ec5057d14035ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466972, "uuid": "5eed7aaf-29ee-469f-a7d7-99d9e1de3066", "value": "T1C88329C1BA4BC0F5D90748304067F33FCB31E6398065C65EEFAA9E65DE33642662629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466972, "uuid": "a554580e-fdca-4d92-927e-46e3bf9c61a8", "value": "1536:G+OY7S59Q/kSY+W6SisVWAcaHWSaC3jxCAorF6ShGF:G+r7s9QxYzzVWHZgjxC9rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466972, "uuid": "c53f3127-9717-4dce-b1ce-d70182c2ed76", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466972, "uuid": "49cd9ba8-01d9-4a3d-8e66-83fa728ec688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466972, "uuid": "4c421ca9-2fc0-4250-96dc-8ed5d72474f4", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f05561a-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466740, "uuid": "a5e7ccee-2509-465b-b637-9d5f3d72caf2", "comment": "Malware payload (Mirai)", "value": "6ce8a07330361032976c13a3e10bda8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466740, "uuid": "f02122bd-f12e-40dc-a7f4-bdddf3699998", "comment": "Malware payload (Mirai)", "value": "5afff89550c60f58eb9e1a2905dcd3e019174707ba414f22e215242e143118cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466740, "uuid": "1070db26-f0a0-4e6c-93f9-235f597a159c", "comment": "Malware payload (Mirai)", "value": "1514c7c6d153958e1cdb3192b4eb4e468211756f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466740, "uuid": "c4d50390-b443-4566-bf3b-dd7f9cc311a8", "comment": "Malware payload (Mirai)", "value": "df5a64f4a86c318718f59124c4ce8c6665ea836cccd6608d12d2945c198de25870bc4c989f1bd7f47d73b1d423ed2120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466740, "uuid": "614c26eb-03e8-4b37-8d03-0ad364893659", "value": "T1FFF4BF87FAA15DEBC02247750CFBC330431ED9921387BB46B97D8264186726EBD4E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466740, "uuid": "6cf9d978-c764-4b06-932c-7c6f92de0897", "value": "12288:1MSMQTNxaYQh/2Z6dPOM0xivD57V1TyPD5Xgf0qEZpTmO4SqgHuZTQhFsjy:NqYQ5POL29R1TNO7qKuZ0hFsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466740, "uuid": "db9d57ec-94bd-43eb-8aac-51092f632d00", "value": 767292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466740, "uuid": "20b03db2-0f8e-46a6-9cf6-ed8f3c40bc4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466740, "uuid": "38422b1e-a713-4748-8cfb-f8ad4a47f846", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7219634-0477-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770504818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504818, "uuid": "5d80bb57-5985-4fde-84f3-dc74358298fc", "comment": "Malware payload", "value": "af04ac65c43f338075583ea164e1458a", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504818, "uuid": "59903482-b15d-418e-8f47-ac061323a6d8", "comment": "Malware payload", "value": "5b4a71057e82b3c22f8c585d64ac367f8dc01d12359e432fa9c525253f474e8e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504818, "uuid": "3245a577-6588-4f07-ad21-5bc91b6248f7", "comment": "Malware payload", "value": "b878fac82adae4ba157b2effd36732830c97e3f3", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770504818, "uuid": "9ecc97a1-337d-4719-b737-fb39b8e82800", "comment": "Malware payload", "value": "f61aee19bac27b7323c4929a8bb9b043073f7a7c90e6b03581f47e022390869196cdbb187d30ce54401b953bc1ec8ba8", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504818, "uuid": "76e7dbdb-15de-48cc-ad17-788968ba3a6e", "value": "T1E01833BD89738E554196316626E036429C89BAE34423CF32F72D011D97FBEFB616860F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504818, "uuid": "c0d3aab1-83ef-4e7a-ba0d-780338cb425b", "value": "1572864:2wbHLmXZf5zysESNjgQUJQoMNYQvioOCaXfS5Wr4s2jXBpxc9sRZ3LtAK:jmJf52wLcQSaTOTXq5HjRp4y0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770504818, "uuid": "30a569e8-f4f3-4b36-a307-1946897b2b32", "value": 88294650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770504818, "uuid": "407f9577-ddd6-479a-b0c1-6b59105de71c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770504818, "uuid": "51f7ccb8-27d4-4498-aa3a-7db2429f0fd4", "value": "loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d5e6cc-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500661, "uuid": "4798566f-60e2-46ed-9f99-231fa9066d2a", "comment": "Malware payload (Mirai)", "value": "75925fe8c86c606a31fae1dcc09afac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500661, "uuid": "6432010c-3c9a-47d8-a389-56fcd95f098e", "comment": "Malware payload (Mirai)", "value": "5ba7f554de9ee85c6d5345bf2744fc1f6cd8864e837829a618e21872c1ceb142", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500661, "uuid": "20315d04-1e13-4702-b814-5511c401d12b", "comment": "Malware payload (Mirai)", "value": "93b18bda63160dab25681ab0d61af71f72db191f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500661, "uuid": "3743084b-16c7-4651-93e5-48dcc417d49e", "comment": "Malware payload (Mirai)", "value": "642f4c1b05a5228af2728519e9af09a7923cf444a0b480fff035ce663a6e96761a1b6c8f2b85886632d6bb0502eddf6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500661, "uuid": "0fa8d924-e32d-44d0-9e64-84869dbb65a7", "value": "T1D7D33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500661, "uuid": "28342d61-13f9-41fd-889d-cf6eb65c0730", "value": "3072:JuVeGJFWOgt9ctajH1I7sr41o+YLyXzXgvs:JuVwt9cUH1I7srMeLmLgvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500661, "uuid": "758e27b1-42c8-4e54-878b-8f75626990e3", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500661, "uuid": "39452207-c217-460d-9a53-3bea9bf34007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500661, "uuid": "d5f6430c-d6cb-4ad0-8210-62d606f29130", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5f3d6c-0446-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770483618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483618, "uuid": "7168eb00-b8f4-4e54-8296-b2583ebd8558", "comment": "Malware payload", "value": "666938cb2b0a205116e4010a56e12f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483618, "uuid": "53f72dcf-e709-406e-a780-d2c0ef5c9b24", "comment": "Malware payload", "value": "5c0b6527e0d225303940e972ca44c084473bc07fdc33da5d56734e7396426592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483618, "uuid": "feeb3f8a-17cb-4a62-9880-125fc4358788", "comment": "Malware payload", "value": "26b0b496f9d178788f9d13960b124dfeb9b74c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483618, "uuid": "9f61ebe7-a2da-4ff7-96c5-27843f401d99", "comment": "Malware payload", "value": "60ddc0eb6f80ed1a561f7887febea24840d7fc64da51ae166ef8aec629adb903e3ada419214b5ffba2c7e54dbcd38162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483618, "uuid": "ee59a327-12d0-4236-97eb-a84b0e87eb3a", "value": "T11FE55A03FD80A16AD85AD2399DB093517730B8981BB533C33E52B6B42EB63D81D76B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483618, "uuid": "90b6c79d-6f78-48d6-9821-134e80e743ff", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483618, "uuid": "45a99e82-5291-4f58-8b43-2b644ef3a1a5", "value": "49152:tyUpnox7pQNOqQi1U5eptDtzTo1eYQgi9bIrcIEXX3FAB19y9kpCK1evGxC7A2AN:FhYSNOgU5SDtfbYQgobIrYXX3WekKxoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483618, "uuid": "c07389c1-1316-4d48-a72f-eb4362e11436", "value": 3046538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483618, "uuid": "502cd854-b692-408b-ab6c-78e07279e3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483618, "uuid": "5b0500f7-1234-4b93-85a0-ad8f10be53bd", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e326bc-0451-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770488542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488542, "uuid": "82882328-81f7-4180-b24e-bd83ebdb0f6d", "comment": "Malware payload", "value": "203585b7a9f1315b457f2d1d034eb7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488542, "uuid": "74d28abb-a7f1-4d09-92d9-9866735fdbc0", "comment": "Malware payload", "value": "5c7d41958ec61ff084be0443afd634dbc5cc3baa15687bfc10df1ffe88cad084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488542, "uuid": "ae9a53bc-fb4e-4152-90ec-07adf766a550", "comment": "Malware payload", "value": "e7184f81c23204f5a33e9af01604a79a2e69bec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488542, "uuid": "f83a7d97-c777-408b-93b3-ef572db83972", "comment": "Malware payload", "value": "98489f30a5af8584724232ca10612873b56a8c363cc4db70935c803af392d97ee694b1b7dd8a5559c539c11f4dba5e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488542, "uuid": "a6f81400-2f24-41f6-9dfa-b1d6ac4db163", "value": "T12683190077E94016F2FEEF7498F16095567BBAAB5A33E26D2CC9218906237C0DD41F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488542, "uuid": "219f15ba-2d87-4294-8984-f3dcdbba272e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488542, "uuid": "19b76b28-4c15-4947-bc1d-6c8713a28bb2", "value": "1536:kzBi2sstyodQbe0b5v56bqv76BeW/SNHZc1dbu0I+CYOyLVKileRZDvOK3zIK6gT:yI2ss/b2MbuitOyLVKilIFvOK3zIK6gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770488542, "uuid": "5170ec30-8127-4f5a-a8d3-8228d950f8e9", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770488542, "uuid": "caa465d2-2d48-47df-a2cb-b62cbccd0b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488542, "uuid": "88d6c8f1-7a62-4fe3-9eef-f0955063af30", "value": "5c7d41958ec61ff084be0443afd634dbc5cc3baa15687bfc10df1ffe88cad084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699294ae-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461684, "uuid": "88613d24-9c77-4748-b59a-b9fd393a225b", "comment": "Malware payload (Mirai)", "value": "06a4adac016f6fad985f5d6e9b4ddb11", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461684, "uuid": "1697c4c9-919d-471e-91ff-858ca8b03c11", "comment": "Malware payload (Mirai)", "value": "5c8d9e6428f8aac46c4fcc5c65474e5e9da8712f563d66c0bcce4b595e508fb5", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461684, "uuid": "e5f58b9b-c7bd-46a4-ac45-1dfbf0e889cc", "comment": "Malware payload (Mirai)", "value": "16137677ba88504d9835cd71a573260ad327f92f", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461684, "uuid": "c9df89c7-5819-4ccb-9d63-e12340230fb2", "comment": "Malware payload (Mirai)", "value": "9ab21b9b8a7406e93cb02dee5fac7bc026c4c9b525d3b15c7a97b6668f2fbba2e778e8e337be3bfb547329ba5658b18e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461684, "uuid": "503ebe5a-f725-4fe5-b67d-778e23b82818", "value": "T120961951BF88DE1FD69820358AA7C23833D63D00C1E064369756F71D2EBE2B5A91BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461684, "uuid": "52295940-7e58-48a7-acd0-543b7307a154", "value": "49152:NdqWTzY6L18lRpPsOiaZHVx2xsqJuv6LvYp9+obRMHHEt5Eq:ui81BDgql1anEjEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461684, "uuid": "81a6a80f-c841-4380-b9d2-ad0b342e53bb", "value": 8913080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461684, "uuid": "ed07e97e-2c4e-4ec7-bd22-024606f36152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461684, "uuid": "d0a15a80-0e31-4422-af66-729016792332", "value": "kintegrity0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4588c8ed-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489112, "uuid": "1ac45733-7356-466d-9a7d-fd5d94f3bf59", "comment": "Malware payload (Mirai)", "value": "5931c64ca1ad12b94dd71e0c29599bfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489112, "uuid": "f3e9565b-fc68-48a7-8097-b1de4a48e581", "comment": "Malware payload (Mirai)", "value": "5d0727dba26603158cb32bef0fe0af7d1e8466067d6a2454dd3f5a4cbac1f0d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489112, "uuid": "d072648a-ea2f-4261-9d9c-8af41b9323d3", "comment": "Malware payload (Mirai)", "value": "50932e10c2f0eb149d26659f2b159ba308345349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489112, "uuid": "beef9865-6134-4d58-83fb-3823958fe06f", "comment": "Malware payload (Mirai)", "value": "e21b2cf4e6341e61b09141b0a747948910bd91d26658d01a0c97b0be0898c8d94e2b58116ebb27fa5c543f9541d0f8b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489112, "uuid": "e3ed5d9f-624a-49e6-a929-6747491a57eb", "value": "T106E3398CF58FC1F6DC0788308066F7BF8B31A4258076C69EDF98AF75DA275829216359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489112, "uuid": "393510a4-bc11-4b26-89f9-b57bf77949ab", "value": "3072:SLNbgLe86f7mtsBiG0fLVeJjf3KQxz2MQSzVM1ySDDw6DXDDDDDDDDDDDDDI4DXb:hLe8k7mSiGc5OSdwM1ySDDw6DXDDDDDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489112, "uuid": "5896b0ab-0dad-404d-94e3-21e7640b1506", "value": 154060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489112, "uuid": "85d5f605-7145-4bdb-8c45-eb37dc8eb838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489112, "uuid": "5fee00b0-f03d-4e53-94ff-10358550dfae", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dd8cf9-03dc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437982, "uuid": "35ef6829-1403-4c7b-a1f7-a7528acd3c2f", "comment": "Malware payload (Mirai)", "value": "0bdd812eade5f37ba12049c3a52ac7b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437982, "uuid": "fc525257-a57a-4973-a77b-85886e5e9bc1", "comment": "Malware payload (Mirai)", "value": "5d889d8a93c1d8adb19662309324f01d31fd9e6ebccc0b92b52122b35e6554a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437982, "uuid": "d6db8968-ceb1-48fb-a779-e83508cf0e25", "comment": "Malware payload (Mirai)", "value": "89c5dcec416f4f856950fae1220a897af987846a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437982, "uuid": "384bc1b1-8811-430c-91c7-edc30923e687", "comment": "Malware payload (Mirai)", "value": "c82d62c6ac8d66e59794d91420cf18cfd15c1ee8dd55db21ef5f09ec4eb41839ff92e84ff23ef51b4b25a333da592152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437982, "uuid": "52f3a724-ccd3-4bd4-9e22-026c2a9e1ece", "value": "T1F6262951FACB94F6D5031D3040ABE2AF5731AD098F25EB87EA007F2AE97B6911D3610D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437982, "uuid": "7137ceed-2bf4-4d44-983e-bc5fc1133c4a", "value": "49152:jFPnZcrHbtUxJfvZE9yt0irV/alfBcSHonizm9J9Z/0QhL9DyonDu8ZB0q0VF1:jhnZAoJfW9yA6izK9ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437982, "uuid": "a5321b8d-9d5e-4873-ba6b-e241c589390e", "value": 4452352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437982, "uuid": "f912c243-f0c0-4f38-a212-8f8db17b89aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437982, "uuid": "b2ffed36-ec6a-4bbb-90c4-e578d2067fcf", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726761f7-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466853, "uuid": "3e47f192-d7a8-4ede-8207-d83b64a16db6", "comment": "Malware payload (Mirai)", "value": "7cdebc0cec833335ca3287477f0f3e50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466853, "uuid": "e11df6cf-1171-45e5-85af-ad23ae9c5518", "comment": "Malware payload (Mirai)", "value": "5dfb3583d654e9c93e757a0b4e0841a680d1996948924daa36f823c3e43f0a30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466853, "uuid": "074ee4df-1dca-47fa-acd1-5bcfb737027d", "comment": "Malware payload (Mirai)", "value": "99d06f586d86b2d15ca3f0ef7293a827983699ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466853, "uuid": "cb3a96e0-50be-4660-9ce0-9d86d9ae68b7", "comment": "Malware payload (Mirai)", "value": "5a2d10a87d3ab4bf5f75ff5d4345487f4a8a1220672f3383eb41a24d0682ae1cd3db3f03b27706405b51c5e405fb9982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466853, "uuid": "6853d223-3be2-4711-8719-9f602c941c01", "value": "T182433D92F85245AAC6D117B9771A978A336367A9C2CF7313CC080B5076C9A4F4E77F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466853, "uuid": "a3b9009e-ae67-4259-9048-9bc900b4ae47", "value": "768:L2uoWsQCLk1597ZGYHy5x8dGBBrmYZf9Or9UKGZ4W8TMg2FX0n7zZt:LABQCo7cYgycnmIFOr9UKGE/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466853, "uuid": "9ae94a8d-cdfa-4429-b37b-df06e38e52f5", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466853, "uuid": "f97b3a8c-59e5-4d4f-9e4b-8e13094fbfea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466853, "uuid": "5ebc1859-e408-44ce-ac77-c5efde2ae41a", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e22e42d-0445-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770483220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483220, "uuid": "c18ed7d5-d5df-42ac-804f-75aad2423d1c", "comment": "Malware payload", "value": "bc32da13ae08bc8fb5c103d487b94b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483220, "uuid": "bd2e9d20-57b0-4c6c-ac3f-64dc5e7e6892", "comment": "Malware payload", "value": "5e9fc86ad016fedf301b466e1ebedd5ddb29573f3ea5ef9956c2141d7e1ae64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483220, "uuid": "db94570c-f6ad-4c80-ac12-ae9b010cc0c2", "comment": "Malware payload", "value": "14d29332801ebee6869072ff51dfb6ea520b26df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483220, "uuid": "3b4e9d69-9835-4f43-bfc1-ab2eadf93973", "comment": "Malware payload", "value": "709d1e9a137a63c7c6db8cd75a8504e7218681573aa070920b194476e5c6707867206bf72694f4bdf7a9260c2dbf985e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483220, "uuid": "68dd9436-43ab-45c8-a7c4-522a811b6306", "value": "T179162A12BC914866C12FE238BCF553613A3138B9837A77D31A87657A1DF57C82A3E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483220, "uuid": "302bbd90-c4e4-4f84-8395-3ea8edc2fc8d", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483220, "uuid": "a908ccf5-0430-40dc-ae9e-3232aae0fd24", "value": "24576:Gg0M1a/Og3oN3ZGX8H21K1pCkUNuIHE3fHX9FSINCzn3+Wq5Qwbn4kDy17XGiwFf:Ba/h3oN3Zs8H21K14mIHE/WTgb5D8GDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483220, "uuid": "5615571c-f0e0-4321-9797-4d7fa4465b8e", "value": 4352464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483220, "uuid": "a34ea59f-9b63-4d5b-93c1-7ed8151a7b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483220, "uuid": "f2c8d836-d97a-4492-b709-76a9ceabae12", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b37442-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474487, "uuid": "5a06bd4e-db23-43f9-a69a-615c0587a935", "comment": "Malware payload (Mirai)", "value": "ba0c2bd32f60ed3d2dce4b50d205720d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474487, "uuid": "a6949412-f38f-4b22-8607-73c41eb4695e", "comment": "Malware payload (Mirai)", "value": "60cf877c6a9fcbec33ff8f3456c81f2f97638cc515e674f031cb5752f49d93db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474487, "uuid": "6fc97863-5e0f-4b28-8b8b-f287632c3a32", "comment": "Malware payload (Mirai)", "value": "51efa0b6c9279b90114d5c9531247f0519f223c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474487, "uuid": "8eeae34f-f321-4d48-800b-b7c3ac6b5335", "comment": "Malware payload (Mirai)", "value": "a74f9debf653f6841e28e3990d0d82cc7efb61ec8c6cd071133d66db3cfe3af1d98321b91a0fc3b3c1d079ade1458e61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474487, "uuid": "9d98b2de-cbb9-425e-9c7a-687be73cd3c5", "value": "T1CC4307C17881A626C3D05377FE5F018D33199798E1EA33568C295FA47B8AC1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474487, "uuid": "66f98c98-aaca-4d41-8c25-809de02c4b32", "value": "768:K/9qJEBv+zFvDLtU07KuucD056SRmYKrI4ekVrZBfV7nKbwvTLwCVy/rCxHghW1A:Kq+WFbpnJYKrnj7nKEShW5i5m//zqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474487, "uuid": "09fe2789-7d28-4017-a551-80891ddc842f", "value": 56332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474487, "uuid": "c667b29f-1936-4aa7-b664-c0a41c97653a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474487, "uuid": "8f38c2b0-7510-40f0-a7a4-5374b7aef919", "value": "Owari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54eccee-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437384, "uuid": "67600871-f36a-408a-be78-93b4906f4db9", "comment": "Malware payload (Mirai)", "value": "d71e159a88af973bbcce9f035102e262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437384, "uuid": "2d7cf63f-f956-4c8f-97b7-70f80bff9563", "comment": "Malware payload (Mirai)", "value": "61345673ac73b13067cb9aff9edacec1338955bf4afddc3313cd2abc77994be9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437384, "uuid": "668b131d-55a8-43eb-bb77-061896aa7443", "comment": "Malware payload (Mirai)", "value": "0729d28bf8ebddfc28620d61cfab7b42b40c818b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437384, "uuid": "80745435-93a2-4632-ab63-960b4bb56426", "comment": "Malware payload (Mirai)", "value": "1a71cb5801a59a58ec14705c6d66f814b308a158be7bdb0f6145638bf7127178c778d4349fc8275f70e78fbb846a4f36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437384, "uuid": "f6c92d95-0c24-4538-a4ef-50d196bed85f", "value": "T179333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE62AE32A02711B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437384, "uuid": "93ae9681-25e0-46fa-8ff6-4755d11180c2", "value": "768:cwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98nN+s:cwOt37pOzwLMU431ANA0BLBCbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437384, "uuid": "6e65af00-7b4c-4efa-a2dc-ae08e9cd0c27", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437384, "uuid": "cde3cb8e-41e8-465d-a449-bd6f0aff0dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437384, "uuid": "6a5933a9-71c5-4c36-9091-d2ea4e42c560", "value": "israel.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffd42ba-0411-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1770460836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460836, "uuid": "65b7973f-a63d-4e46-b24a-224388aba37f", "comment": "Malware payload (RemcosRAT)", "value": "c87706dce86308385c6f87ca6fadd7c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460836, "uuid": "09550ee9-7a12-4315-ae89-a47e11daa7c3", "comment": "Malware payload (RemcosRAT)", "value": "62fbbc55b13e699fc67520c4ef189b071fbec2f059961fd63e7c4e424b2df42b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460836, "uuid": "8b91fdc1-5fb1-421d-b913-68830bdc59f3", "comment": "Malware payload (RemcosRAT)", "value": "3c6638c0b1871cdb6541092638db39d7afac4c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460836, "uuid": "b63a7782-8819-4506-94a2-4d66c2c545f0", "comment": "Malware payload (RemcosRAT)", "value": "24dabb20aaf3aeb6f3052bded262b4b84bfdcb7d916d7d635d56eca218beb38dc63beb5e8368165a2f6a71ed4c9e6438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460836, "uuid": "7d837966-2cd5-4a13-98b1-be6a96893cd5", "value": "T14356121EB28BFC3EE05A3B374572E16454FBB66D64226D1686E4849CCE25CD43E3E603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460836, "uuid": "16474992-8f96-4cc4-bc4f-a00c4654b533", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460836, "uuid": "96deef92-47f0-430d-94ea-c0df4759e0a6", "value": "98304:MrzwNvj7djn4smdeSRPqXiWc1Qhzezcr0aS08JcG7+CV2jv8ujQAuDcPLrzMyydx:a6vJ4/ewPqXBcqhC6CaGKCIz8KEayX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770460836, "uuid": "2640e4aa-c9d1-4b83-931a-fef920b83a5b", "value": 6177640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770460836, "uuid": "7fbd366a-0486-4424-aff3-8aeb5f811c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460836, "uuid": "dccb743a-6cb0-4cc4-993d-789bfcf7f0e7", "value": "synergistic_151.2_instructions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33daf507-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474479, "uuid": "654b7efa-5279-4eac-9b2d-02a7d4f67883", "comment": "Malware payload (Mirai)", "value": "000e97ad2f9895f3b505ea4e5b8c3cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474479, "uuid": "c79ffbe5-9a80-459b-8084-9fb4a45b68f9", "comment": "Malware payload (Mirai)", "value": "6335958f87009f0c085150fbfc91707439a9e127d561afc44c8c5a69a76077e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474479, "uuid": "06af4f4e-a9da-4457-99eb-62b25d90f37f", "comment": "Malware payload (Mirai)", "value": "50ae7bb4ee33d390b809cba6566dc2dbbcf030fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474479, "uuid": "9bf44e32-4fe9-46be-858f-f18545791472", "comment": "Malware payload (Mirai)", "value": "9241a5c579315ff56d294a29392467324b8940884a5374f05ac37de6c5ec79d80b28d913d83e0ea5be99bfa255f98692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474479, "uuid": "1a16a3ed-2851-4886-aa0a-e742fa13524e", "value": "T1C163971A3E219FBDFBAC863887B78E20965833D616F1C584D15CED015E7038E645FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474479, "uuid": "36be5edc-393a-4af1-a3a0-21ec40979152", "value": "1536:2VVUIa+SzL6P1rNVHV0vaEfKOYFRhOJmuE79ywo8eFpV:2VqIfVBNf0STDhO5PPHrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474479, "uuid": "5ee57dc6-8464-42fc-a4ff-bc6805340016", "value": 68804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474479, "uuid": "0f058cce-2a2a-4bd2-bcea-d42da01f967d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474479, "uuid": "d9459c33-de87-4c35-920a-4fbc78d83814", "value": "Owari.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a60ba7-0442-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770481866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770481866, "uuid": "f5cf4161-7a08-4f99-aecd-22a44bd5568b", "comment": "Malware payload (CoinMiner)", "value": "483c27cfff87bab395601673908dc935", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770481866, "uuid": "dc6cb316-cb2e-4153-ba26-45bbcdfcadd2", "comment": "Malware payload (CoinMiner)", "value": "63fb1bb6af66fbe29823c5ac577034207888c3bf23218c96777ec63bf7499afd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770481866, "uuid": "d4f9fc29-7a4a-407d-9d7b-a818efb77936", "comment": "Malware payload (CoinMiner)", "value": "8df8e36afadc0ee02f6726abe63b83af97bd7fa5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770481866, "uuid": "ba97ed59-3b83-49d6-b2df-2a0a513f0de5", "comment": "Malware payload (CoinMiner)", "value": "ea377fc025cd50d35fd43dfe8b5cc106e70a031fcef1a26561bebea9c9eb60a17c38ed4885b54aeaff6cb2758d212efa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770481866, "uuid": "05bd5baa-8067-4e33-9cf8-0b2b5a885c95", "value": "T1AED523CDA1F48418C3405272FD3C997C606A289E471CD6DF63E8933838A5BE72AB759D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770481866, "uuid": "9cd836ef-e681-46b6-81ba-b80b93cb1338", "value": "4b3ee95f35e7f4c0001cc18c48681f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770481866, "uuid": "a10aca72-2705-4696-bbf5-e72e21aea744", "value": "49152:aUa9W1kVvLfK1M2x+GBjhL8CaGzaXHPcMdUB39A+g/yWqG/iAqvFOjQ11lgP:aUoFVvLeIEjhL8hAcVUB3leQci9vBCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770481866, "uuid": "343b48eb-25b5-4450-9b55-64678c8c152e", "value": 2903120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770481866, "uuid": "34417f42-0575-4be4-997c-e9c023d6dc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770481866, "uuid": "f90f95cd-5c8c-41b3-a922-2c8542769061", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddce8f00-042f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473905, "uuid": "84c6c105-8c48-4358-9453-cccfee244b96", "comment": "Malware payload (Mirai)", "value": "9e804416758090681516b425000ca82a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473905, "uuid": "95f69fbc-135e-47e0-96fe-e45978d82982", "comment": "Malware payload (Mirai)", "value": "646c2dd2f27f34635c3dfa10910835aa083d6aa4dbc20f686092e1ed30c41893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473905, "uuid": "98579190-4c2c-4739-bcde-cec4ba228b7e", "comment": "Malware payload (Mirai)", "value": "2489d62887f72f0b5b7befc3ebb0acb8f79de0d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473905, "uuid": "25b7588b-e73a-45f1-9fb1-5d4533f05d0e", "comment": "Malware payload (Mirai)", "value": "89e7b4818bef367d43be9e009cc06cf92b72527641ae63547ad5da79768b773d2dd80bc87b68349925b648f6184cf95b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473905, "uuid": "8ce0d132-854d-4e38-a1dc-9c316ac3145f", "value": "T16DE44946F8808F62C5D12676F65F8268732347B9C3EBB20699184B343BD796F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473905, "uuid": "8e9c92e5-82e3-40f5-aa08-71ead55e4d7b", "value": "12288:N0XDF1rToBQvxyqiix7KIqZk1Xc1l2fnBAaMS8p1M5KAMfxE/L2q:NSF1rToBGH1x2PZMc1jOCfy/L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473905, "uuid": "2de84a47-6e5c-4a12-8491-72ef0d11ba62", "value": 658512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473905, "uuid": "15f647fd-302c-4103-86a8-f463909066bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473905, "uuid": "5ec05f3a-85a7-4ccc-af7d-60356ba50d8a", "value": "SATAN.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ce0243-0424-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770469189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469189, "uuid": "38283df5-b506-4e8b-84a9-43a4be29ffd3", "comment": "Malware payload", "value": "ebe184e152adc546e0ee992c0406ecf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469189, "uuid": "d6d6d790-e5df-4e45-940d-3afa8a8c9fb9", "comment": "Malware payload", "value": "64b2ac8dccb2b192dca24c6f19839cd4da7740065a7433e8bcd6b21b973d90a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469189, "uuid": "d0717106-066a-4fe1-a88c-d3b538c33f56", "comment": "Malware payload", "value": "1a985140c775b2e9506beeab890c9d9d2383ac0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469189, "uuid": "80ffed13-9916-4636-9f48-b35cfe6b7193", "comment": "Malware payload", "value": "bf099a86392da6627d65c23f40f5c260f4edd14d831c74491e61e8878612d3e1e357c5dcf7586dd216c960f267074ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469189, "uuid": "d49abc9f-0708-4723-badf-14a7f28751cc", "value": "T18B442907A66998F5D4B3D23AC542296AF6B17C058371D7DF43903A27AF336E0D8393A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469189, "uuid": "dc00724a-6733-4eee-a7d7-d33a3c83a737", "value": "c21f7e17d1d746619c809b3ce642d7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469189, "uuid": "2986f0a8-f880-40db-ab9a-9fbe6e19d123", "value": "3072:3bwjW2n2OVKuW9J7N63+KwYaR+aQ3aTnnFBFYvgX3QrVqZe+7Cr:runjU/37zkP3SEY3QYCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469189, "uuid": "00da947f-b795-4097-a9bb-eba9414668c3", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469189, "uuid": "f15df3d2-f185-43b6-a692-32c318b66648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469189, "uuid": "c9d9fb2b-0500-4d3b-b0d0-6caf5b52ec32", "value": "undetek-v10.17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37eab371-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489089, "uuid": "497a6643-2607-482b-986d-f37ed59a72d6", "comment": "Malware payload (Mirai)", "value": "aab9c990392e1800ee23a243ac05572b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489089, "uuid": "cd47de62-8442-4fb6-9289-0e5b9193370f", "comment": "Malware payload (Mirai)", "value": "64c5cfd0c895b5b7ec09b231dd85fad29fd2da339f47a3c3b1349b69b222a152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489089, "uuid": "0cedc28e-44ed-4a93-a966-a27fdef78ed0", "comment": "Malware payload (Mirai)", "value": "627b17d8885f0beb5c1547b2b91c52c835362cd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489089, "uuid": "332dffb6-7e3b-4541-91f5-3a9899dea9f9", "comment": "Malware payload (Mirai)", "value": "65bd3f49ebd61f6aecde3c9f41cfca41e72e9e5560487d9c4575b46c732d5595930d8bbf1d67ce7bf899b7061f9dbaca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489089, "uuid": "3554e3b1-82cd-49e0-9e75-76bda4bbcb3d", "value": "T1368309C6BCC2991AC6D4277EA62E619D3361A3E0C2DE3517DC974B25338319B0F27B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489089, "uuid": "5e31ee83-a531-4b42-8419-4a9145cb0686", "value": "1536:ZUKMZOnu4iDMorkzfCBevgJBzrjFZk1itKx9jnQwaDf+GQxc8L:ZdMZOu4iDlgz6Jlrjg3xJdUz8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489089, "uuid": "11c1feae-4baf-4419-b70b-6a525b86458b", "value": 87520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489089, "uuid": "90f7f580-7899-4c15-ac6e-1818950cecc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489089, "uuid": "d582c145-cf44-4296-b2b2-3cc911e13fe5", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e46a659-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466739, "uuid": "4d9f23b0-8c6e-4f49-9636-59d395d6241b", "comment": "Malware payload (Mirai)", "value": "4b7d962e4bc1567fcb701bc18c5255ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466739, "uuid": "b19c316f-e7f1-4667-8c85-f69c8eeccb43", "comment": "Malware payload (Mirai)", "value": "65370e75708c35ad1768741eadb7425c65124efa8088043f6785f853f5361d55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466739, "uuid": "cbd9ba23-7e23-4aa5-9814-0984959f2226", "comment": "Malware payload (Mirai)", "value": "f0ce3cc4175f15686b506c12663937adfa7d3833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466739, "uuid": "cf287c6e-2e8f-44f0-9e7e-3ba6fbeed38a", "comment": "Malware payload (Mirai)", "value": "cd2f9744321964c2dd2c1123ece6797acd299fd1313f7e815a439e5ba07e83ffac81258f51e141ebf1c411913c5a756f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466739, "uuid": "9bbd1629-17f6-4000-8825-1435304bf1ef", "value": "T159258D367701DF6AD368C27005F387A487F126A21BE305866278D33CAE6165C6D5FAF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466739, "uuid": "c6635129-c23a-47f8-9974-6e7161faa8bd", "value": "24576:Fbm/eqci2WY8eZQhgvViWJIddEQO1YKOEIUJuhNTWxmQs:F6tJjDhgvViWJIddEQOYKOMuhNTus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466739, "uuid": "2960a3ed-cae9-4b03-a94c-a2bccf8d0b13", "value": 977380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466739, "uuid": "17884f1a-286a-48ca-b5be-1655c757380e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466739, "uuid": "ab0c58a8-3d20-4460-8781-264be750a73b", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829fcd6e-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491362, "uuid": "63fce212-a0a4-4d9c-98a8-7c6984d5ed8d", "comment": "Malware payload (Mirai)", "value": "e88261e6012139354c2c7c5048f981e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491362, "uuid": "c3a4fc3e-1889-4e60-8949-a92f0f535ccf", "comment": "Malware payload (Mirai)", "value": "6557bab7d11acdeafbf3519b8a21ea712054b97cf106370c304c79e412a33e33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491362, "uuid": "ef1d98ad-3660-4775-a336-f799eca586ce", "comment": "Malware payload (Mirai)", "value": "f02e3b0df265dc5355260341db2d779fcda31c05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491362, "uuid": "dc4a52e8-5e1c-4a7e-b2a3-8ebc5a7d0c6a", "comment": "Malware payload (Mirai)", "value": "9b1780ece1ffe6bf5de7aae06e1f6447efb02dbf820045ad8201db11b8fd685211d0d7cd5ebc7c75b8f0981865d56404", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491362, "uuid": "633bf346-d0f0-48bf-b056-8130fbe529b4", "value": "T1AF148C5ABA4F7E82D2C6D3F49F8BCBA5312734A58E5681F43D01132EC5C2DDA8CE1691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491362, "uuid": "3280092a-b882-4379-ac65-58f3d116fc51", "value": "3072:A/nUsQYG1PHG13KX3Rw3luBiCyuwcvepFuyjYYjq:uUscPHG13KH23luB7ypYepTsYjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491362, "uuid": "708ae23d-01fd-4f6a-882a-af760c80dc64", "value": 194480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491362, "uuid": "d293a2f9-ac8f-4174-980b-f2e84923773e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491362, "uuid": "034fab33-b3da-45a1-b796-9bb8fccb831f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d641d5dc-0447-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770484200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484200, "uuid": "c8f5b031-4181-465d-95d5-f09436857c62", "comment": "Malware payload", "value": "a9f71eb39fbb66f27a07dcda6791bf5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484200, "uuid": "3b429c2a-1e15-4e3c-a0de-d531b94aced2", "comment": "Malware payload", "value": "6688239d3266236edc9f341a0e717f32a25905a3d0ce43a2668a67eb2f8843b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484200, "uuid": "656159ca-594f-4478-9eca-74b1ce832d34", "comment": "Malware payload", "value": "5fadfab0850ba3b99cbaabdc772662e6fbe6d188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484200, "uuid": "6ca76e27-ab1e-4dfc-bff8-e6086c38c4ef", "comment": "Malware payload", "value": "4bee9571b23760f7734bdf82f5adc9568acb963f76b3f8463bdfd10d08b73349cb3ef90b1fc24013bc762e22e7092fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484200, "uuid": "71c669ac-2003-4335-8ed7-00bc3e4ce9ba", "value": "T103D5AE0AF25349D5CC5BC0BC839B7131EB317D69CB242EDB17918B613E55B806B29F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484200, "uuid": "cc9d52cf-ff5c-4618-a9e7-18f53703ba0e", "value": "1e71a6dfe71991a69e79c1243f113f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484200, "uuid": "f12762eb-a505-4e87-b007-f5c489276680", "value": "49152:5NfZEXurRHg9orj/oKCQOydhYMJucKK6q3MqCc/9k3e8:59auTj/oFQOyrYMkcKzjw9k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484200, "uuid": "32466b80-f0a5-4d02-aa9e-d0bf9cc3162e", "value": 2982400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484200, "uuid": "130e3f39-bd82-44e8-b716-a28446f56df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484200, "uuid": "ebba6f98-28fd-4994-ac70-f81da3e8bd62", "value": "KeyGeneratorPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3724ad-03f4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770448371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448371, "uuid": "302edca7-64a2-4789-8ba8-7a868d9def65", "comment": "Malware payload (Mirai)", "value": "4746b93fd75c5796e0bd99b134d9d4d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448371, "uuid": "1ef0f5c6-5dd3-4f7f-b6b2-0316291f0dcf", "comment": "Malware payload (Mirai)", "value": "66c22f0cc59281780cf03285a7c8bea9257c9fcd10bb81ac201f35b097a3f2aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448371, "uuid": "1853f9bd-1705-480b-bc55-97b8aaee8f55", "comment": "Malware payload (Mirai)", "value": "f31e830f58aeb0d9de5a9cc590ae0f7697c0a7e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448371, "uuid": "3c85e3a3-e01f-434b-b078-5b150ea17e15", "comment": "Malware payload (Mirai)", "value": "257f2ccd2b5e8d817b80dba20887402d3f26695b8d856abba9c3f6a519cc711d37094f5c3c5c5f1efe8e78ccfa49ce7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448371, "uuid": "cfc06a60-89b8-4479-a677-8ecdbb7a3282", "value": "T180038D7BD46E5E55C0490278A9608E781B13F508D36B1EFB4DCA82619017DFCFA283FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448371, "uuid": "03f6cfbe-cced-4962-ad1e-5e628de41a74", "value": "768:WaKgxeDYyYItggrHVrwkAcACxXAoIDECnrA:Wa5xK/RtB8cA0viECn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770448371, "uuid": "440a9701-2dbb-403d-8e71-b61dac4b26ba", "value": 37708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770448371, "uuid": "708535c4-6235-47e5-ade9-17e14179a407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448371, "uuid": "f0907b84-0fb3-4e19-b15a-ec178f2522ad", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afdad16-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466733, "uuid": "1b1ee53b-7a2c-4013-83ae-007c2b55055f", "comment": "Malware payload (Mirai)", "value": "67b997b839a72b4cf800a7ad36de8632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466733, "uuid": "dc3c02cd-62c7-4942-86ca-3d9b1da52158", "comment": "Malware payload (Mirai)", "value": "676ca1ba645c07464df9350dbcdfef0f5908bb614176139bc96f1859d8b68b87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466733, "uuid": "6922db7f-9837-4402-b312-17c959f05175", "comment": "Malware payload (Mirai)", "value": "78fb0568dcc58253062f6870468ccf1c7dcf9bd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466733, "uuid": "dacbb2a8-0709-4760-bded-88b8281df310", "comment": "Malware payload (Mirai)", "value": "215a913244bbb56752e052d579bd09bd71691fd0163cc64a611393ef5c2ef742342713c40ad4e984dfb2e4914087dedb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466733, "uuid": "d4324564-4486-440b-80b4-421032cebf06", "value": "T1407309DABC858B11D5D526B6FE1E208D33134B78E3FE7113CE185B2E634A86B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466733, "uuid": "4080c51b-fb22-4fc2-9cc1-f7166063d60d", "value": "1536:amneV19h9q3Z89MS+AR3tgpyeEpJYfk263rsHSc+5HssMFiPAfMfZh:6pq3Zq0W3upyeEpWfk263rMkAfMfZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466733, "uuid": "9af4371f-696d-47dd-8354-d24a5c5e21d8", "value": 76608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466733, "uuid": "da73991f-c788-49db-96f8-be2b7572bc2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466733, "uuid": "2be9e3a4-af1d-442a-84e4-426dab2951f5", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb874dc-0458-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770491325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491325, "uuid": "e378eb00-9734-4e7c-ad49-6a2a0a956599", "comment": "Malware payload", "value": "776585ffe75c09e20e55e4ce8df725d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491325, "uuid": "d6ea6eed-3c3d-4846-9d05-9f88db6d9407", "comment": "Malware payload", "value": "6a9876af7f5899286b329df548d8ca4e3b42bc5519ac9c915def8f7c87c9e6a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491325, "uuid": "ce333b92-8973-4ec6-ac2a-e911e60370c6", "comment": "Malware payload", "value": "3217d3b5efbaa44b0d7d5955b3512fd1a0861bad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491325, "uuid": "8a5fe6a4-febf-4fa3-994c-0a98c0b9849c", "comment": "Malware payload", "value": "a569c9963ba56fd8ffabe73d7e0a083806cf7fe9f12dc175dcd876ae57ffc25fa463a186869c3947ae5a538715eac076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491325, "uuid": "50f77bcd-b145-4600-85af-abd0309424cf", "value": "T1B793A64F6E53DFBCF32C86344BB38B3A6695239533A0C585E25CDA415D6024E186FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491325, "uuid": "a2ba5676-af00-4cdc-a5c2-0f020c1051c4", "value": "1536:0XXFOk/id3idL5dCYzQNk5USvCPWHS/JBuSbt:0FOszkFeHYJ9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491325, "uuid": "11f53fcd-5d55-43fb-a980-1e351334bde4", "value": 88940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491325, "uuid": "18bda8ad-8192-4d39-a10c-531b3d092b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491325, "uuid": "5a98eb9c-eb5c-4064-b9a5-b3b8391e4461", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3164c6c-0460-11f1-a129-42010a9c0007", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1770494852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494852, "uuid": "c1bd445b-4534-464b-a516-71aa25996ceb", "comment": "Malware payload (ScarfaceStealer)", "value": "cbec21f09a8622109b984215e6fd54fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494852, "uuid": "66c69c59-3fe1-4d94-898e-67f167b0967b", "comment": "Malware payload (ScarfaceStealer)", "value": "6ac1f895cf6b5b2a54ed2e75bf045c2542aa98e6a5fa738587f4b1a82adb225b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494852, "uuid": "ba471aec-559c-4c11-b519-7235782cf121", "comment": "Malware payload (ScarfaceStealer)", "value": "91ad6d0df4f7df15e78c0767fbe7a2e78ab05185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494852, "uuid": "2b8a6e3d-b96c-472f-bedf-8103e73a3230", "comment": "Malware payload (ScarfaceStealer)", "value": "c0335a76f59fefecda369bc3b97d5eae11e86ab8b7fdf4985392687f6f3a38475658d2d77a016b26a0820c7de8eed9ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494852, "uuid": "72044e5b-68ae-4a8b-a207-87ef0eb18170", "value": "T110086B4667EA04D4F9F79A749AE66213C673BC063F3095CF3208172A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494852, "uuid": "120b4312-3f61-4689-94d2-2251f96983a5", "value": "04397e0bcb7648e70cf6570253f46feb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494852, "uuid": "678ff328-8f02-46c0-8c3f-765cedd0b3aa", "value": "393216:QFmNYSYZXCpixyZbvJVANEEgC/Kyxf663DQu58EASEhoIaE2lShBujCm5w1PN3hM:QrHx8iQJhYWuhvYvxOOxe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770494852, "uuid": "bcdaf942-05e4-40c4-9224-f0d17cefa91b", "value": 81896468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770494852, "uuid": "0855aa38-41a3-4095-9884-ba8ad286a323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494852, "uuid": "4d79c62a-2030-481a-b8a9-473a04512bde", "value": "EasyLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83cd567-045e-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770494109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494109, "uuid": "8c6d8908-166e-4471-bb95-ce346849582a", "comment": "Malware payload (ValleyRAT)", "value": "5c4fda221d68b0863b65d8765ed2ebe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494109, "uuid": "c53f811a-c7b9-450f-ba1d-3f136ce19788", "comment": "Malware payload (ValleyRAT)", "value": "6b26ccd21b6a590edc74a98f66e557631708a9dd9ec739be8e47f05efb0c6288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494109, "uuid": "d16a0ed4-d436-4009-9754-c8bf96e4e9b1", "comment": "Malware payload (ValleyRAT)", "value": "475ab188e7e9d7673a34e1ea5364f483104380e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494109, "uuid": "6378890c-81d8-4b47-a894-d2a1084a7ee1", "comment": "Malware payload (ValleyRAT)", "value": "b1fe8753e5162f16f16d9a17c6203ca77e578773924e3187e14587942a866c20ec87b50bb3320fbfe15ffe3f690042fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494109, "uuid": "4875e84e-ca21-405f-874c-ef4ff133b38a", "value": "T17FF57C0577B89DAAFC022A3891CF23365A395C316B6249E7CB05BB6159333D56F3B702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494109, "uuid": "c3829478-d923-4a74-bcd5-a34871322a87", "value": "59010c5840153cfa420aabe5bb8fa447", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494109, "uuid": "05c0fc4d-a137-441e-9629-d5f8bcf20d13", "value": "49152:SGaJbNXZ2IsJ63+bEaJbNXZKIsJ63+bEs:zwb9gIsJ63+bEwb9gIsJ63+bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770494109, "uuid": "aedb227f-fd10-47ab-80d7-f101efb36a72", "value": 3510272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770494109, "uuid": "e6b8c428-1b27-4e76-90d6-5e0a11297103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494109, "uuid": "526b0716-6a4f-4abd-8bc1-a29cc0fd7f80", "value": "5C4FDA221D68B0863B65D8765ED2EBE7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caa8400-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438819, "uuid": "50607ac1-b49b-43c3-b7b9-953a68313d6d", "comment": "Malware payload (Mirai)", "value": "a29308474acb85feb04a14516296fcda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438819, "uuid": "dd937546-e4f5-4e78-b618-b99f3d518cd6", "comment": "Malware payload (Mirai)", "value": "6cf4cf86f88a4a39c6f5f666d938771bb58d99dfe16c83c3041442db8adb9746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438819, "uuid": "3b0b0209-9d14-4374-9f3f-9f8594364035", "comment": "Malware payload (Mirai)", "value": "f18a7000bab24bb1a590981c56324c11b61d3ea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438819, "uuid": "5e0a3d5b-0670-46bc-994e-e2b2313cf8d5", "comment": "Malware payload (Mirai)", "value": "9976d98ea1c6d4f363dbf6254f4c99e49919a740585b6638e93d571cde12d9f4cdeff41c48911cc452333ee5bdce52a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438819, "uuid": "0993022e-cf78-4034-ae24-376206087b90", "value": "T1CDA3D596BC82962BC5E123BAB67E668D336173E4C2CF711B88205B247B8551F0D77F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438819, "uuid": "fa500c03-7979-456b-ac91-2aec62179e4f", "value": "1536:Aj0d/LPKGSDKPJFPUD6tGQn4fjRHLETVcl3sjWqkUit6fix9U/aOxn/SCj5eckyO:Aje/LP+KPJFu3w430M6fisBTjES+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438819, "uuid": "d7180416-d25f-4ca7-9c20-1725c074248a", "value": 104500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438819, "uuid": "38ae93ac-2049-4ced-8c02-af1f9dd66396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438819, "uuid": "ef5c7655-5aee-4829-ada5-ab06ad7f5be7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92631a3f-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473349, "uuid": "007a4882-b040-4559-9b5d-06ca42879a58", "comment": "Malware payload (Mirai)", "value": "4cfb90b96c8ac423d6a3e88b622ffaab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473349, "uuid": "833ff700-de0b-4c1e-83ce-00cdd82e0f41", "comment": "Malware payload (Mirai)", "value": "6d8aa0fc71904b9400ac4d791719886125ca09b8d00839d0672086c01182e965", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473349, "uuid": "15ad16a7-7e12-491f-8867-2648ad4da81a", "comment": "Malware payload (Mirai)", "value": "043d6bba918df69fb056c08793f7195d83da6ed7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473349, "uuid": "df7d9211-3ed0-4ca8-8b69-0d8ce4f78f0b", "comment": "Malware payload (Mirai)", "value": "f23ebf9368e8a4d89e7ff4fd6bada6b3a1283e975d7ff729632da79e221a668d4d2035dd105da3c77001b420a1718f74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473349, "uuid": "5dbb962d-64f0-4aea-b12a-704e5a424a7a", "value": "T1CB430846B951CF12C4D161BABE5F428D33136FF8E6EA31029D117FB037AA8DA0D6B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473349, "uuid": "7de5c33d-0ed7-40f7-bbfb-db66256885ee", "value": "1536:2fnrPYLR5X6mYulJriuOGVfc4CbgSdmLjOQXnSDi2:IYltJriuOGfcvtgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473349, "uuid": "81d5587c-79fb-4172-8804-b164c8e31749", "value": 57204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473349, "uuid": "a3c1c5b2-4be0-43f1-a609-c925ee1da93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473349, "uuid": "c7dde39a-f323-4cae-aea4-4fcfd2573f58", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f10165-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491183, "uuid": "e582c10f-fa09-456d-b930-15ce33607af1", "comment": "Malware payload (Mirai)", "value": "4de68e96d7cc4cf95acd46d124f97bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491183, "uuid": "0e147773-db89-4f9f-a309-130e99d32438", "comment": "Malware payload (Mirai)", "value": "6e1d40a4f74e3348e13f27401c889be002c2eaa1e7b7fce6912adda3e5e60960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491183, "uuid": "016726da-6e34-419b-870f-da45d3d6e873", "comment": "Malware payload (Mirai)", "value": "059f9ba57d6f902c14a1535a8d8c2febd78382bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491183, "uuid": "b7a28641-3d77-4a00-9660-7de353c86075", "comment": "Malware payload (Mirai)", "value": "52ad1500e6cda13cee6b7f71cddb03454d489dccce12b4eaab3d06fd289289c1c8b3932c91f8f051576a8093521fd39f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491183, "uuid": "bbad4666-4fe4-4622-8f39-c1479b0420a0", "value": "T1E7931855F890DA62C6E4267AFA5D428C33631F78D3DE3106DD14AB3477EB95B0E3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491183, "uuid": "26ab4b2f-28b7-4782-96be-f31466456701", "value": "1536:AN2I7gvH800SxuSGoqy5KMgIb5M3OFLaz2aK+MvpqPQp6iBlxcSOMYv1HIr:Y2Ikf800SxuGqy5KMH5azoLqotPOv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491183, "uuid": "40f4d21f-5f08-47e1-a114-9ac6859a869f", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491183, "uuid": "e5e68332-7c32-46f0-bc9a-23cf71b93df4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491183, "uuid": "e0d8dc33-959e-4d7d-87e0-60f4835cf513", "value": "catgirl.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359e090c-0459-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491662, "uuid": "05019d58-e04b-4710-84b9-3c8a84deba23", "comment": "Malware payload (Mirai)", "value": "c5570b13bf043b6b4e13ef4c72860eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491662, "uuid": "967f11d9-0c48-491d-9422-c5623dbbb4f0", "comment": "Malware payload (Mirai)", "value": "6e5137a3e01535b7907a26eab0b656e690e9f9058bef7ec0796ba3385dbf970d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491662, "uuid": "02a0cd85-bf93-482c-834d-2bebb6d789bc", "comment": "Malware payload (Mirai)", "value": "86f7f96edef621c58619d3cd103f9741f05feb7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491662, "uuid": "cc2054c5-65ef-405b-8803-9eb032c361dd", "comment": "Malware payload (Mirai)", "value": "e7f48785277fcec9a5ad22fe5a891ec9fdd26788097bbbe2500a54db1c890155b803de9db4c24b927cfea727b5dfda48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491662, "uuid": "15093f4e-250d-4dc8-9506-62def0ff6966", "value": "T104B34A55FD802B11D4D626B9FFBE82893323177CE3ED71129D246B2423CA96B0F36906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491662, "uuid": "3435b96c-b86b-4f7a-9c49-0db265203fe0", "value": "3072:B1CEQQr23r+LZveEd/WoTWl2aPAvRSiSJOVBTpb+LG:B1CEv67+LZmEd//TC2aPAvRS5OJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491662, "uuid": "5ccc3454-1428-4f5c-8811-2efeaea2dd9f", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491662, "uuid": "87c07fd0-11e3-4b27-b610-cc1322b18106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491662, "uuid": "c0042453-189f-41a4-a70b-9a7923c3355d", "value": "qst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a84ea19-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437258, "uuid": "160215af-c6e8-41b9-a150-da423ee3800e", "comment": "Malware payload (Mirai)", "value": "1cc9cd9c431debd2be5eb91eb90ad435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437258, "uuid": "0bf0587d-f982-42de-9be2-1617b908ec5a", "comment": "Malware payload (Mirai)", "value": "7030a1ac2ab03624e3d90642fd689751637f35a6cb471f47855933f8401270a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437258, "uuid": "5e34b0cd-26a9-449e-a59f-e8c8777ba988", "comment": "Malware payload (Mirai)", "value": "6456b5b8230e41cd981559be2bfcfc5e74f5316b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437258, "uuid": "8d138077-691d-4957-99b6-9f0de6c96a3e", "comment": "Malware payload (Mirai)", "value": "7942821394c1f8bc7246bf17f74c9132c542ce1d0bc6a546fcdb47b6d658d975cea18ff4e15d2f956b55c3f3b58575d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437258, "uuid": "74f28541-83ca-4f9c-b273-b0d8dc4887f6", "value": "T16D23F1F3463754FCCA636E7847194ED7E8DA742206322A3F15D630BCA0B3D586711B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437258, "uuid": "a87d479a-947a-4bcc-88ca-799f01275bb2", "value": "768:KssEME4hUOMZHMSla6Y8BJyCw4ST/81GxwPJE3l88BM4G24y:mnhUOiMSla6+4STkYqxklFzGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437258, "uuid": "68ea2d89-bb80-4df5-adfa-df32fbcfa29f", "value": 47768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437258, "uuid": "d3abf63a-b8f3-40c7-a0f9-bfd08d409356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437258, "uuid": "0a683abe-eaf2-4107-b254-046c70d4b2ef", "value": "israel.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc1ee42-03fc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770451865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451865, "uuid": "b7a51dbd-a53a-4476-b34d-4dfae0251001", "comment": "Malware payload (Mirai)", "value": "3503a1faaa98aa696d86763ba799b4c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451865, "uuid": "8c969ddf-37ac-44a3-95b3-fa6404604ddb", "comment": "Malware payload (Mirai)", "value": "70bccb4ddf6f1e27c679e73f812c1e5fd00bac0319e7a9c005c01b7f97575f26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451865, "uuid": "6c94d0fe-3431-470e-97b6-0af151ddab37", "comment": "Malware payload (Mirai)", "value": "b2344f60d07cc2292a505271ffe4c063252428ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451865, "uuid": "cf408925-155b-4c85-aa50-ccec95e4e12c", "comment": "Malware payload (Mirai)", "value": "b4969bf9d39f83eaefaebd15c4455f119224e1066636a5e74a8fca65b042affe730fc3a1b7057c9a3d6dced4d459660c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451865, "uuid": "b1ecaf1a-2d62-4adb-b61f-378f585688d5", "value": "T1C0A38DCBF74B4490C8654BF10BDB4BDD3E2362225E6B88E76C1D663A1D351CF5A0A392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451865, "uuid": "a143a142-b8b2-4f98-b095-806657e53c4a", "value": "1536:mSCNnETRHkTMxrSvCm3iSyrWwloggM/LWmREd:mxNnETNIMpqCQiSyrWwloggMqmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770451865, "uuid": "00643866-d33f-4bfa-abd8-f3605b43a517", "value": 99444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770451865, "uuid": "17707988-4a42-488c-a888-640a2aad15af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451865, "uuid": "4f6d9fa5-f3ba-4caa-8b0f-155ca1ad8a42", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41959cc1-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489105, "uuid": "e65dbe6d-42b6-430b-9dc8-c93a20d098a3", "comment": "Malware payload (Mirai)", "value": "e522db96b8adc6935d028ddba22172e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489105, "uuid": "58260a93-006e-4ec1-90ff-03b154e43bdb", "comment": "Malware payload (Mirai)", "value": "7269ecbe8bfa2e2e4f7d100cbc5c705840f9731aa059d3bba48221714910a432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489105, "uuid": "9d72f023-9a4a-4d57-99a6-8e8e0c1a35c9", "comment": "Malware payload (Mirai)", "value": "f96b48e3f65ca5405cfebf2c3f80e3ebc07dd5fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489105, "uuid": "5c8a4a5b-d0f7-4a68-a90a-abffea77e7ef", "comment": "Malware payload (Mirai)", "value": "d0cb3f40ff4713b41693c2ebc2f75efcd884b7cec979a7a70a72c7891a9130a8e568a8e23146340e0f2c7b47c2fcd625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489105, "uuid": "f1b6c69c-395f-46dd-bdbc-7d35a38697a8", "value": "T14E34C80E6E228F7DF7B9873447B79A21975D23C627E1D984D1ACD2101F2029E245FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489105, "uuid": "daf68c8f-37f1-4100-a98e-70973ef280c4", "value": "6144:LrlBKmvTPWKRMFN6aHUAQ8ZOZOmpLf+31M+o3whpCh9GXPtFw7i4rzwjZCzQ5AMy:6L0AMLzvvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489105, "uuid": "c2f89928-a8ec-437a-a76f-944b5f4d8244", "value": 241988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489105, "uuid": "17bf0d8c-7206-4151-a8c3-9f47dd28943e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489105, "uuid": "c4a09b77-f97c-4f10-922e-2b4c5dbb3e8c", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563fe90f-0454-11f1-a129-42010a9c0007", "comment": "Malware payload (DiscordRAT)", "timestamp": 1770489569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489569, "uuid": "224501eb-983c-44d3-a1b0-e79db5f1065a", "comment": "Malware payload (DiscordRAT)", "value": "ac69e9a73b4cc40cb05a9060c6e093fd", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489569, "uuid": "ec2e3fe2-1b4f-403a-9912-2f446c3be7f4", "comment": "Malware payload (DiscordRAT)", "value": "726a321c489253584377ccdb566c29109ea5f9a399f2874784e3f29a6ebac926", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489569, "uuid": "bc688bba-b1c9-41ae-8fe5-abd2380a739a", "comment": "Malware payload (DiscordRAT)", "value": "5d8bc93588cc116878661dfb983c16e050d7e8a0", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489569, "uuid": "65a4fb84-82aa-447a-839d-4e41bf80c4e1", "comment": "Malware payload (DiscordRAT)", "value": "67dddef340dbae12b84475d1216fc6fb4d78bc976edafdbdb76dd42bcf64479ba9356018fc64319a76811824891a08fd", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489569, "uuid": "6d5fccaa-8615-4fde-914c-b8856fe3af37", "value": "T1B073B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489569, "uuid": "e7bd0354-368a-419e-9fc2-651585d022ff", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489569, "uuid": "a4364d4f-0426-4f7d-a7d8-f1d688a4cca7", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489569, "uuid": "ab4fe3c4-625a-488d-bcc3-1ab00a85f1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489569, "uuid": "08498cda-f563-4068-ab5e-f8ba46bbfa4d", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2afc24-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770489094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "58ce8735-843c-4195-998e-6d04768fd8e0", "comment": "Malware payload (ValleyRAT)", "value": "fdb1e2fad6794020967a820fcafe459f", "object_relation": "md5", "Tag": [ { "name": "CryptInject", "colour": "#09C8B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CryptInject!MSR", "colour": "#686916", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "17016f9c-13e5-49fb-8f0f-d1853b9ef05e", "comment": "Malware payload (ValleyRAT)", "value": "729c830b997d00d365ae4dadee5e26ce2a269df651c93a8337bde5084c66cc1a", "object_relation": "sha256", "Tag": [ { "name": "CryptInject", "colour": "#09C8B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CryptInject!MSR", "colour": "#686916", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "8aad01bb-4b98-4482-ba97-3a53e3ecb959", "comment": "Malware payload (ValleyRAT)", "value": "82bf6cd2033c171efe6201c73c1d20e1956f8cd0", "object_relation": "sha1", "Tag": [ { "name": "CryptInject", "colour": "#09C8B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CryptInject!MSR", "colour": "#686916", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "21384d0b-7166-496e-9bd3-967ec649c83f", "comment": "Malware payload (ValleyRAT)", "value": "9476e01c8751144f01fd0c2f8726de703d4ba27cd6e5964cc43fd6ca28731d9e8d8189cf7d4bc5e2b6d6478c6fd7066f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptInject", "colour": "#09C8B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/CryptInject!MSR", "colour": "#686916", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "0a2a00ad-1940-40f5-aeca-8f2022865f1f", "value": "T15DA6335A65B953E5E176C078CF668206F336BC490358A6FB03E473652FBB9E02A7D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "03ee02bd-69ee-4f98-93a3-83c45c8d200e", "value": "b21fd499fe1809aa5e922f7f7cc6adb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "88501b38-ded5-4de8-9803-a39d95d24312", "value": "196608:WcjFGVP+q1y8vCB9Fl5sjnq26lHvBRWGm3PFFgoKp0Wcps5YqM8:/IXCzFsjqhPB2Pwr00KJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489094, "uuid": "2b528ee2-e5eb-4fce-a32d-c02e6bfa40e2", "value": 9630208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489094, "uuid": "e0b17231-e765-4c6d-aa8c-f7c6b548a2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "4bd0770c-4a98-42a4-9444-bb97406b61e9", "value": "0206SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9149a67d-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473347, "uuid": "e12ae2ef-4393-4f49-9f15-e90c8645ba51", "comment": "Malware payload (Mirai)", "value": "28edd69a94dd64c6321eadf2d33c4acc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473347, "uuid": "7ca598fa-dfda-4e72-badf-1f2d1446bade", "comment": "Malware payload (Mirai)", "value": "745d70312f52f2a0ddba29b867ff816bccee4995485716b4c07df50a2ead58c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473347, "uuid": "1dc87d7b-b62d-42f4-8b9a-1704220a2f5f", "comment": "Malware payload (Mirai)", "value": "fb68dfcaebf965908b9b78a9a5a29638a7147777", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473347, "uuid": "b443049a-321f-4b72-b07d-7c07272e00e1", "comment": "Malware payload (Mirai)", "value": "a1eecbc688ddd84a66985a2fb09d3771681639c3add92e7bf0297dd93eaa08a54356b15633978d3a7f008a910760ea61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473347, "uuid": "bb44c2a3-58b6-4156-a70f-d7c33d02ba31", "value": "T11C231C95F9919612C6E415BBBE0D038C372A57ACD1EF7203DE22AF613BDE41B0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473347, "uuid": "cb825c47-93a2-4a45-a9ef-1b1f138c8a62", "value": "1536:jAQq7YajKPhxycq9Cv2TJEygVIk2rFHOpnJr:jvoY4cB+TJ7GvkFHOpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473347, "uuid": "163891f8-467e-4297-80f7-2b8b222f5825", "value": 50080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473347, "uuid": "81f4fa5a-56fe-4f3e-b3a6-52a256894666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473347, "uuid": "c060c0fb-df0e-4cc0-b40b-b32e323210e3", "value": "bot.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2107e73-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437378, "uuid": "f1fa45cb-0fd5-45de-853f-ef69b49305cc", "comment": "Malware payload (Mirai)", "value": "93675adcb69fdc4d3286a109a91bbc89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437378, "uuid": "7f3bd05e-483f-4768-a8d2-4aac55c1f149", "comment": "Malware payload (Mirai)", "value": "759a02f8124938055fde70fececeffea388002033a58b2a7101902131bdc3425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437378, "uuid": "035487dd-9612-49b7-a20a-ffe703a29d6a", "comment": "Malware payload (Mirai)", "value": "20a30da96f301868166d965b23eca04e9c4982fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437378, "uuid": "92f05e56-2c73-43c4-a103-8fc5f812fc9e", "comment": "Malware payload (Mirai)", "value": "90dff51316aae36b2d5af36e69c4b07abcb75bc26759189fde7e7c435a7ee615a85f114e537db80a3bb254bf18ff8391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437378, "uuid": "b6a799c4-f885-448a-a0b6-b1ce8d63d760", "value": "T12293C54AA9419F01D49731FAFB8F425833536FACE3F97101DA24AF6123C6ADB0B76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437378, "uuid": "6c6a1818-1bab-4ded-9c4a-36f573631ef6", "value": "1536:oqnZr8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1YxfvD:b8NUv5nTacgzafVAwe4BNRIbT2gX2fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437378, "uuid": "911a37af-ec6f-46f7-bc23-c028fe74fa92", "value": 96904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437378, "uuid": "db399c33-d876-4094-8119-89e6c6348590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437378, "uuid": "3fe01638-ccad-4509-a39d-1df352b55973", "value": "israel.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec3cf39-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1770461747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461747, "uuid": "e0421b6d-3470-4038-9863-2772c0c51d67", "comment": "Malware payload (DDoSAgent)", "value": "f1b9dad080b65795ee1b7147fd683570", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461747, "uuid": "21b53b20-49ac-4e73-9492-6e2902a2531f", "comment": "Malware payload (DDoSAgent)", "value": "75fff99805e874d9620066a1779ca972a80cf1f1abd7b83d83427ae8522fdffc", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461747, "uuid": "0853189f-f582-45d4-baf2-34f2f0fb6b77", "comment": "Malware payload (DDoSAgent)", "value": "ed44d46443d4b265dc3eab2f4edf73d4f66a5db8", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461747, "uuid": "c4d44bbb-6ffa-446f-a627-2f0b7f455f46", "comment": "Malware payload (DDoSAgent)", "value": "d7c79998fd6490a13cc67b55d3dbdf817a2ece3d1b4be2ccca486206dc183ff3e9141330b7bcd41b824b4516f5a6e2e1", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461747, "uuid": "acedbcd2-ab81-41e3-a8d3-213f8c59258d", "value": "T1EA865A03EC9615EAC0ADD13186629253BAB27C496B2123D73F50F7782F77BD06AB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461747, "uuid": "9ad4a8f5-7f93-497a-a3a5-1325f1a73cda", "value": "49152:MT9iC3tsuU4uGeSTfjBvo7/14a5zEGYRd5D0t7YM91Q4rQUCmrW1JHl1vb2HmC9K:MNq28N5MRd10FNrQY0J6sZE5Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461747, "uuid": "d01e2c9b-975b-452b-ab35-b22f7f498b21", "value": 8208676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461747, "uuid": "dc61f000-167d-427a-9a52-fa58e8c8add0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461747, "uuid": "60544a4f-16bc-4dab-b5c4-d07e7bd082fa", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e37add2-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468188, "uuid": "748fd2bb-a9ff-4b31-91ba-1c88c8a5db87", "comment": "Malware payload (Mirai)", "value": "ab6087f67d9f6e4d2ffbfefd35a4333f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468188, "uuid": "04a8c517-d0f2-44d6-ab27-e5c12dcc247a", "comment": "Malware payload (Mirai)", "value": "7647b276e6a8cdf684f1bc8f55cb1fafcd017f8822d87dd6a7041de41c8e409c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468188, "uuid": "016c3ee6-1bf0-47bb-a72f-d75e8d1a0f6d", "comment": "Malware payload (Mirai)", "value": "68c125ac54b1a52e60319fbaba64ca085e6ff218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468188, "uuid": "100c3005-ef7d-4fcc-8308-7d48c247e26c", "comment": "Malware payload (Mirai)", "value": "7f3138d0f4040b610292fc546e900f68e246fb0dbf8fd38ad95a9bc2279e9dd4cfa131cd588e13e62723031292f56ab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468188, "uuid": "eca697f9-1f66-47ff-8a3b-0a719cdc9fe9", "value": "T148836C31BA3A2E2BC0D0647B21F34365F2F6474E21A8CA1E3DB10E4DBF55A5036576B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468188, "uuid": "61a6520a-988c-4649-800f-82f8de3bc984", "value": "1536:MFwB9O/7z1rOVOuxP08eLQ3tTZwZrvYk5ntXtJmzEQ:cwB94Q88QawrvYUnZHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468188, "uuid": "d865dd79-6c6c-4536-8487-bb94684af770", "value": 84536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468188, "uuid": "d801a73f-79ae-4657-9f0d-a5570617e49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468188, "uuid": "7620e4e2-84e7-444d-ba44-3af79fa28334", "value": "binary.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c537f7d-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489069, "uuid": "6b02bd3c-f853-45cc-a8d8-59f99ef662e4", "comment": "Malware payload (Mirai)", "value": "f40c85ad53da6f2d49d28792ff90fe9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489069, "uuid": "78d7c14a-623e-450f-80de-5e4825a12136", "comment": "Malware payload (Mirai)", "value": "76c2b4a77d2bdc17b4f2aea2d66130a819864ba9d1fbbb88fc489fab8d2f9774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489069, "uuid": "9d79abec-0809-44b5-8bd9-1d78e1b6e6fd", "comment": "Malware payload (Mirai)", "value": "f3a9aa734c4984ae822d170affeb39d67883ae4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489069, "uuid": "54fe337c-5ef2-458b-8ea4-0ebf6c49f0aa", "comment": "Malware payload (Mirai)", "value": "eec899465a7bd57205e86103a2a2c36516ab4ecfc9d4c101a22a7afe30cdafaf1f404ca868b7c175ee597328697e3f91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489069, "uuid": "55c33ade-9f2c-4235-b827-9527d131287a", "value": "T1521449DBF801DDBDF80BE63A4C530906B570B77204924B377257B967A93A0E90927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489069, "uuid": "d7ef9eae-53fa-4bfa-887e-a98416b8b3dd", "value": "3072:BLBeBMUowVQFMp/jPUS9foynqzTAP23xeRFJEeKV5VNjbi4LBbbvydYLHl:dwMwtp/dqzTAe3oHKV9LBHydkHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489069, "uuid": "05b1cd32-57a8-48e7-a547-198fca340589", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489069, "uuid": "02f476b0-943d-45f3-acc1-c9db19eb5053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489069, "uuid": "739fdbc9-16a4-48bb-b2fd-2ed3954d5b23", "value": "executor.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bd8869-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437379, "uuid": "08629340-4a9f-447b-acc3-da7d512cc7d0", "comment": "Malware payload (Mirai)", "value": "25b82427abf98694c2d63079c1941b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437379, "uuid": "dc7e5a53-411a-4b53-ab0d-fc381acd4c2e", "comment": "Malware payload (Mirai)", "value": "76e240f6ef416e3a5d02de6e00a440a0f12999f0d8f34a6afac9336d5f2608bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437379, "uuid": "8fe418be-0a34-4320-9332-ffa57648d02b", "comment": "Malware payload (Mirai)", "value": "8b5f5cbdea92fd8a317e35215d448bcf6b83fd60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437379, "uuid": "d8b57a24-5a36-4e57-88af-876f60e2ad67", "comment": "Malware payload (Mirai)", "value": "a2cafeadcdc5ec1e171552068c2b2e1f84d030092d849727409994ad884322d37533b67fe234d44bdacc135cdbe45048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437379, "uuid": "d3b9769a-dc8a-457d-9a28-2b24f7bc4965", "value": "T1A7C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437379, "uuid": "67c226ae-cdfc-48c0-a5b3-87d1e46ec626", "value": "3072:f3D7YhjFMX+maR8TcDeRqQV3tNQYciYTG1O:f3D76aX9aKTcRQVnoiYq1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437379, "uuid": "4e4d9203-6b5e-4e9c-8a07-a39ff6b5b4a9", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437379, "uuid": "053280d5-19bd-4c06-a425-a172d2171328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437379, "uuid": "f6f7bdda-eed9-4c23-92b1-747ae57154d4", "value": "israel.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6052e3fd-0426-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770469829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469829, "uuid": "5bd6502f-2811-4523-91ca-22563673d257", "comment": "Malware payload", "value": "90fe8823edd7824157268e68d391a2ea", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469829, "uuid": "8f568d7d-9e68-4612-8aef-7261fd683211", "comment": "Malware payload", "value": "775a02c3341f9e1e92666eaa0438455c4952f822d2aa08b1f94eb77ac530e1ce", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469829, "uuid": "de54bf04-815d-4721-a730-fdc4802066f5", "comment": "Malware payload", "value": "c5a8e55a6b7a6a1daed22530f80692c2b30505e2", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469829, "uuid": "5bb0ea20-7faa-4379-91aa-52de1e46e004", "comment": "Malware payload", "value": "8d45be16c87791371352f54b07834a3b21f71d2e1a0892270f4c2511666a96e4a94ee2493c9be99819d5b7887603f967", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469829, "uuid": "bc41ddf3-2226-4303-94b0-8538a3ce2f21", "value": "T15BD61259EB1CA52FCAF774B68F69C263611AE00241C397ABAC08811D69C77885F5FFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469829, "uuid": "947effa3-c84f-49b9-b971-15787981f573", "value": "393216:gDxrpXPo+aujzDEWWucSd3LNJ3fNdZOtmL3OKM:gdrlo+djzY8cSdBNNdPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469829, "uuid": "3cfaa182-bbc9-487a-9a3c-b189c1ceff22", "value": 12827640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469829, "uuid": "67ee17e9-aad2-4b49-b5ab-ada5cdc78fd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469829, "uuid": "750398ff-874a-426c-a894-32742eef4253", "value": "com.lesser.wicamera_1.4.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49247f2-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437382, "uuid": "b63a06fd-36bc-49b8-9779-d2d2dd87ac03", "comment": "Malware payload (Mirai)", "value": "25f105bc8157ef9ad99482086c67b804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437382, "uuid": "6b5a303c-26e0-4e68-940a-853477af74cc", "comment": "Malware payload (Mirai)", "value": "7761b788577830645da6f68812b3881132df87b835cc8016abdb27e4c84cd3d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437382, "uuid": "0db2e384-9669-4acf-a593-97a67c47f64f", "comment": "Malware payload (Mirai)", "value": "2dacc775d3721389210a17b975b5bf3692f316aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437382, "uuid": "7a6b45cc-2d7b-4064-bb3c-409e06d2ee96", "comment": "Malware payload (Mirai)", "value": "f4134c7d1a507ff04194e7385fb00be9747f631c0602ab3bb0c6bb665df949785c90b720854be0a049797e753bdeedba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437382, "uuid": "f9b86d7f-03ec-4e08-891e-013c4281f693", "value": "T103B30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437382, "uuid": "2ba30931-481c-4710-b4bb-d859051375da", "value": "1536:s7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxZ:KzPqF41OUBljSIxecUtCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437382, "uuid": "95ddc915-b24b-4a60-83c9-57285edf4359", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437382, "uuid": "0807f621-d7af-4140-a572-d5893062f9a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437382, "uuid": "0da3193b-8e0c-491d-8641-c7a7c0c904cb", "value": "israel.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0bca92-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461774, "uuid": "3e5d1b7a-9b8b-424f-9f41-b98eeeecbbfb", "comment": "Malware payload (Mirai)", "value": "de9075eb1b14ab4ac2940a3970115307", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461774, "uuid": "b9802152-a4eb-4270-acf1-90d26222f4c8", "comment": "Malware payload (Mirai)", "value": "778b68e69ff679d56d9f9d76f0d4d352e1509b0296f25ee43eb348df965f9d25", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461774, "uuid": "9c2fe85e-6c14-4065-8966-5999816ecb90", "comment": "Malware payload (Mirai)", "value": "6e40d24f756705b989af146d84efddf129e07d1e", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461774, "uuid": "24f6a783-f0a1-4dce-9ea4-c6a6c7e231a5", "comment": "Malware payload (Mirai)", "value": "95f23eb8544743d4bb7b1a5bef546e1b10f5d2be255d3b3a775fb25f439f17bc21da02357a1378fc691e6ea70ba3e461", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461774, "uuid": "824e3386-7f1f-449d-8dc0-e4f3ca36202f", "value": "T1B3762940FACF14F6E9075D3144BBA22F23321D058B25DBD7EA447F2AF97B5A5193220A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461774, "uuid": "1d2409ef-8311-4abc-9edc-52561f045ead", "value": "49152:At2tJ5V63exbMhy8sHT8QPkX9EiTyWqNxsbpCrO3hTiraFQGyG4Gk7nTCQXMP3Cy:9tJ5U8Yy5TiR2rOhTgaFQT2W6EW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461774, "uuid": "b0597b05-3ae6-48db-afef-bb1d2343808c", "value": 7745720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461774, "uuid": "fa0253a8-af1c-4ac1-81c1-80716a26dfee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461774, "uuid": "d1b9cf19-1747-4a10-bd54-51408e2101ef", "value": "kworkerd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66423333-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (DDoSAgent)", "timestamp": 1770461679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461679, "uuid": "6b193248-db1a-4173-8209-7caad1f2decd", "comment": "Malware payload (DDoSAgent)", "value": "d7a957d9270270eec939af749b4aed78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461679, "uuid": "b7003717-5d9c-421a-b4c5-7abc14c9b47e", "comment": "Malware payload (DDoSAgent)", "value": "7912a696df4c5c7b3842e4ed82454e445a7097cf72d76f20c0c9988a49da8e9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461679, "uuid": "42be42da-b5d0-4d88-9986-aa7f4f94faeb", "comment": "Malware payload (DDoSAgent)", "value": "08ac650e4582fc892390ea2e1772c79ca85c28e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461679, "uuid": "eafc1627-c410-4252-b43d-ed80acfe78ae", "comment": "Malware payload (DDoSAgent)", "value": "a6c516c7ca2e1c725686d3f1776e3a56cd05bbe2aeb64eae6cd6f3608ee19a2db166e78c691ca51f279f55ce42fcda19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461679, "uuid": "1544f529-312e-46dc-9615-7097425c3fac", "value": "T1BEB5335C60F274152CE93D6FFDD62D9D238344DA628B87DDC532D1739683B3A2B0906A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461679, "uuid": "c653ccae-f655-42c4-b2f4-a4637e95b035", "value": "49152:1zqCkzyT5C7pTKqcaALIPpXOkZQ6XCWNUrSveS2Yn+tyeCt0wJdubHkcQ9qe:LoUkpTlukPpXf1CdrSveunBzzWkIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461679, "uuid": "956a0e20-3231-44b8-afa9-1b2491ad59a8", "value": 2408124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461679, "uuid": "f29bb846-b107-4edf-adc4-5c15bfdd2119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461679, "uuid": "3ba1d8e3-21f9-4f0c-b423-f26e0ce5a1f3", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c23975-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489077, "uuid": "c0ab1e52-af25-468e-841c-4c40abb217ea", "comment": "Malware payload (Mirai)", "value": "8eaadefdb330ac4965dfdee2f7d0608f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489077, "uuid": "9183cd4c-b667-43c2-8da8-87725c7e8ccd", "comment": "Malware payload (Mirai)", "value": "794c06229e0b76f4c5e161f1b278792d1f3b41a6fee56c3bd5de4d3df36a2eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489077, "uuid": "86396bda-289c-4c8e-8d45-c677af838525", "comment": "Malware payload (Mirai)", "value": "3a8bc4541ba06b69af365a2eda03fb58e1286d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489077, "uuid": "dbb7fbd5-c0fc-4dd4-bff5-280af494ae54", "comment": "Malware payload (Mirai)", "value": "d1f645dc6449aa25df1670aa3e428a029b5a6e3115f1002376cee10e23f5bc94b9576ca0a009c01f99dc65ccbdb25a5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489077, "uuid": "d98a824e-04e8-41e0-b1a1-6b0117ca3e18", "value": "T10A5301C1A75C1E0CD34A0038C49DA86E9A2BE06867B458DBF6C534BF5EBBE17041C363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489077, "uuid": "d18612e7-4d95-4e3f-bbb9-e827a04a8346", "value": "1536:gts7bzJ0Re4kCPQjukTX6Bca0WYkfoLnouy8GyL:gK6qSJ9/WoutP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489077, "uuid": "a0dcc9d2-325b-4df6-ab33-0d8717c9082b", "value": 61160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489077, "uuid": "d76f6cb5-1a47-4cb3-af6c-b68cba65ff7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489077, "uuid": "1a1d854a-bb4f-4017-957a-c9aa7b574e6b", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286845f1-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500659, "uuid": "56031aff-c3d4-4591-bacc-3e7dd8dd6f28", "comment": "Malware payload (Mirai)", "value": "927d2f4d12dbf78c1a8c5ff59d589433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500659, "uuid": "349c3636-80f6-48b7-94dc-f57861f6f9e3", "comment": "Malware payload (Mirai)", "value": "79bfbf828db74659af5a05b6f46bb713f6fa83bf5b55e9bc2142b4677fcac3a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500659, "uuid": "1ed87f92-4636-4527-a1d0-f65c950d9e24", "comment": "Malware payload (Mirai)", "value": "ec3921b95dd64df0760b896c9658f6a4ab3e128a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500659, "uuid": "ba66ad95-1a91-4a38-bebe-df3105243a45", "comment": "Malware payload (Mirai)", "value": "00adda4b3f1c0755285e01d5e2f7fda8f81937ba93e5ee32cf3efad479502ae1db1a75ecd11d6264ebf1205f77a59ec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500659, "uuid": "e54787b2-f01f-450a-8227-2f5da965468f", "value": "T14904B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500659, "uuid": "30f46e5c-2a2d-4c62-b65c-b8fe7d8af80a", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2m:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500659, "uuid": "d2440b65-2c6f-4be1-8e6c-502d2860de13", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500659, "uuid": "f082a5f0-b254-4491-aba7-a5e9ce43013f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500659, "uuid": "f9ce070d-cf6c-4643-993a-c5b7a6fcd25b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7600706-0457-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770491021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491021, "uuid": "933c59cb-7639-4581-8d19-2ae390e54f96", "comment": "Malware payload", "value": "ec685bc5e6d8dd9b597c00f4e179678a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491021, "uuid": "fd0e4f29-1ea2-46ad-bda5-77543efc9a8c", "comment": "Malware payload", "value": "7b1e5a83b5251de56fa9f70cba79a75f3853d928d10653b20f10eb9f7a0e53ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491021, "uuid": "c1c11151-5659-4710-9b2c-68c5fe82a380", "comment": "Malware payload", "value": "0a6a57a4190c33827c05cd3efce21409334d5be6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491021, "uuid": "8165655e-0f44-489c-9780-62a032149498", "comment": "Malware payload", "value": "5036b5a5a6ed961ae6ddf39d26fa06907cb8455c3d2127de0488fdd24eb45710b57515c2cb4e0ca7080b6d016dd08156", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491021, "uuid": "90e60d67-07bb-46e5-8eb4-604080e1aad6", "value": "T1AB11DB9E3093700282A0FF977267CE0273CA81C655D97A099DCD50FE8096F043A17B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491021, "uuid": "25d9ea4d-b5b6-4d51-b2a4-fb7063010d10", "value": "24:u49f8fG49+8fG49p8fG4L98fG4u8fG42o8fG4l8fG49rB8fG488fG4z8fVDN:YNaVSHsbcX+ZOVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491021, "uuid": "b75ec1eb-e447-4741-bc53-79316951ced4", "value": 1034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491021, "uuid": "8b98c4fd-bec4-41c0-b7db-934bf97e5e17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491021, "uuid": "3a012bff-8b25-4ee5-82e1-33c9bf7883cc", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf1bb45-044c-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770486305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486305, "uuid": "e63c4628-d9dd-469a-847c-03097233e492", "comment": "Malware payload (njrat)", "value": "2d1c955c6f44d70985fb7ea0f85ace73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486305, "uuid": "d46074a6-7568-4885-b418-204eb6393c3a", "comment": "Malware payload (njrat)", "value": "7b739b1ecfd76e94cd22186b0778b0797f193a2a52f459acb0fe9a5176ec000b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486305, "uuid": "04d02313-07c6-48dc-ab15-9be9a41a4ea9", "comment": "Malware payload (njrat)", "value": "1cf6892560e0fe5fd9cd18d5a57c46468cdd92ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486305, "uuid": "1caeef35-8a35-4925-810d-c7e6e9d0be88", "comment": "Malware payload (njrat)", "value": "898dad84045b6711e5d6427be0b5d49a5422beca9d7eed3cc7927b282c0b5185fdf3de61326aaada380676528a0b7adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486305, "uuid": "98881070-8db4-4cfd-b607-71179de46579", "value": "T187B23A4E3FA98856C4BC17748AB5965043B491870423EE2FCCC464DBAFB3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486305, "uuid": "ffed48e8-e8b6-4bb0-994a-beda2b1844d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486305, "uuid": "e8a8d4c7-0982-4c7f-9207-ebe59d9612d3", "value": "384:Ec6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZwT:TIU0tw3RpcnuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770486305, "uuid": "c117b525-8819-436c-8aa7-cb65da76c44c", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770486305, "uuid": "88b67a42-63f4-496c-a2f9-466d1e3b2a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486305, "uuid": "d9f239d0-9c66-4fb7-8e5f-e816bfd4b109", "value": "2D1C955C6F44D70985FB7EA0F85ACE73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68563a64-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461682, "uuid": "d0b5dd6b-c5c0-4ba5-9d75-a2a95af17bc4", "comment": "Malware payload (Mirai)", "value": "b351013438891e81f5a52226f7df5911", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461682, "uuid": "f549422e-6c19-4b5a-877d-1bb752cfcf60", "comment": "Malware payload (Mirai)", "value": "7c2658ea3eadae79caa0ad653ce074d2a78984133a4d08fc1b5b4b2d281d1920", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461682, "uuid": "ed5c4172-b01d-439e-8a61-6bf09718ed40", "comment": "Malware payload (Mirai)", "value": "bd1f10a8e135302760478642b610fb8af4db9139", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461682, "uuid": "9c10e949-f6b6-470e-b73c-8e72ccb0a3c8", "comment": "Malware payload (Mirai)", "value": "aa7be182e172ebc9cc794a01058029d48c129c047b320ea748b23e961d1ad9ec238c3c367deab8b7a56cec8625085c39", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461682, "uuid": "4461603a-6170-4b39-ab9b-d20083b74164", "value": "T1F5768C0AFD549FA2C66402B649F812541334AD026FC75713A234F37CFDFA6D8EE8A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461682, "uuid": "a6702564-bf19-4911-9fdc-383b3aa228e7", "value": "49152:/pO1oTvTPpMSCdOu4L0QB57Eb2hAmnaqZwd8p1E0HXNutg5E1R:Q1oZMSCdOueHHducE1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461682, "uuid": "fde6f218-f486-43d2-ac37-3be006f58dee", "value": 7798968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461682, "uuid": "d147e087-1f77-4376-bbcb-3610e1cc9810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461682, "uuid": "9000ea21-8665-4f2f-b58d-5142504dbbe6", "value": "kvmirqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c0c056-0428-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770470620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470620, "uuid": "c4aa4ccd-fc12-4797-9a80-3332f27a756e", "comment": "Malware payload", "value": "7b8025cccf65f5ecbcb3d89e47884fa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470620, "uuid": "5037a87f-e479-43a3-ab1e-8ff0fdcece81", "comment": "Malware payload", "value": "7c2686c4f2b2641f1481150ac442d1f24700b52070e5c28a30526818602da116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470620, "uuid": "c3793413-3321-4f68-84a8-9f59c32cb5a5", "comment": "Malware payload", "value": "597b7717b19cf3c1b19e1e15410c6ac33605db5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470620, "uuid": "488630c2-729d-4d1f-9c88-05924456f4f0", "comment": "Malware payload", "value": "95d8966596f245141b519ce5cc4ce1a146c7a30409615e694d2222ea4fe86f869386530c8f40ee7d5877f63ddb5120b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470620, "uuid": "373d206c-b71b-4b82-ba9e-20d734538180", "value": "T1B8531A4AA9E370BCC28BC074469BE961B9327C5112203EBF6BD4FE312D75E512369B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470620, "uuid": "417d2c24-f3d4-4e5c-a25b-418294f6cbf4", "value": "1536:ytilZogOwmpCbQAv2eqaXRvBxML29xpEFRIKFAge8u2fddmVpVXSvPeiUr:4ilZRjbQAtqWzt+5i3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470620, "uuid": "27a81170-dd09-4a19-95d6-737724a977f5", "value": 63080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470620, "uuid": "fa224d18-5aee-47bd-ad07-41df18040fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470620, "uuid": "2757e83b-21f1-43bb-8c6b-a1ad3c2288f5", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93e5006-0428-11f1-a129-42010a9c0007", "comment": "Malware payload (MillenuimRAT)", "timestamp": 1770470891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470891, "uuid": "bdd0aacd-6db2-4a2e-ae11-42307da4a6a2", "comment": "Malware payload (MillenuimRAT)", "value": "09f5d4d9b970c08a935a0b5b9bc26ea5", "object_relation": "md5", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470891, "uuid": "b647510a-24fe-4805-9a1c-206d00e16b2d", "comment": "Malware payload (MillenuimRAT)", "value": "7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8", "object_relation": "sha256", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470891, "uuid": "0ddd18f0-17c5-4c93-b1e5-6e66c72506d3", "comment": "Malware payload (MillenuimRAT)", "value": "688fec9bacc20191683723aedebd3f041863f887", "object_relation": "sha1", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470891, "uuid": "8c86a723-bbe0-4349-890b-763353308fd2", "comment": "Malware payload (MillenuimRAT)", "value": "c179ff5353a30bac8d5a164d6d841bea6c5c013f50f2b226e997625c5c85ea4bf6de7574f309941853ae7dc494e5070f", "object_relation": "sha3-384", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false }, { "name": "MillenuimRAT", "colour": "#1F3A5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470891, "uuid": "655adb1b-7ab2-402f-b5f2-df6a1fcd6548", "value": "T160D59D62F782D0B2E4D201B155BEABF74D787635537584CBE3C01E6A49206C2B63AF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470891, "uuid": "1dbda748-5a4c-4542-be56-2f1bda2dffa5", "value": "e036611c05048ce1b230596686eabd36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470891, "uuid": "57a89f14-49c6-435b-94b9-f07ebc5f0e22", "value": "49152:15uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUw9KTnUVz:KTrVI4dGOgGpYHCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470891, "uuid": "5b9b96aa-8eaf-4c29-b380-24b0e8f5d030", "value": 2765312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470891, "uuid": "a37f3bce-0a48-4379-a18d-e6f6591d9266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470891, "uuid": "1973c21f-38bb-431b-8abd-cb134084f4c1", "value": "winmde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e2f2f8-03f7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770449682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449682, "uuid": "0bad2bfb-22ba-4354-b256-0ef280b62e28", "comment": "Malware payload (Mirai)", "value": "768dfd10b8693dd018a71b8ea32d7dca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449682, "uuid": "7fa29551-fc38-4939-9ba7-2f4302875b1c", "comment": "Malware payload (Mirai)", "value": "7e5d1966724b50152f30d5ad1c0149af47e801170f2f811dfc4d34c7f5bc1593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449682, "uuid": "832ec0c7-a51e-4a99-8ae2-9368c7ba6187", "comment": "Malware payload (Mirai)", "value": "745896b77bde6a62c4da00530a29c36e9cc67b2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449682, "uuid": "2870f155-783f-47d7-b5ee-d84e6469ce39", "comment": "Malware payload (Mirai)", "value": "6fcb3e4239bc6ff4dbcd5f9c66e89475c35c0ad5bc1c97d7ead9592c75b8daac52f826fbdf7ce79d50ce03371f34b22f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449682, "uuid": "abaf3be6-77af-4ca4-8dd2-b051f0b6306c", "value": "T16E130981B8809613C6E4237AF66E01CD332567A8E2DF731BDD226F50778682F0D77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449682, "uuid": "8d708ea8-ee30-41d9-8273-db0a692ba988", "value": "768:y8Hw5vwKEHbut8Lbdf338ArMm9U4/t9gdNO/NMx1bW3MLX:ZQ5vwKabuad19z/DONOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770449682, "uuid": "2edc63d3-8d44-4903-87a1-8bca2a494b2b", "value": 41852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770449682, "uuid": "006e8089-e13b-482d-ad2e-e7847d3f45e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449682, "uuid": "a06fd341-2fbf-4bce-a790-6c6ff01f85a8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8549de83-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461731, "uuid": "d9518fc6-5bea-49e7-882e-cdf11d932a99", "comment": "Malware payload (Mirai)", "value": "8e65663272166978930695ed93fab5c6", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461731, "uuid": "5845dfd8-787f-4c28-8488-a7dfd5a50404", "comment": "Malware payload (Mirai)", "value": "80cad7b9c2acdaa723e500de8ee31ab878208aa4e1eab38e699f5ab8cfbf0597", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461731, "uuid": "5f1f24a7-0808-49cc-b928-f6dff602d803", "comment": "Malware payload (Mirai)", "value": "c68fa91f5046e7c84cc433a1bdfd9334a0ca908d", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461731, "uuid": "9e7b0851-ef66-4d08-b267-35d5666691c4", "comment": "Malware payload (Mirai)", "value": "11e28ee4cfe527850fcdaffc67f47e31e111f763e8c540825d60fddbc590286695f66662df326e5fe764413416eb8f48", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461731, "uuid": "b0ed4b0d-cd29-46fc-ae69-d06e91133431", "value": "T191867D81F748A225DA5A0E3288A30B74F3712D42C5E5C96F5708F72F15B1AF6694FEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461731, "uuid": "23afd7f8-9de0-494a-b821-b75c1e092499", "value": "98304:vBfZZIsJ4X6BrqnDNAAyiJrz4c6PyzI0QinEjE4:pfZZIsJ4XqrqnDNAAy/Tinf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461731, "uuid": "d3069c54-beec-4220-b644-7ed0ae35bec9", "value": 7995576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461731, "uuid": "8c15d046-a368-4ea2-8a59-9e31fac718cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461731, "uuid": "648d891f-e9d2-4ac4-9c94-dc42c80fba5c", "value": "kpsmoused0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348c0e21-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474480, "uuid": "b9122fca-84c6-42fd-8263-840b0a1a2647", "comment": "Malware payload (Mirai)", "value": "563cfdbf08d019c61e9bf3c1c6261b0a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474480, "uuid": "cd28ebb6-b14d-43ed-a4f4-c6307ee24e54", "comment": "Malware payload (Mirai)", "value": "826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474480, "uuid": "7d34e271-a4fa-4c43-9125-3c5398304f13", "comment": "Malware payload (Mirai)", "value": "83ea504d06506adda6bd41c5991842ed7e250340", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474480, "uuid": "d6f016b3-f84d-4e72-85ac-a8ee70a36883", "comment": "Malware payload (Mirai)", "value": "e9c37714e4ddc13bcc5969ae2de38c16232797342dd0b428a2038a7d95233a35675f5686a9fac91a2b014a3f9f40c21a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474480, "uuid": "b1660bda-8d09-439d-8e68-8977a029d4a8", "value": "T19C413D8A14115131EDA5A927F3B9291B378899F66CD0FD2C5CFD3EA486CEF15E08CA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474480, "uuid": "d31b06d7-42be-4c17-a1a6-dccb0b060ccb", "value": "24:vtnIsFn0ykwpnSKJJseoedHnhz5FnwaL6snMwkslnpEgJnZmSnzEQnW:vtdFdk6SKvRHB5FJL1VJlpEgJZlzHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474480, "uuid": "00b1d005-e8de-42d7-83bd-2e7490b6a3a2", "value": 1930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474480, "uuid": "eeb4e615-3e1e-41ff-aa41-3cc9b8c542a6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474480, "uuid": "39b1d8fd-cf1a-4a63-8c03-bf07b48a7eec", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c326b0-0411-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770460730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460730, "uuid": "9f214949-7bc5-4e87-84f4-e33581a58c58", "comment": "Malware payload (ValleyRAT)", "value": "a3c3b290b1989b78d33f90b3611335b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460730, "uuid": "1e6c44cd-5068-4a63-b487-d2ca145278d7", "comment": "Malware payload (ValleyRAT)", "value": "8334abf7a7af06479e6afa45ace0142d51e48c2b1f7bfb6f4d86f5eb3e8fa1e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460730, "uuid": "211fd947-ac8a-4834-9b0e-4115331af2fb", "comment": "Malware payload (ValleyRAT)", "value": "3a2d6ed65d3d0aee0e0e496d248c60c8c4c583f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460730, "uuid": "ecaa2b96-a8d9-4b1c-9a40-24c1c498be66", "comment": "Malware payload (ValleyRAT)", "value": "68c2ba84bf79d4ded79afbe8b7ad4de03cf2331e491a9169f017b8e780dc7e58c73c7fb11c98959d1b6b45526d038869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.C!ml", "colour": "#4F232D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460730, "uuid": "63dde9ed-dec1-484b-aa48-9d025106a59d", "value": "T16D8733B3434FCCA6FF985C3689DB02DD3C35776B2D449417391E6A44E82228FE9B5922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460730, "uuid": "01ad1427-1933-4973-a629-40a31d48af6e", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460730, "uuid": "eaeb65da-7e44-4304-9919-38bf73149305", "value": "786432:/1iLLE6v+IOr+dgCdZavYhKas8oCi4Q9K6jXknSMUmS6w3ObQvqJep:/1iLY65XdgCd0vYhKxJ95jXkSPGw3ObC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770460730, "uuid": "0aa4f892-a7d3-4cde-bda0-2e1c3334677b", "value": 37929246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770460730, "uuid": "e94ec61a-1e77-414f-a1b5-4cebe30dca56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460730, "uuid": "7bfccd9c-32f6-4a64-bc0a-2234c4ca934d", "value": "LetsVPN2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8204c4-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500663, "uuid": "0143abc6-a883-4fda-a49d-de99606e58c4", "comment": "Malware payload (Mirai)", "value": "d2d4b4f36918e6466033d76e75d5dfae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500663, "uuid": "181158b9-6fbd-4d99-96cb-9d6cfb3a429c", "comment": "Malware payload (Mirai)", "value": "8338addea025bc71a19ea5e983b218cad0b39a3a51ebe6f26f403453713e3ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500663, "uuid": "40b4cbac-eb69-4816-9a2b-bf982dfe53e2", "comment": "Malware payload (Mirai)", "value": "edce6b6ec176d11e58158c40097c44bebe4e8898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500663, "uuid": "d76f7ac1-417b-4c8f-8fdf-4f6c9954ef83", "comment": "Malware payload (Mirai)", "value": "f196f1a29ae69dbe7856155351498b212f87bb5746e7afc4a02685bbc77eb12adb2eeac9f73c1bbd476e8a080371b403", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500663, "uuid": "3cdd037b-a67a-48bd-8715-fbcf4c7c0562", "value": "T1BAB339C0EA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500663, "uuid": "9b8a3585-83a1-4e4f-9ccc-8cdf96b7346e", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEh8ohHw0pJbLf:XFmzY5mXBypzjYYZ/5+JplHLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500663, "uuid": "7673bd62-c7ab-409c-a918-c8c2358a57c9", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500663, "uuid": "890e86cd-b189-4064-96ef-fab4a0c3125a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500663, "uuid": "d96d92c9-b18e-4fae-b634-1114d69f70d4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f522f56-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489074, "uuid": "66170156-4d20-4b8c-8096-898b1e03884e", "comment": "Malware payload (Mirai)", "value": "2a93a4d7b80dd4bf16490e14cb60fe3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489074, "uuid": "712aea40-418e-4710-bcc4-4fab9e3118f6", "comment": "Malware payload (Mirai)", "value": "83456e256430fa6460e0a968b665f1a1abf2db00aeefe7d4535b2262c0a115c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489074, "uuid": "03959efc-9325-4a32-bb2d-ae29c781487f", "comment": "Malware payload (Mirai)", "value": "afb1b8078dd11ac21756d70fa47a895ae3b6efe6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489074, "uuid": "b054cb85-4b1e-4824-87b2-5bee3f399fa5", "comment": "Malware payload (Mirai)", "value": "be1391af8dc9e94036b130687cf37317e72348e990070286045804662e241263d83da16e1409090c66ca78f3fad5a06c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489074, "uuid": "e762910b-3f56-416c-8329-dd0e3742471e", "value": "T14834238CF78B79DAC99C28E661C0610352D435E9B2D76DEF44B4EAF819D408FC4B1DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489074, "uuid": "e283a25f-9709-408b-a03b-ce00329fe489", "value": "6144:1ZUMcYZrS+Vmo5ud55ANgsf7tdx+UdtSKXnuhT6wkH:nUMvmo4d52Ngsbx+U6wGZkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489074, "uuid": "5895feff-e3c7-4931-a72b-427c6d5a25e0", "value": 253304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489074, "uuid": "19815161-07c8-4145-b812-85fbd4657134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489074, "uuid": "e95b09d7-da98-4622-bc40-7ec922c75d90", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6be35b9-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466968, "uuid": "ee36044a-2d7b-427a-a211-b68da4c862a7", "comment": "Malware payload (Mirai)", "value": "e0eb887e52a54bbb7e62135b89276d35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466968, "uuid": "83bb2bec-6517-425e-a5a5-a82454904986", "comment": "Malware payload (Mirai)", "value": "834c11d032784916f73299c353ecfadceb4144ff432e3f83b24c3b4b11f269a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466968, "uuid": "d4837664-d624-45ca-a2fb-689afe060db9", "comment": "Malware payload (Mirai)", "value": "43f088adeeb73f50245b1e509b4ae7cb5e63fc10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466968, "uuid": "99aa3c08-b86c-4b27-872c-d14ab812d84e", "comment": "Malware payload (Mirai)", "value": "26b740c487a82a5faf67e8c04b596ea0c9060a9414ac0e6bd2ba2fd35fbdb2ddb406c8ad723c1293b617270909b60cbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466968, "uuid": "45e9c3e3-b0b6-4985-8195-9d872b44bb3c", "value": "T18B01F5823234317033ABD8F64B320C9972A594757D876CF83865B1C72C85C40E4CA9FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466968, "uuid": "7e352ac6-db94-4ec4-8f41-1611f36125a0", "value": "12:YkF1kcClZF70S8NSHFqNSHFlNSHFWZv0FSBv+FM5gFUK2Zv0FSLv+FMDgFUK6A1B:ZDkH/Fb8kHFqkHFlkHFWZMFsGFM5gFUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466968, "uuid": "813aee23-b5d2-4fc4-9a23-f3a881a944db", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466968, "uuid": "d0af4c8b-984d-41f3-911a-ec60a58725d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466968, "uuid": "47734396-b9e4-49e9-96cd-29626eb091c0", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8948a0a0-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468180, "uuid": "8e3fe29f-16f5-4db3-bf47-c6eebf2eb93c", "comment": "Malware payload (Mirai)", "value": "87d13b259dc20dd2cf943d874078e354", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468180, "uuid": "d3fe6ccf-961d-4068-b721-8bd1680d7bd0", "comment": "Malware payload (Mirai)", "value": "85b42800d102c8623eaad21d20e81e43c1ddde465dda1d1fc129a6aeb70d6713", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468180, "uuid": "ec601620-c3be-479d-8366-1da97036968e", "comment": "Malware payload (Mirai)", "value": "86fcd559ad75861e32e49a7eee24170a274dd9e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468180, "uuid": "10620563-6134-49b5-8ee8-8473f37252ca", "comment": "Malware payload (Mirai)", "value": "064f0d95a5de199599962d3a445a721885bf695095f1c0cd3faeee2dc21b67168978549e66e61ae2bbe31880485e412d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468180, "uuid": "cb3f8ab0-61da-428c-b3b3-a4e9ab136568", "value": "T1B1D1C74BD0912275AD644E67A2D734867090D0EE8AC64FCB37FC75B4D18CEC87E91AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468180, "uuid": "38c7edfa-2296-424a-ba52-6a076cfd396b", "value": "96:eyOca6a0ayassia2aSaCaqDRayfyRw2uezsi/ocEIDRXZH5HBZsiZJpzDRZ+:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468180, "uuid": "91b3ee12-8221-4cdb-907c-262e5762c579", "value": 6348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468180, "uuid": "8fbef8cd-9616-4507-a4c7-87c9b470a375", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468180, "uuid": "39f6f8c9-b576-42a2-9b8a-0b9f7bafc4c9", "value": "jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d066a6a-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489070, "uuid": "0bd7290c-03f6-4b06-9dba-dfb368c96077", "comment": "Malware payload (Mirai)", "value": "67b7ce850a16025386554c7ffe3597b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489070, "uuid": "0a6642cd-d5a2-46e6-9ccf-9ff4e58cebee", "comment": "Malware payload (Mirai)", "value": "86f9f9e008704058f9f78bc87560cbd3d80c2aa986cc86539db01bb7bb8e2472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489070, "uuid": "a626e174-335d-4308-918d-4e6ad9d5f921", "comment": "Malware payload (Mirai)", "value": "c5211d09ca69907753155890f8ef92195f8d3395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489070, "uuid": "a47a88b5-0c9a-4f7f-9856-5d088e921447", "comment": "Malware payload (Mirai)", "value": "e1f774e5ab061fb80620ede1d9ed744c1aa7bcbbd8bfce7b7d5551bc49d7e2490584de3f8064210f693cd9792c5fa3a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489070, "uuid": "1026fe81-5243-48a6-9614-0462396241c2", "value": "T13E04BFA7F34F2491C86106F84BCB6B9D262361124D6BDBE76C6F353A5A371DE18023E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489070, "uuid": "33dd1e2d-a231-4bab-bedc-7361bd866cae", "value": "3072:VumIMr5XWFsTIH85LCg5V7dDKwa9IP/v62izsqelxjg/C4U2f3GWlYq:Vxf5WFcL5mqDKwaIPn6T/eLyC4Tf33Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489070, "uuid": "81be9552-c82c-4f1c-b172-8ec991041bba", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489070, "uuid": "f0b79d7c-05b1-4e1c-8195-6d1a99e33773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489070, "uuid": "fc3299b6-a305-49f6-b472-90bbedca6240", "value": "executor.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f93d8e-0407-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770456397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456397, "uuid": "f1feb519-da5d-41f5-bfb4-b8404d8078fb", "comment": "Malware payload", "value": "cd6350a45b18c692bab3e26ec896f269", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456397, "uuid": "4c4ad229-5ad4-4948-a67f-3d0432b85fa5", "comment": "Malware payload", "value": "8797f85df085e2e70b903109409ab006260299ad3390f9ff49d75ff1beeae133", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456397, "uuid": "2db45476-7e2c-44f8-8438-16c484866b13", "comment": "Malware payload", "value": "a440ab5363216172157a180bb7195b9d3590a658", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456397, "uuid": "583fb766-7034-4a89-ab99-27fb683c1ff3", "comment": "Malware payload", "value": "3885cd25a7ed919a3e9fbefd5e74c44d24d848f1357f47a7c3e589a574b9ba7cb32c7b67542fa202c22cd39a77aacae2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456397, "uuid": "967a139c-2ce8-49b8-8265-df407269caac", "value": "T1E055230271416536D49E687487860AA0027EBE38ED81E80B371A779772B3BF54F676FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456397, "uuid": "759e0aa9-82e5-4c78-b8fe-c1362341e96a", "value": "24576:XyAtwz2JxW+AqNvcOuJolvTEdYvG9fSXmelxcPRyDQDY8/COWtcu634uKAxgZOsF:iAtwz2JxdAq5huDYvgSV0quY8/xJ3Ltu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456397, "uuid": "f5e95dbb-e6ce-4413-9457-abc08ea5a6e0", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456397, "uuid": "a50e8d08-97a8-4485-8cbe-ba44e4bad061", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456397, "uuid": "8e9a0b03-6803-4339-b425-775610e42509", "value": "SecuriteInfo.com.Other.Malware-gen.52176895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afe28a2-0443-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770482329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482329, "uuid": "1a9d72ca-516a-4523-8a2c-80085ad02911", "comment": "Malware payload", "value": "039e1093eacb3a7cc78c3b60de6bda86", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482329, "uuid": "5c8a4788-d34b-4e88-9c43-9cf2fbb7ca48", "comment": "Malware payload", "value": "88338ea02fe8b680fde42b86a3d2a6924c6b17913350b638c3611381d7e3fe20", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482329, "uuid": "4031efd4-ea58-40a4-a6a6-455f7e5103f9", "comment": "Malware payload", "value": "9b64a35ad1d7814fe65cdabb3bed38e96205ac2b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770482329, "uuid": "138060d8-fb77-48cd-a741-43f7024b4773", "comment": "Malware payload", "value": "a75a08c97abb97383b365aae2fc24267f1ea6c2310e5decf4f1b7a17d103c913a187bdfa64049a457241c1dc5e4de472", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482329, "uuid": "3239e815-90c5-4b12-8b76-02a4fba3f3df", "value": "T1790833EB7D5266B6D8FA6CB9017AABF416281F19360298333B12319DFCF39F512149C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482329, "uuid": "b124fa93-faf8-438b-a5bc-8e066adf66a8", "value": "1572864:QkRBPoRH8+uvd3NLbYnw0VZXyYVVTggr0Kmzs3gJiBaJ/o+nvU:QkRBwyvddbYLXyYHgKoiCA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770482329, "uuid": "8c8b88e6-3e8c-4b9e-b4c2-ef756bbccae6", "value": 81649457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770482329, "uuid": "9957a139-f05e-4aea-bb78-53e9d5f9f32c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770482329, "uuid": "f8d51eb8-06fc-4cd4-8097-00b84128fb52", "value": "Vortex_ValorantChecker 1.4.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b03e51-0424-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1770469024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469024, "uuid": "baecbd13-7a4b-4fac-b3e6-363e1b4f2660", "comment": "Malware payload (DonutLoader)", "value": "d9a2c4aac91f10a79890ffc439e4da71", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469024, "uuid": "8ca97df2-9c16-44f4-bcb0-cc83931fb150", "comment": "Malware payload (DonutLoader)", "value": "88835b5c0e12c8dffd6df0d8810ab30e349f7e7ae9ee9bd5108ba036af358e98", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469024, "uuid": "5df72f39-48cb-45c4-9521-a0b0e2e05205", "comment": "Malware payload (DonutLoader)", "value": "821c7b3c07b7fe0fd7d883af7167921282eaf137", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469024, "uuid": "9b4c32b5-f5fe-4f6a-9c68-4f51c059b218", "comment": "Malware payload (DonutLoader)", "value": "359a6328926ee00b61a50585b0ddf274c2b47882be63c1aea147250a0c8660d5480a2cb77bedb861729875fb9764bbf5", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469024, "uuid": "f6909191-ec59-4f6c-bbf7-f4c9d1a4e2c4", "value": "T1E2B45B2435D186D9F0ABC5310AA794C6E955B8824374269F2B911FBE0F2B38C1CFB797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469024, "uuid": "75db1561-ebaf-4ff4-ae24-67f30edca9ee", "value": "c58e20b6c69af665da3994a32764bcd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469024, "uuid": "a76a6847-5fac-4bfd-80ac-7e6e29b348c8", "value": "6144:TsYysSMaMj6r+KycnWHVaD3HOn0+zDfcnRB6tFXW6W4oK160zpQuYx691gTC4JrG:hysSEWr/nW1IXsFgXWfWarFQueAiRyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469024, "uuid": "4394b96c-3973-4e1a-9fc3-47a1a6181e38", "value": 530088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469024, "uuid": "448cfdf5-08b8-4276-834f-498909a7ee3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469024, "uuid": "35b179b5-16bd-4cda-b2c4-5d360c593db6", "value": "ThereD.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c0bfc9-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489092, "uuid": "bbf028cb-dba6-4909-9696-749b5fd0a89d", "comment": "Malware payload (Mirai)", "value": "0f455b6f05be3029e78ef96aa1d3b71a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489092, "uuid": "23000069-095c-495b-a488-dbf50d337551", "comment": "Malware payload (Mirai)", "value": "8a33d0d0374d43b7d64cb3715237b44ff47a564129c8c9c16c4b92826c6becc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489092, "uuid": "d3f2651d-e2f3-47cf-ad0c-e1c7c771d407", "comment": "Malware payload (Mirai)", "value": "3bd6d8598648c09555ea96135c53eb382c64e3d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489092, "uuid": "e7706f41-0fd2-4cc2-b6e6-b883c584f5e0", "comment": "Malware payload (Mirai)", "value": "e82ecd2c33948c87434cd50f3b195d66d4793cac2a8dc35421560021958b5ef2435adfb9d7a2b84d6763e751e3ed56f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489092, "uuid": "af422eb7-ef52-4b5d-8b49-d7a7bde7be77", "value": "T14F142706B5C8D4FDC499D1344BBFB536E971BC5D423CB25B27C4AE222E4FEA01A2DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489092, "uuid": "de6ccd3f-a9a0-439b-9928-f0b72bef2aba", "value": "3072:j+MEkQJDX8bcuguFfxYEODLtjHUDlov7oGXtugUmiMaQb1PP0VbJ2Kj:j+3kQJDsb/xoDLtHvZgMrbawKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489092, "uuid": "d861950e-18eb-4944-b355-a24bdb984d04", "value": 192808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489092, "uuid": "a9f9adc5-ce9c-44ba-a7f0-0083afadb61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489092, "uuid": "1fecc7b4-98d2-4038-8437-ad0b28e31e9a", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31729c68-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438827, "uuid": "3bba6b81-2301-4719-9e67-2028cb579f5a", "comment": "Malware payload (Mirai)", "value": "4b3e03811519e270a380e27465e46bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438827, "uuid": "4576e6ad-dc2a-4d0a-80bc-fda1879775c1", "comment": "Malware payload (Mirai)", "value": "8a7e8ec7cb35832e5a57dbd2c9a85478ca68ec7575527ac239e4f0c608b05007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438827, "uuid": "e2134e64-c309-42ea-8de9-a3f33d2f75d4", "comment": "Malware payload (Mirai)", "value": "dfab0f5e62ad9d5cb2b74b250ff82b77d5ddd7cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438827, "uuid": "f5e7ec4f-ea27-4f81-88b4-5a1000ac3171", "comment": "Malware payload (Mirai)", "value": "3f6aa266fe297bb1030947862ad0a7fb85202f6ad737c9ec1007d6044e73bfdbb4f063ce782473d83f506dbb00fc505d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438827, "uuid": "d6f8f3c9-e158-4023-9412-6259a704252e", "value": "T1D5F35D86B4029F7DF94BD6BE44270D05F931A3B531830B2A62D7FDA3B9311A54D1AEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438827, "uuid": "c55a62bf-8df3-4874-a35a-80c5c3b65c63", "value": "3072:jHj+ZA9Cqjg2ACw79PY0xE+YMLP2exWOEKGPW:jEgCqjgLP1vLP2uEKG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438827, "uuid": "67f6f95a-d33c-42d5-b555-6626b13284b8", "value": 159984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438827, "uuid": "a4bc4f03-eef8-4c33-95da-53cbf9cd5cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438827, "uuid": "54577fec-a712-427f-a59f-2171dd920ff9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f17ff6a-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500670, "uuid": "3ca5c76e-4399-4f14-98ce-c151f74e97b7", "comment": "Malware payload (Mirai)", "value": "0e6e4239d64b5600dfd88571012aaaa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500670, "uuid": "566ca5ba-718e-4536-a137-5d02906eb2d0", "comment": "Malware payload (Mirai)", "value": "8b25a749630b4c7728da8b2c5fab2b686a455b92675abd67507184e6d813e47e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500670, "uuid": "170b3c64-1f3e-4518-9808-fcfafeb43c8c", "comment": "Malware payload (Mirai)", "value": "19cd18ad718e0f82b18906270f67a6943e8e7ece", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500670, "uuid": "b9c1c19a-4484-4701-bb47-4dc1ce718998", "comment": "Malware payload (Mirai)", "value": "053f0943cb9150bfeb18bf0d09206d09c3e35fcfd6454c74643487085a2b7a2022c84c441020ecc1db56e4d522418456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500670, "uuid": "854a25bc-5408-4786-ab74-28b2e0b724b2", "value": "T198C3AE73D42A7EC4D1514030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500670, "uuid": "54b5a5e3-a704-4b61-a9a8-d53b46deaa4f", "value": "3072:hfpZykqkt436I+9eIHbmNOkSMPXeC4GnHQ:hRZ0F3Bc6NOkvZhnHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500670, "uuid": "dd23a9ab-7f41-40f2-904b-2cd1b4dcf289", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500670, "uuid": "3d6d42cd-bb45-4892-beb7-e99851192920", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500670, "uuid": "925b913d-3536-4b54-9dc0-a4679a4c4736", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a609ac5-0464-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770496448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496448, "uuid": "cb0dc74c-4de8-4f37-b784-62a832050666", "comment": "Malware payload", "value": "93ab442e1056aeed9827e5ea5687f42c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496448, "uuid": "231159ff-8057-4afd-803e-54d4b763cc65", "comment": "Malware payload", "value": "8ba2bf7f25a42c24e8e59907e966fc25f040d8cc896d3e97407511894bf2e925", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496448, "uuid": "c473e453-94a7-4667-9855-4efea8bee64b", "comment": "Malware payload", "value": "62d568ab1fd7644b536df34ef8594bc163e3a358", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496448, "uuid": "8532dcff-bddc-4e05-9392-9f75772907bd", "comment": "Malware payload", "value": "f4791ae96935e6aeef9fccd67f130f96c2a5eb711a1f189d1d02a29adffd24d7576d40f6d4c994f6ccab53a5a53c4567", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496448, "uuid": "ef951e5c-84c4-4f2e-841c-4479ca4e2251", "value": "T1833623400FD95BBE0D2C913920AF0F2FD7D2EE695049B596EF80FCC597DAB04852AE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496448, "uuid": "d092b337-4ed9-4280-ae1e-eb9b6ac5d93b", "value": "49152:mOCXtl49g3o61w4OtUD2fdknYsSZ5eK89K7mgXnmYI0ZCm1TUz3wNFr8snucB9nN:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770496448, "uuid": "53d5af41-2ab1-4bfc-aec8-d8c1daeeeb57", "value": 5035272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770496448, "uuid": "a399151a-9d32-4b8b-a56a-d693f288dee3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496448, "uuid": "65760601-4081-4dc4-9836-56a4c04c283a", "value": "crypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c33db6-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437257, "uuid": "a3b955f8-03d6-4ce2-af3b-ff6f9caa38fb", "comment": "Malware payload (Mirai)", "value": "75c607f188fdffddcd071941721aa373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437257, "uuid": "e6b24cc5-574b-4483-9af0-43400b9277da", "comment": "Malware payload (Mirai)", "value": "8bbad939e64c10f2dc6723480ee5e25e805c7ad778fbcc06d26630cd5f9675f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437257, "uuid": "aa248927-756e-48b7-ac8d-62d555a046cd", "comment": "Malware payload (Mirai)", "value": "7e80438808f2d3edd08ac18c7541b80d08bceb00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437257, "uuid": "45ab7764-1316-46a6-b356-f78dadbb1ba8", "comment": "Malware payload (Mirai)", "value": "4c73634c3303699e91ff752885228bdad3a02198e187112619e154763c19faf29acb008ee648a10ec0d1253f4a88098e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437257, "uuid": "9bd9accd-129c-48ce-963e-ce7762e0c8be", "value": "T1D9C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437257, "uuid": "c8ad46c9-40ba-482a-b6c5-fb072a3ced01", "value": "1536:6HB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dbJ:61B4exMF7oZKJnCNYahJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437257, "uuid": "0c4bebb7-f26d-40a8-8a05-a9042118878a", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437257, "uuid": "974012f8-075a-456e-bd9d-0ea32d6b4c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437257, "uuid": "b1a316ac-0461-4379-9ab4-7fe3447a3dcb", "value": "israel.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547d45dc-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770473245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473245, "uuid": "28fe6a5d-eb40-4409-a7b5-bc05a115e0a0", "comment": "Malware payload (LummaStealer)", "value": "266fa976a16903342433f3cb4ccb9288", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473245, "uuid": "b4914990-e6d3-4368-9eb0-e4194e537465", "comment": "Malware payload (LummaStealer)", "value": "8bd174d78518bad07b3e182fff8dafa8dc3d32916461be23a80c61a5ae4b0a13", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473245, "uuid": "23c6cbb4-603e-49ad-bfe4-a95a50ac40f6", "comment": "Malware payload (LummaStealer)", "value": "fa4b1f9ebfa56fb8df1a287fbb81c4f02817beeb", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473245, "uuid": "dd0b63d5-626b-4040-a03d-15a0f2185c7d", "comment": "Malware payload (LummaStealer)", "value": "174893a965d1fc34cdf9d71353d020b55dcb3ce8ad725078d8d6338f60c793c874a30b59a3bbcda91eeb4b3360f09e4d", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473245, "uuid": "0b2dcf9a-7610-4c7e-9ce8-c5b5fb7ef204", "value": "T1D28522172BD8A466C1B65BB095F281935B70BD608B7807DB3A857D3CAE339C07970B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473245, "uuid": "cffa1988-3d81-40f1-abf6-8f701582890d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473245, "uuid": "877b5a40-b676-4f12-9355-d18be5269313", "value": "24576:4vHyj/Cu1KzT6204avi7vsXwqmIxPL2mclU8YwG3DflDNswBQTOYa+5S:Vdp18CwqmkPLrclU8PAlDNfQTuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473245, "uuid": "d53dad68-6cce-4a70-8227-d20530fad7ee", "value": 1747968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473245, "uuid": "d6eb612a-418e-42b3-ac21-65abea10f918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473245, "uuid": "3be8ea7c-7ae2-4e57-9636-d38aaf4b83cf", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bca17f-040e-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1770459473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459473, "uuid": "6af10bfe-8353-4341-8b26-9c019c719fc6", "comment": "Malware payload (CoinMiner)", "value": "79f1a7e79e7f0308c8b1c002004ea0f1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459473, "uuid": "acc9f92f-b5fb-4cac-a036-441166dbc027", "comment": "Malware payload (CoinMiner)", "value": "8c540bcb37c9faba5044faa007ed03c2ebc64bf39fd724b22ed4b2408d2fb43c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459473, "uuid": "e688e9a0-9bc5-497a-bac2-067c48949d92", "comment": "Malware payload (CoinMiner)", "value": "b0ca0b4c5c4b68c79d0320cd0f4407126cd91c45", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459473, "uuid": "9b49190c-adff-4083-8979-67acfde4bd1f", "comment": "Malware payload (CoinMiner)", "value": "d9f9b2cb295a3c327d60c09738ad8b2dbbdf8f18d37ada3dcb9dbf64fc193447b5353055f5b97b263719b881903f4ed9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459473, "uuid": "f9a901d3-cdd4-41b9-a90c-945188706739", "value": "T155E52393A08588F5DC9AD03CB3C99B54DE6EB4318794E5C703B059113A96AE88FFDE31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459473, "uuid": "1796c2bf-d212-45b8-95e4-f2d68fc36ca9", "value": "a04338e07c426b2fefa044b2835c73ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459473, "uuid": "45eb91a5-cd54-4c50-96b6-4c99ab96c0a6", "value": "49152:cSvUr9Y+UWtxMeDLyoAttv+GGMpl8IsInnlhJKOe1YLFItSj3NBfZzonY:WRVTDL52tGGxDJzJe1YLFcSjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770459473, "uuid": "23fb2a50-f500-43c8-aac0-3cbabc1a9068", "value": 3200512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770459473, "uuid": "14ca0cc7-8221-4097-8ecc-3b8af483e96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459473, "uuid": "6a9255e9-93f0-4dfb-a3f1-c655b54ca13d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13e5269-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437377, "uuid": "ddd19b66-114f-4f94-a78d-4685b2264626", "comment": "Malware payload (Mirai)", "value": "0a9b992dbb99138275638fb5d1ae6291", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437377, "uuid": "fd53f626-2e91-42a1-97ad-4a71bc670d36", "comment": "Malware payload (Mirai)", "value": "8d23e5ad446f433f848a47afe214c5985a1e6613ad31f6b42757bf9a8fd7fc74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437377, "uuid": "d79b9b28-2f3a-4232-9e59-fe20c80de6c5", "comment": "Malware payload (Mirai)", "value": "d29b65d791e39027cbb665277da7fb6faf35ceab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437377, "uuid": "d588dd90-7885-46b8-b552-b552ff677839", "comment": "Malware payload (Mirai)", "value": "cbfd9ed8c900688d543578d55486b6f6de249e5b9a8f27315de21931d99396fc3b8b9b71f1734c7a6a05fb6039ef16df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437377, "uuid": "fe07a808-8c09-41d8-91a7-667d74161b2a", "value": "T15BB30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437377, "uuid": "5dee12ee-f690-4da8-87bc-d8efe252139b", "value": "1536:oUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zv2:JixnUHz4Z+5ypkn3E82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437377, "uuid": "7f66c146-f60a-46de-a7a2-f4cc046e35bd", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437377, "uuid": "1622422e-6fb8-42a7-a653-ac8213b2cb07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437377, "uuid": "06d499ac-5f42-4aca-9026-82d593494d53", "value": "israel.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc131d57-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466977, "uuid": "c5c63fd8-f505-438f-9b3a-f47317a10912", "comment": "Malware payload (Mirai)", "value": "070f37de9cd1f632d0187f6e1b3e4495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466977, "uuid": "bd3a6846-9331-4f9b-80c1-c6c33b6277d4", "comment": "Malware payload (Mirai)", "value": "8f8e3635827ab115d05c84ad788b12e6946dfd2bfd6e93b7e8a4797c63e8bc77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466977, "uuid": "a7b208a6-3678-4bc2-a7cd-99e43c23dba8", "comment": "Malware payload (Mirai)", "value": "dc2c8f13100b7333d43f75a67bddd06800a2d59c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466977, "uuid": "09fcebfe-5d4a-4fc7-9de3-4e0eaaf2174c", "comment": "Malware payload (Mirai)", "value": "2bffc6e991390cea31f3701ba7be5f6a1093b7cdf3da034d3a65349d9e52e40a33a42d243c96b674ea356f456bf14eb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466977, "uuid": "93319a2c-d53c-454f-9aaf-1568fa877175", "value": "T1BA433C92F85245AAC6D117BA771A968A336267A9C2CF7313CC0C0B5076C9B4F4E77F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466977, "uuid": "7cc41e87-a111-4b3e-a172-f54a78f2f4e7", "value": "768:CuoWsQCLk159rZGYHy5x8dGBBrmYZf9OrdUKGZ4W8TMg2FX0n7zZM:cBQCorcYgycnmIFOrdUKGE/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466977, "uuid": "4b727633-5607-438d-a4d6-49c489fd665c", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466977, "uuid": "7a8516cb-1fa6-495e-b681-e4c83108f86e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466977, "uuid": "10c02a60-5b51-4e79-bdc1-b0894727120b", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e08d3b5-0421-11f1-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1770467570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467570, "uuid": "99937d61-4e37-4865-847a-3c1ac6f57fc9", "comment": "Malware payload (Efimer)", "value": "591ae0861b31d8cb9e0f657c0e627dd6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467570, "uuid": "8cacfded-0f7e-42e3-9b4e-e080b45fa84b", "comment": "Malware payload (Efimer)", "value": "9071a5ddbd218d78224653419efeb2f728e03840313a8c23a3e977dfb9885e0d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467570, "uuid": "94e74a94-1819-4569-bd55-3bfb972d8565", "comment": "Malware payload (Efimer)", "value": "70f51f408a3d15552fef3bd7f48f828cfdf73947", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467570, "uuid": "2b1f4029-b5f9-4c33-a9fe-4b0927ccbd4f", "comment": "Malware payload (Efimer)", "value": "63debb427056d6de90154b98fbcf23c109dbd0f5f7bb4fe12e816ee691f91c38602d75fcb9c89d6f48328fdd51bcaf21", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467570, "uuid": "46704a85-feee-4805-9a3c-cbca4e0a5118", "value": "T163D6331877E402FAD977803CEDE251E6E0B9783A0B37C8DB4B7851E56E1B1A18D3D612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467570, "uuid": "340c938d-fef5-4c97-997f-f9082826bd44", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467570, "uuid": "ee286ea6-315d-4638-8337-1015485d85df", "value": "393216:vgBQ8DCP1MSKIbnD+0kRgIQmGXMCHWUjXvcuI3/PGTAI:vgBKP1bKw5Q9fGXMb8XkH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467570, "uuid": "e4f4104e-f9f6-4d02-a18d-e7276d3cbcb4", "value": 12743880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467570, "uuid": "667714cc-1905-4eb6-9339-78e11f7359e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467570, "uuid": "ca9f3037-fea7-4296-af0c-3294d250c99e", "value": "zinfoz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7117fd38-0424-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770468998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468998, "uuid": "ff2a0fd6-a8ee-4f20-8ba5-7499d91a6c47", "comment": "Malware payload (ValleyRAT)", "value": "b238b9c60da9769feeb9ff6372046367", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468998, "uuid": "d34ab8ab-517c-4abd-b3ed-5645bae86d0e", "comment": "Malware payload (ValleyRAT)", "value": "90abcd989f29730287302024df8145fd9f08deb0fb0851d0ccbdf5debcb2418a", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468998, "uuid": "2c258ea0-c3b3-4e27-a94a-2d7e5e7b4961", "comment": "Malware payload (ValleyRAT)", "value": "98fdb8a0680760d5edd0e42aa158b4ab43198f49", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468998, "uuid": "74edb484-8fb3-4e31-a742-22f5c92e2900", "comment": "Malware payload (ValleyRAT)", "value": "668c1dbb97fba403ba5b722edcbf6abb39333baea6d384d685c3a576581be2cb149cd6642e99ab9df8e4454801a89184", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468998, "uuid": "91dfbb73-e8cd-4b50-b4d1-7d13fe048843", "value": "T1C6083326758B8A31C62F1733C575FE0C08753EA2332B80E7F2A4BDAB4572DD26575A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468998, "uuid": "d215fc02-fb1b-4693-9988-9407a81ea26d", "value": "1572864:NlAgVM94t9jOh4S8USrVfhLsXPIlyPkrAKvkOfejdIoDJUkk0l:NlAsSa9jOfyrVp84r/smkki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468998, "uuid": "03f8b8b1-0f5a-454f-ab64-4e27fa3c2f63", "value": 78313984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468998, "uuid": "cfba4ff8-102e-4324-bd76-1e8e3c3db4e3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468998, "uuid": "54e0bfcb-fca3-4f7f-977c-0bc8ac7cbf53", "value": "gogel_chome_win7_11_v1770017374.084888.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1df57c-047d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770507086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507086, "uuid": "e1bf7741-464b-4475-b136-28659293e707", "comment": "Malware payload", "value": "c8cb12e880b5d2d4f673aec201bf5e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507086, "uuid": "4242b35f-ddd0-4c5f-a8bb-7ccde51e2612", "comment": "Malware payload", "value": "90ccd387470444a2cb2c41b1b8db9a43983825dcc883ee5648765cc88c4f0a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507086, "uuid": "3e5071dc-bbfa-4485-8539-29925a9dadb1", "comment": "Malware payload", "value": "26c3cd47d1cbcf83f9fc135e2139f31dc0700cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507086, "uuid": "a6dea4f7-c1d4-46c8-abbc-1b044f776d47", "comment": "Malware payload", "value": "e8e25151854e1b0440e202387e0f1fd6deedf1ffa0775c85f5889221d32a8c20b8a1172e6abfd36b5b68b80413a8173e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507086, "uuid": "60eb1ebd-0a3d-4f2a-8fae-4ea585453ab0", "value": "T1B3D733B3D0E2040ED2E3B8B5A166DDB51D465C964616D2BF69CFF4A43F32243A82D7C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507086, "uuid": "016fb1d6-5e8b-4125-996e-a377a4271bb3", "value": "fc3b0de2e7f988c46ed9c8e46a804071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507086, "uuid": "62536885-7069-46a7-ae41-0b568f2249b1", "value": "1572864:0cnWEgpLLpuWuNneAhvzSZwLly/juuPwzuBnm4:0cnhgp2MmuGLly/jzwSBm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770507086, "uuid": "7e703ee1-d683-4cf3-9373-351a849687cd", "value": 63472483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770507086, "uuid": "51c94f35-844b-4101-a0e0-79d8f00dd626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507086, "uuid": "f50599f5-bc63-4595-9bb1-ea7e92a77ab6", "value": "contentIndex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876fe811-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461734, "uuid": "3e66f2c9-f81d-48b1-a923-5cea41d78e31", "comment": "Malware payload (Mirai)", "value": "aa710a9a6b2429ff3b98e7f46fd7415a", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461734, "uuid": "0ef9f57c-3203-4e97-85a8-bf425928b5ba", "comment": "Malware payload (Mirai)", "value": "9114f7606cd3745e89b79c494873a8b226151932e0e0de50b981c9fbf6494389", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461734, "uuid": "c287daa6-a140-41c4-9281-482c9c898bdb", "comment": "Malware payload (Mirai)", "value": "36b44cdd592bb4f06e2f73e2cf3d838b0a838e5c", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461734, "uuid": "dc0eb628-59c7-4940-a6a2-27972578eca4", "comment": "Malware payload (Mirai)", "value": "5fc617d8bc3af77aaf9cdd5926b639055efcc3c6d9fe684e9a2c6fe4937c4680c0133eb36f6a63395c306b643746b833", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461734, "uuid": "ec547888-ff42-4f35-968a-e8d1de010bf5", "value": "T177861887B9924982C4E83A37BCBD80C433671EB98B8756566D05FE383EBE1D90E35354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461734, "uuid": "ea0085ce-06e0-4c99-a504-6ce931ba89ea", "value": "49152:NhDHR/ckO+VgUiEEr3Ml9H0ke/cIUO7m7U7nTCs4fxVsNuuQOq9g5E+:jDRJJV7iJ7cJyXw/uQO/E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461734, "uuid": "ad2dd090-a3d5-435f-862a-6b74271dddf3", "value": 7864504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461734, "uuid": "167b6430-b54b-46c6-89cd-ab44e04899f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461734, "uuid": "2885b4af-5ef3-4e03-9ec9-f18817eae175", "value": "ksnapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e24667-040f-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1770460042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460042, "uuid": "514bce2a-5021-45ec-878f-4328cecb1741", "comment": "Malware payload (ConnectWise)", "value": "3ea4b9b98ebc895f8630448f8831b455", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460042, "uuid": "9a993bd1-0415-486f-a97a-87d240453f13", "comment": "Malware payload (ConnectWise)", "value": "9143622c00f7527d18fc8ac548190ee053000bdfffed1709aa4a1759638261bd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460042, "uuid": "a101fdd6-264a-4c11-863c-2a420fd583ce", "comment": "Malware payload (ConnectWise)", "value": "7ea43f06f55bdd079e4894176fce6f92b407b311", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770460042, "uuid": "3583e08a-1cdf-4146-817f-a9be224bdad1", "comment": "Malware payload (ConnectWise)", "value": "07b5d2a1cacdeea6f1a0574de7eaa5f19bede6be06a4d2d2e1c56911f76ef58e458e19291363da271797e1ebb17cafa2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460042, "uuid": "3bf6d303-c59d-4602-8f7a-5b153368f7db", "value": "T1AEA6231172E58179F1FB0B39FD3A91B16A763C699E63806F1354391E1A72E50CAB2333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460042, "uuid": "b7b01cc4-f6e0-4735-a5c8-9a56f20f0f96", "value": "196608:CZJbjFd29qxmdZJbjFd29jZJbjFd29HZJbjFd29:C3b29qwd3b29j3b29H3b29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770460042, "uuid": "3cb2c620-d0aa-46d9-9c09-0163ec9b4bbb", "value": 10067968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770460042, "uuid": "be4dec33-c2a4-4d18-ad87-fc6a798ce25e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770460042, "uuid": "7273979f-749f-4f0c-bc3f-bdd69e68ab82", "value": "Zoom_64-bit.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae73c7f-0478-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770505173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505173, "uuid": "ce68eaae-5889-4aac-87c4-a4d344b5d073", "comment": "Malware payload", "value": "fc5d5cf7e765d7757e67ecd0adb579ad", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505173, "uuid": "06abfa6b-f436-4c43-bd77-025666d519db", "comment": "Malware payload", "value": "91b765ec5ae1a0f61cdbbad038c859fe437d062db83af4deacbd694e57b05a6d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505173, "uuid": "e9ba6e80-0708-44dd-a0f1-8fed4f6516c8", "comment": "Malware payload", "value": "23a2e57edce6baed9c32b38626408b9a1dafecef", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505173, "uuid": "a178e58d-b916-4a40-8d3e-27912a3686a0", "comment": "Malware payload", "value": "811ed1b917642801bd0c4da91be26dc0306f6e8433af8d0903e5cd074f2645d458031798ac414cf72b77f5ef8bf746a3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505173, "uuid": "7f577eb0-c3d8-4b69-bc42-3f3da413ccdb", "value": "T198172313D5AFC424CA3B88F361C74344A9332655DC0AD27F13F469958E62A6B0BF1B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505173, "uuid": "48138059-9a7b-435d-8267-1681cf0f25f3", "value": "393216:imn1v6od9DlXMODzfQ5xxOaxQn5f0Ed3Udqx8mbdvwgOmew0H:iQ17TDtPDzfS/5Q5sEdgqx8OjGwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770505173, "uuid": "860146c5-a403-461a-add5-1f126660a169", "value": 18571960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770505173, "uuid": "d88b29d8-0970-47b7-835d-b73d09422a30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505173, "uuid": "bf05616e-dd40-4a54-8dad-4427e03791b4", "value": "client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc54bd4-0455-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770490144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770490144, "uuid": "5002d2a9-71e3-403f-8eaf-f795aa80d58f", "comment": "Malware payload", "value": "6a08a96b10436ba4af65a8a8394cc03c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770490144, "uuid": "fba065cc-001e-4cff-9f29-654e3c2e5814", "comment": "Malware payload", "value": "938fbae854554b4eef14fee9a7405d682a37f136bf87d8c7b5b78186425d1937", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770490144, "uuid": "44d2e02a-89bf-4414-adda-b8872ea9120a", "comment": "Malware payload", "value": "b6fc9c940c21ffaea440849868a35375ce582516", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770490144, "uuid": "c2c78246-c1c2-4f1e-86f2-6a4457cdae44", "comment": "Malware payload", "value": "0667067c6aa39d7bf134ba05a82bfd39dd06bce65b420bb60784ecd97db4c09304bc6ab86b9dff0ba2082826e76d48d2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770490144, "uuid": "0c5488b6-c863-40af-823d-b971149c040c", "value": "T13086338781AC9F12A89C57F35CA8BD91D5E294F247FECA12CE788E6C055150F48B09FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770490144, "uuid": "0c8998c2-491d-444a-917c-6aa26868b352", "value": "196608:ssASilaDIXUSuI7fuKW56EDb4s2hquFIOq9PBPXKXJ:JASilackYWhDbF2hqyIOgV65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770490144, "uuid": "5d59bb76-938c-4eb8-af7a-b65f40640f51", "value": 8591462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770490144, "uuid": "8d2e5ee5-bbe1-4d79-af81-bb97f491b20a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770490144, "uuid": "b5e2b718-8d16-4ca8-b1ac-69246e5daa1f", "value": "SilentCode Executor.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac47a8a-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491187, "uuid": "220866c2-8281-4d05-9eb1-d93a3f6d710c", "comment": "Malware payload (Mirai)", "value": "00166dbf150370f38efe673ad622eb93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491187, "uuid": "f086c1a7-f282-4df8-90be-1ce00db1d98f", "comment": "Malware payload (Mirai)", "value": "93ea0908dfad3d5ecf644001624b0f632c2461bb057964653ba69f21925d14a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491187, "uuid": "411d78ec-d5ad-45ae-ad74-e27415298e3b", "comment": "Malware payload (Mirai)", "value": "285f23f938eecb9906d21828eb72b9cc4e3db921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491187, "uuid": "1947a5b5-d042-440f-954a-8351a62d7fe4", "comment": "Malware payload (Mirai)", "value": "a33049c55c79baa4d9342ade07d721beb6ac112b53861e1bb7e2a6e1ada6e33c3a951c5c33249c28be17b995106457f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491187, "uuid": "50fde16c-a086-4c34-aed2-6e4065df5842", "value": "T196931855F890DA62C6E4267AFA5D428C33631F78D3DE3106DD14AB3477EB95B0E3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491187, "uuid": "e275a4c2-ce41-41fa-bed2-0a7662b49c58", "value": "1536:AN2I7gvH800SxuSGoqy5KMgIb5M3OFLaz2aK+MvpqPQp6iBlxcSOMYv4HIr:Y2Ikf800SxuGqy5KMH5azoLqotPOvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491187, "uuid": "5d9704dc-b2bc-4280-8139-77f4944c764e", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491187, "uuid": "0b5baddf-3f6c-4a16-9807-4688fc7b6e2e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491187, "uuid": "fa85ac56-9d37-4c31-bf19-ede3cc26af63", "value": "catgirl.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341950cf-03fe-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770452575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452575, "uuid": "97461646-6e22-4add-866e-655f764007aa", "comment": "Malware payload (Mirai)", "value": "4fbc176d145e5c494195005e091faf6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452575, "uuid": "84d12085-98f9-48c1-a0e2-8039d5ae95a5", "comment": "Malware payload (Mirai)", "value": "9707f74cebfb771d0020278845cd41c6480ef495648beabe10a0dfafd86ded8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452575, "uuid": "5116501f-506c-4094-8dc9-d68fae467ce2", "comment": "Malware payload (Mirai)", "value": "5b522ba8eb03abdb531050a0f03fc065e0823c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452575, "uuid": "830c7c75-e478-4222-bd54-f5dffee9510a", "comment": "Malware payload (Mirai)", "value": "c949f4879a25a6f912f8dc99e4bcb48d482c776fa3c27ef2fc87214e8f7c9af8ee0f0f2428d2b986e7538e73fe816275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452575, "uuid": "022c141b-a1f4-42a8-9166-5b111e32a490", "value": "T10533A50A2E11CFEDFB6C873447778E21965833AA27D1D645E55CDA002F6038E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452575, "uuid": "cc87a64f-d1c9-4022-8607-04649e11f22c", "value": "768:GdgEGfgtXjpBW6JEroHndaIaaajHnyYkwfhw4LDTrPlxIWm0LI:5uj3nUeduzyJwffIWmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770452575, "uuid": "f17412de-783c-49b4-a7c7-b924c3905a07", "value": 52932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770452575, "uuid": "cf5cef41-ca0c-4514-9fae-6007126ef413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452575, "uuid": "a85df126-5e7a-41d2-a412-20f4d6a05e49", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d95ac24-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438820, "uuid": "52374a46-3568-47a7-add8-c0696a4f17da", "comment": "Malware payload (Mirai)", "value": "82efc5e9cae9db8889fad7d7c4965757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438820, "uuid": "d268c5fb-c78a-4763-b158-fa66239b54d9", "comment": "Malware payload (Mirai)", "value": "971964a7412906662d012abf1316d0c9fcdbcfa327d619d39039b483273cace2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438820, "uuid": "286220d1-65f6-49dd-be64-85ea69919113", "comment": "Malware payload (Mirai)", "value": "d5bf5d8cea1fc25d2c738c5b820b4632e909b978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438820, "uuid": "914191d2-7b12-4997-8f62-1304d88609ac", "comment": "Malware payload (Mirai)", "value": "a4ed9db15a4b1ad332b4fdbce72bb148e3af76c1efe884b2ba8e316c473e52042966592555ece271626e0156fd76660d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438820, "uuid": "c354d82f-a27d-420b-b35e-9c93ee15bc7a", "value": "T1DAC3C74E6F218F7DF368863047B38B21A75933D626E1D685E2ACD6045F7034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438820, "uuid": "317a905f-a9a9-41c5-832b-237cf373941d", "value": "1536:3cT1LkgRae4eSZjkad6Ijj/Cr0ubgpa59X4FLHR88emveK7DG9tpaax:61LPRavJk+PeH4FLHJemw9mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438820, "uuid": "12f89a31-efc0-451f-8d8e-a94202e29458", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438820, "uuid": "0681770f-2ef9-4d67-a1ba-9e1e6c9f69ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438820, "uuid": "209f6563-89ea-41f2-9dae-d3c553628228", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d286cf0-041d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770465905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465905, "uuid": "54109d93-027f-4024-9654-33f9c3a28e96", "comment": "Malware payload (Mirai)", "value": "212e121f91fa8636739dc14c3a789936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465905, "uuid": "5ec787d5-3018-4c82-9445-f7dbe9935185", "comment": "Malware payload (Mirai)", "value": "974aad2e8da246047e04812b0087d9182a43e688d64472396abacfce1e84a31d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465905, "uuid": "a57d9951-b402-4d63-b6bc-063a2c89c3d6", "comment": "Malware payload (Mirai)", "value": "7bc9fb2219aad3eb09aa60b058969c867c73dd21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465905, "uuid": "73cf3d57-5e25-4bae-87cc-df9452080835", "comment": "Malware payload (Mirai)", "value": "94d0b01fcc74c6e7f079cfdb6a105b527b4cd826a2ff31696ee4c2c3c1256d58962b7edc8cd36986f23bfb0888bf5cfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770465905, "uuid": "32d38ebf-ebfd-411e-8582-706cd1a68aeb", "value": "T10FE35B2279791F2BC4D0997E12F74721F1F117DA26A8C90E7EB20D4FEF21620650BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770465905, "uuid": "723058f3-3d18-4a99-b2ef-4aaaec8a9cbc", "value": "3072:wgKqnlZkF0hQZ1bgQs6b230QjX0ol8TKcwb:7KqnfW0hyRL6eomTbwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770465905, "uuid": "20b7708a-07d7-4ae7-8fc5-4e33dcca1bca", "value": 148968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770465905, "uuid": "6c56b5b4-37f4-48ca-b602-ead2e80e58d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770465905, "uuid": "353c4ca2-7015-45df-aede-df706c4016cd", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63b3006-0445-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770483288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483288, "uuid": "17518cce-66e8-459a-9b7b-fb481b308e0f", "comment": "Malware payload", "value": "a0286f1a2ee8ba290e5a8447789dc25e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483288, "uuid": "6d48d30f-0674-4d01-9159-b3b75d9475fd", "comment": "Malware payload", "value": "9846135306bde7fc025f15d9862eb043dd916a6b3596ae8352570bfae7d7a5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483288, "uuid": "37fe3f86-7a2c-4c3c-9340-9fa9295cc4ec", "comment": "Malware payload", "value": "a33228068b864801ec59fadd7319268e9767bbee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483288, "uuid": "65ebe040-2b1e-4e13-ad28-aa493292714e", "comment": "Malware payload", "value": "8cbcf372a0385934bf8335a399478d03c7bc06d1544c177506a5016a7d746b062d004fbf05e2c5121b9b29cf92c3c434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483288, "uuid": "7afa80d3-6a7b-49ed-be2d-298a7b89bf9b", "value": "T1C3F54A136D9A50AAC1BEF1309A9492957773386543313BD31B9968BB0DB6BC03F3E718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483288, "uuid": "4ebdf612-0116-427c-ac40-5faa14a0cd9a", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483288, "uuid": "c84b78af-2510-4912-b7e9-ec23e0d64680", "value": "24576:X8EjhpdlmZD3HEjmicN/C+8+nCT4EcoYYe3+9xJDwZxyG3hrW5n8uXkOMtK1DU1p:FBlmt3HEjmjN/CMCT4Ecb4j4tK1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483288, "uuid": "8f2a52c3-265b-4651-9f16-3c07a4140c71", "value": 3551232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483288, "uuid": "81446e17-bee8-4e80-a196-1ead3e266582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483288, "uuid": "0320a4c6-2054-43e6-b49c-b1030f871b66", "value": "\u0412\u043e\u043etst\u0430\u0440\u0440\u0435\u0433\u0425\u0435no.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9155d415-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468193, "uuid": "a127d7c8-e81f-4abb-8606-520121a2acef", "comment": "Malware payload (Mirai)", "value": "c1652659e53bfa32c8a97dda29e2a16e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468193, "uuid": "fd6a7c6d-dcc5-4179-bd06-da9890d15004", "comment": "Malware payload (Mirai)", "value": "9894db10c187d9a5f8f7891922e8b8e1bc70290077263c74139f3bff620fd533", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468193, "uuid": "36f443b1-2f76-4b3a-81fa-03437a74dff9", "comment": "Malware payload (Mirai)", "value": "ad0def72883c75452dc60fef2ebb6adcbf2fb654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468193, "uuid": "b72c3984-6193-4e89-943f-9a4ab1d5df47", "comment": "Malware payload (Mirai)", "value": "d13ac2c46d744c82bd9ea012c5c6bd473a33dfefc1209a9d90183190ccd56f0003962e57f13f92880ba8e53d6d1758c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468193, "uuid": "3f47193b-1161-422d-a756-23c3d5d5b5a3", "value": "T12873BF23C4246EE6C29D0670B9E58AB42363ED0562535FF68699C67D8047FECF5083F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468193, "uuid": "0e037bd1-39c4-4f76-955b-3c5da2203f93", "value": "1536:lTazAdRzaryHuOSfcy+JVK9WaUCyNoTQNrCLAd:pGjIuoJ89mZNoGrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468193, "uuid": "846dda20-096f-400f-b5ed-cb6a0d35ec1a", "value": 75120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468193, "uuid": "1ecd4aa5-3369-4f3b-94e5-c1c648885e31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468193, "uuid": "fc62adbc-10a0-46ec-b266-0a23c5cce7a8", "value": "binary.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca67dcb-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466736, "uuid": "18a033e9-75be-4601-8059-22bc430962b3", "comment": "Malware payload (Mirai)", "value": "fa6fdf7b0900ab8f5fb2d667f59c6cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466736, "uuid": "1a0856ac-77d6-4931-b172-597869593094", "comment": "Malware payload (Mirai)", "value": "9a306cd25c380576fccd217dd314108dbc8632c15889242a44cc6fd9f31b7516", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466736, "uuid": "6095999d-c814-4f66-89bb-0fce42085912", "comment": "Malware payload (Mirai)", "value": "4ccdbed5d5845a429633738264a379fbe55aae70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466736, "uuid": "125577ed-3288-43a1-9788-b2a4c885114e", "comment": "Malware payload (Mirai)", "value": "d7852b4d86048b3bbdaf410b136a35171bb47e09429c3215af2e40ce78085cbd1889ddce25b20cec7e1dd0ed7dad86a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466736, "uuid": "cebdd8d3-5230-47b8-b67f-9694266eae7d", "value": "T116255B0AFF806FFBC06DCD30496E825601DE99925AD6472B72FCC64CBB9D60D0E97894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466736, "uuid": "7762699e-07e6-41ec-9636-30d25464f5ae", "value": "12288:7yI68Kcszf7rPuSkoMvzxPyz1W86xfreRn0d7eA9KWcXjiJqZPg+lLsuVUdj1Z2Q:hm/Ufre90QLWsWEewxWFWxmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466736, "uuid": "aa40a4b5-b446-4588-8f33-40b937cc3e40", "value": 977336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466736, "uuid": "87564bab-111c-4d4d-934a-caeebc60b6bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466736, "uuid": "46661948-6583-4e68-af62-77f2ad0e0c7c", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51de264-041e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466562, "uuid": "5c8a85d5-2575-4a36-a7c1-00a103c1fa44", "comment": "Malware payload", "value": "d82e64be3120614081ed305e4cdce6c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466562, "uuid": "57ddd6bf-609d-4bc1-875f-774d88652bc6", "comment": "Malware payload", "value": "9cdac3691609d9d9903ce4c54c849779de728c3fadf383789e38b86a2b4b3aff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466562, "uuid": "30e92643-e375-47de-a744-5ce288fdf994", "comment": "Malware payload", "value": "016b47a5d9b213d834f3160ebb0a759e6bc45542", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466562, "uuid": "b3eea7f2-46f2-461f-8c1c-8607e57dd9ee", "comment": "Malware payload", "value": "44462da91ea15208d0915ab5e3cec0542216efa45bd1dbb92b25cfa2e9c7c7aa0e711a3a282e8092681814bc23d3c643", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466562, "uuid": "fa965fba-da43-4f41-89c7-6f6320d7c809", "value": "T156567D30B5B68469ECFD00F1A2BB59775A6D1D04773484D3A8947C943CB01E2A3FAEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466562, "uuid": "2f8225b7-7392-4511-a28c-233cc2611b25", "value": "41c32693477d1b5435c0e09bb2654b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466562, "uuid": "c0ce680d-5a80-494a-b89f-bf373b44d933", "value": "98304:Zn+Y8vybTDhTSSTSaQz+fAWBfVrc5r4HeMeGq6QxjCU:ZnwvuhTSSIc+YeLeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466562, "uuid": "e15e2dad-c98d-4c96-a1d4-03059c4435e9", "value": 6153048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466562, "uuid": "cd4cfb78-f6eb-4992-9d15-5084f92144a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466562, "uuid": "65db2fa9-87ea-4617-afb8-f7dfb9037a0f", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193d04d6-0407-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1770456395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456395, "uuid": "d9d3778b-783d-4f20-9a82-eb5c3b1c848f", "comment": "Malware payload (Formbook)", "value": "df72278620ceb0d829dc9dcf1c09200f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456395, "uuid": "3c8caa18-4fcc-4a5d-bc1f-98c5f96b2848", "comment": "Malware payload (Formbook)", "value": "9d9daf97b0d7654a729fff5f5cd8a8e85afee669f2bfe84022d74fc435c6046e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456395, "uuid": "207ac289-0282-4867-b6c6-c2a1ac4c92a7", "comment": "Malware payload (Formbook)", "value": "f7975ccbe0d60356e360d1b7150b42e95a277348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456395, "uuid": "6ccfbc40-1ecb-42b0-8dce-5985635102d0", "comment": "Malware payload (Formbook)", "value": "7fe418651702ad50eb819cb28b9c18035f436921c481c17cc6540227f8a2fe2f1f90bf1840d03df6f2f214b931411c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456395, "uuid": "8ef603f4-9967-47c3-ae96-2be27da48336", "value": "T1B635339949C5DF5BC7F5423082E7AC090B8BC5ED658D5F1B61C802DA630BD4BAF82CB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456395, "uuid": "4a11057a-fa06-4d9b-8b86-b33631718708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456395, "uuid": "73d5bd3e-99d3-45df-ac40-06cc259ae4cb", "value": "24576:oaVbzwdXEbwbwMP4kaScy2ITl8ACFLtg2H9m1BWMSZrxIuw:osb5wbwkMITldgbm1BWMYrxIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456395, "uuid": "2971fefc-3f7c-4c5c-9a07-7f7df5817e81", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456395, "uuid": "64ca1cc3-b9a8-44f4-8598-0f8d0d730e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456395, "uuid": "c5a22717-182a-4de7-94cc-a5b8f94fc66a", "value": "SecuriteInfo.com.Trojan.Siggen32.5791.21263.3925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a137058-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491186, "uuid": "434e17b0-e68c-44cc-b7d3-5684b0504d32", "comment": "Malware payload (Mirai)", "value": "01c441ef0e5007dffa3e5f458db1aaf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491186, "uuid": "16fb3fa3-b776-42d4-889a-9566daac1e6b", "comment": "Malware payload (Mirai)", "value": "9dd4a327958d9d218bac954d5c09fc5cb64489e308eac8600cc662f6e5a982f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491186, "uuid": "21379e07-0db6-4615-8106-18f840aa466b", "comment": "Malware payload (Mirai)", "value": "310d30c3e4eb65eb6d2e7962c679427faa925bfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491186, "uuid": "2f66f50d-0de7-4ab2-9632-f9ac1169b7fa", "comment": "Malware payload (Mirai)", "value": "382639d6cdbd88a1f7e6866000e35ba2229d3b0894e7a756d66ca7e6f1c9df18b4839c9999c5142fc3ce29499a1c4dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491186, "uuid": "24be6861-7e11-4a53-81c0-f1ae63e4d0f4", "value": "T1D4E3F8567B11DF62C26CC1300AB3C75667EA26952AE19949F35CDE0C3E31349292FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491186, "uuid": "56d0436d-947c-4470-88ab-1e623e205f32", "value": "3072:ce4NREVQZT+WWiSr3nokzdoOZOBCUzL62y8xnOiCslp9WAjdWn:yP+XrXocUHy8AOv7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491186, "uuid": "089245d0-77a7-40b5-ba4a-a5efb43740ad", "value": 149916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491186, "uuid": "62a85e05-fd42-4aef-938e-1401ff7c0c13", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491186, "uuid": "e46f7e23-ba65-4b08-84aa-b14acc7cb65a", "value": "catgirl.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370fb6b9-0428-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770470619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470619, "uuid": "236af8e9-7973-4bdb-88cc-aedb5d039e92", "comment": "Malware payload", "value": "b2db9f61593720109bb3cac508731da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470619, "uuid": "22662272-c76d-46b1-b6cd-a707ed236c7e", "comment": "Malware payload", "value": "9ea5a98cb39e2d3ee06761b61f8bfa690b1736541c17cf5ec5090d3f17cdbbd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470619, "uuid": "caba8d46-4d40-427a-b310-5243386cda3c", "comment": "Malware payload", "value": "a9469dab7d0b9e5872f319b4aba136ba7ba61e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470619, "uuid": "3406b5ce-daa9-4b12-84c2-184f245f8690", "comment": "Malware payload", "value": "38056e2ffb61ee1f137e43a6b07456be113b463ce42438a95180e55f5fd7a77c5c7031db3c19d96c41114954657afa51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470619, "uuid": "17b5087c-4879-4a6b-a5dd-9eed7535dfeb", "value": "T10793094AAFB11EBBE4AFCD3309A90749399D5A0621B53F3A3574DC1CF60A64B16D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470619, "uuid": "7a4d3da7-2a0d-4406-b666-2e04099767f8", "value": "1536:H0nMECmxuwgCv5/++oTLsptO3uL0MFqFYC15b988160HRmLTtBHhZfqFX39wu7rw:Hc9ULsp5jHiKNj4axoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470619, "uuid": "59db0240-701e-4dc5-8014-42b11c8b4917", "value": 89744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470619, "uuid": "51c39972-d324-439d-976c-75e24576df87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470619, "uuid": "506d44f5-1505-448d-ac9b-ee2c7bb0a23e", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19764f51-044c-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770486031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486031, "uuid": "7da7050f-ddb2-4c9b-84e1-2dfa44714931", "comment": "Malware payload (SalatStealer)", "value": "c887137dc9e83d967fd63797138639f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486031, "uuid": "34ec019b-4849-48d4-9c68-ffe813c8a9ae", "comment": "Malware payload (SalatStealer)", "value": "9fa404ae52de527e89d8ee0927d4246222db2568929a9560f924c4e58cb9ff26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486031, "uuid": "2f4d7c95-92b8-4c83-b0d4-b8d11c852d75", "comment": "Malware payload (SalatStealer)", "value": "048dc9d7a7ccc1972d9076f59b404071928cdf29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486031, "uuid": "05c020d4-d121-46cc-a77c-61a60b222b10", "comment": "Malware payload (SalatStealer)", "value": "c28c2a3c40bb4d2b8d1bf922fa063c033dc6c2e6ed4ce267a38689f91689f5ae8fff4eed4c2bff599898543c74fea578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486031, "uuid": "4a4fbbb2-e7f2-40f3-9190-dbebb125591f", "value": "T170C65A11FA8B54F5E9031831415BB23F33355E048B38DBABEB547F6AFC7B691292A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486031, "uuid": "525f8353-aedd-498c-adfa-7aff1b6c1f0a", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486031, "uuid": "76ebb38d-3853-4b88-8760-a73c31d7e9f0", "value": "98304:pm3wNgF1ybEK7+JMpDmxSuTm/KELascUus:oTPpwjK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770486031, "uuid": "f7a2843e-9360-4378-9afe-c53a84166cbf", "value": 11669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770486031, "uuid": "45e74209-3cd5-48dd-bea6-9d48da89a311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486031, "uuid": "d74ab304-e697-4530-9110-c6454766eb02", "value": "XENO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4161f4-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438823, "uuid": "b9c7a60d-66dd-4b35-bd0c-18445a85835c", "comment": "Malware payload (Mirai)", "value": "2e69b6a1a1610033a6f47db81d8d8fb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438823, "uuid": "7578f2e5-9e4c-4cd7-bb63-0888d9dd86d8", "comment": "Malware payload (Mirai)", "value": "9ff107700a252556cd996e61c631e3c74e19a2f2ef752d34fbf682970000938c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438823, "uuid": "660737ed-73cd-4b9c-9c2f-9f2357875e81", "comment": "Malware payload (Mirai)", "value": "32a24fb57015d27f4f718eb3f92b22421447d9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438823, "uuid": "7d32f02d-23e7-406d-b087-4648dc2aa159", "comment": "Malware payload (Mirai)", "value": "a0b750b92f1c24609f416d416f04cd2471e16ddeac355098b29aa6ed5471e701b58eb49da6693d95f7000c7dbf591176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438823, "uuid": "de547835-9a8b-4abe-acf9-8184207a71bf", "value": "T1DDE35C0672180F17D5A749B0263F1BE083FED5C121F4BA88695F9B5A4672E3B2486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438823, "uuid": "96eeb071-79aa-4990-b81c-3960fcc9e71f", "value": "3072:w/miaF+oRYJGw967SpC/8UQoFJy8E3v8g/:saNRc0//8UQoFJy8qkg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438823, "uuid": "1c493b51-077b-4e48-ab81-8ee887e6124d", "value": 144952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438823, "uuid": "6b522266-fdf8-4b34-aafc-ffc2e2a20d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438823, "uuid": "31284ad8-cd34-44e2-8e6d-9e3bebc702be", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d614ddb1-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437385, "uuid": "86cf66db-19ce-49d9-991e-ad872ed32b63", "comment": "Malware payload (Mirai)", "value": "cb5d89473e2b86573202250d4a9adad8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437385, "uuid": "ac2e1882-f802-4ace-a2cb-9c20052b726c", "comment": "Malware payload (Mirai)", "value": "a0c8d7d9af8b5e45087378a26c9709acbaa3c00fd3ec9e599907e9a797ca6dd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437385, "uuid": "b185009c-6c53-42d9-8b6b-0b0ae3119388", "comment": "Malware payload (Mirai)", "value": "15f66fbc8330ec86190f2db109c0bdea0fc7c22f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437385, "uuid": "533616ea-44b7-42e9-9720-b9b49351645f", "comment": "Malware payload (Mirai)", "value": "ae1da17de63699d0663a9cac0a4af9c3a382f134f6567e6084c33358e56bbb95492ace1cb8ad19a5a41851dfd28e2ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437385, "uuid": "1effd943-47be-4bce-ab0d-1b4f59374e99", "value": "T195E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437385, "uuid": "ce2aadbd-0efa-4933-a0c8-8def0c3f78e3", "value": "3072:vxjJw1Cc/0s6YAPwenUr48pzfR+JonXy:vxlw1xAop0YfRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437385, "uuid": "e72a7aab-cadd-47b2-808b-51eb8a0d6b93", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437385, "uuid": "5f0800f1-9ad5-423d-b0dc-8fea39066002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437385, "uuid": "6884be6c-4b68-4ae9-b465-82ee0f5f1e73", "value": "israel.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2917f8c9-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500660, "uuid": "100a795e-da2a-4504-aa08-b8ef898296aa", "comment": "Malware payload (Mirai)", "value": "84b281902492e291510777d33f2ac288", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500660, "uuid": "dab56e94-47fc-4e3c-b4c9-2fc9c213115c", "comment": "Malware payload (Mirai)", "value": "a0cfd62f4abd6944485d1924ad0e95ae78fbf64d32da83329d14cacaaba567f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500660, "uuid": "9174286e-b5ec-44a3-b452-5d935ce3f893", "comment": "Malware payload (Mirai)", "value": "8f7cb05092c475bdf6b8736af7d37d1f0fc091a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500660, "uuid": "0c5e3c33-9b87-4e92-8d43-1cf1f59cba9b", "comment": "Malware payload (Mirai)", "value": "8133489e971ed7efba9a583102cfa5d53ba09884eb61457212568c7f08a065a0e017c0c2d844ecfba24c9559cb70e962", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500660, "uuid": "9a86a072-d88c-45e8-9ab3-70d73c91979b", "value": "T1BB93E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500660, "uuid": "8b737de2-3499-424f-a3b7-bff4302ba286", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8In:8+tsCurVDN+ouw8LVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500660, "uuid": "9c5bcad5-eb25-4332-b84d-45950e42a18d", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500660, "uuid": "6abea609-d44e-4360-836b-413dd84bbe58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500660, "uuid": "25a6124a-6a19-459d-8920-d40e76bd6db3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0000ee-03b8-11f1-a129-42010a9c0007", "comment": "Malware payload (Prince)", "timestamp": 1770422446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422446, "uuid": "50f0ad1e-a55e-4571-aa74-fe5478be899c", "comment": "Malware payload (Prince)", "value": "9ac267c88b27f4eac20f50e47946d606", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Prince", "colour": "#8450BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422446, "uuid": "f33a7e93-d7c4-496a-a5cb-2194ce8cc784", "comment": "Malware payload (Prince)", "value": "a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Prince", "colour": "#8450BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422446, "uuid": "4f4d50c2-86c6-4c50-aade-1b5b960fef51", "comment": "Malware payload (Prince)", "value": "6810ec9dab0b4a7bb4f60397b5d0e76f9a10a93c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Prince", "colour": "#8450BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422446, "uuid": "7616cdb2-ede2-4941-a0bf-34aac8251c05", "comment": "Malware payload (Prince)", "value": "317de1f3b08abca213569a946266b9a70c528f1330c17edf8987075a48c8a4269e972ab13bc9839bd14a22661917bb80", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Prince", "colour": "#8450BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422446, "uuid": "afba89af-6264-47c8-9c08-e5d30ef5cd8b", "value": "T186565B43EC9155E5C0EEE23585629292BB717C486B3523D72FA0F7382F76BD06AB8710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422446, "uuid": "2b1707cd-6148-4b59-a54a-ff8359ccadef", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422446, "uuid": "6de83cd5-3b40-4d1c-b79b-ecaaa5232e43", "value": "49152:T0btg+Y6DQM8m1FulNynTfwYnccVvTYI2sbajzTVYajDfF7Vf3MdSdBHBxwKeK9W:TJ2FvI03VGQarxHxf6El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770422446, "uuid": "d4b909e0-a4da-4bc7-960c-6f47283d47c1", "value": 6116864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770422446, "uuid": "a4fdf3fb-9fbc-4104-bd65-091c791a8e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422446, "uuid": "96687e6b-87c8-4862-be29-3caf8a45f4d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f08e3b-0447-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1770484254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484254, "uuid": "4fa43db4-2923-4de2-b76c-f6b5699a16c0", "comment": "Malware payload (SantaStealer)", "value": "5843f25e5d736f915da1d2efbf7cde4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484254, "uuid": "bc238fd4-c4a2-4b51-acb7-0f702df06af2", "comment": "Malware payload (SantaStealer)", "value": "a29d6ca899a2a2c1497b192dc8aeb1cb6290109c347ffe3bc66d950dc0b0f1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484254, "uuid": "d100c64e-75f5-48ab-8a4c-97f317ba2a8f", "comment": "Malware payload (SantaStealer)", "value": "ece724aa46c18bcc5c81185583f5cac9fc8badeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770484254, "uuid": "2e3748fd-7d61-419e-b070-3ce560deb8e0", "comment": "Malware payload (SantaStealer)", "value": "847827b2ec1a4def8a7c77b53ee31f40feebc3a074136c15a1606b355acfecb6636517888bdc11642486404cbb979ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484254, "uuid": "3018372f-1379-4af4-803e-a1f118e3fa22", "value": "T1D4C59E0AE15349D5CC5BC0BC838F7131EB357D79CA282D9B17D28B613A95B807729F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484254, "uuid": "15822131-6598-4bb7-8a3f-9eee7857c734", "value": "d6d4019539ab1757eb53b82c6691b682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484254, "uuid": "15d60eb6-32a8-4b8d-ba1c-7a8a02a08f5a", "value": "49152:UwLgW0B2MXHpeGLzCnx7Rt80JjIGr2yXEJmgS/GcEIuDZ:UpW0jpeGLzkx9KAjcyTxp+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770484254, "uuid": "01cf1508-cc83-4036-9a26-9506b25980ff", "value": 2628096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770484254, "uuid": "8229fbad-4b0a-4083-9b1f-a3197e287574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770484254, "uuid": "59502887-c6ab-489e-9010-9137c0696731", "value": "xa29d6ca899a2a2c1497b192dc8aeb1cb6290109c347ffe3bc66d950dc0b0f1a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb44cfeb-044b-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770485980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485980, "uuid": "c4b9d525-2b83-4cba-8d62-340014d320cf", "comment": "Malware payload (SalatStealer)", "value": "bd46bc1317878c321f72d9a75b71c1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485980, "uuid": "c8615177-e594-4c42-862c-a3f98c58ad54", "comment": "Malware payload (SalatStealer)", "value": "a30940760fe0de1c84ec8452d2af1aa23dea47a483b7eb3e655952bab0a75ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485980, "uuid": "013204d8-115e-48f4-ad20-2d4a05760979", "comment": "Malware payload (SalatStealer)", "value": "0f18250232cba885b4e2f96eed67a3e1ed206b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485980, "uuid": "d77210cd-1081-4b78-889c-a0cea6951465", "comment": "Malware payload (SalatStealer)", "value": "185eb083419cde5a5e39498e6efde9250578fd044f734b4b1255f98c39c8bcf1786909c205ef11dcd4b69984f49c475d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485980, "uuid": "53eeee98-e423-4912-ac2a-347cdbd71ff1", "value": "T133E53349A1EA39D9F5988FB6324F77C4C30B663DB22EF71B17301389579B852194338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485980, "uuid": "bceee615-6703-4fcc-b911-5d935c9d92a3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485980, "uuid": "2fb0ed20-c881-46af-8f3b-af684075ca12", "value": "98304:EA+t0WTNER1ugRlMypkj27OtOkTAWu3fmmL:EA+qWB+ga+ntO0Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770485980, "uuid": "2d1ac4d2-e1a3-44b7-b587-d9c5e84ea36c", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770485980, "uuid": "6e3e5490-377c-4703-8833-cb3e690c0cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485980, "uuid": "e0e2e31e-d512-4d7a-94e0-bd61762cf2fe", "value": "XENO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0d3544-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437261, "uuid": "0397a8a8-6efa-4688-a23f-bac32ce7ff48", "comment": "Malware payload (Mirai)", "value": "1f46578887137461613eeeb72d24cf20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437261, "uuid": "aa075c69-c901-40fa-842c-c0bf85538257", "comment": "Malware payload (Mirai)", "value": "a31c5de996a00a2b443abb29fc0a225d4e4939ce29e640921520208f75fe6231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437261, "uuid": "a89edd93-6803-4191-a7ee-f2d975b06f77", "comment": "Malware payload (Mirai)", "value": "d8baf31d74103e3142da05c56025229a6672fb21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437261, "uuid": "cd58e387-6119-4783-9002-a0f90b6de2ac", "comment": "Malware payload (Mirai)", "value": "823d5c74698a07c9192993990079ef86d8f14c1481a5234d103bb45117db8c7ffe221b106ee2a6d133138b06073fa394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437261, "uuid": "762969c6-6568-4aa6-84d9-3f5d4f782960", "value": "T193D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437261, "uuid": "e0abbb19-742d-4696-9918-38baf742e441", "value": "3072:XNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQ+J:SHy5ct8/cyiWuVosLD3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437261, "uuid": "43a56705-8d4a-4930-8dde-a55d8f2a64d1", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437261, "uuid": "d8953e08-6beb-4d60-ac67-82cf1adf07fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437261, "uuid": "2ccf660d-2a34-4106-b4c4-172094acb922", "value": "israel.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f1b9b0-047a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770505999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505999, "uuid": "722fe7ac-4d17-4642-b6e3-14f5a220eaad", "comment": "Malware payload", "value": "120461e2196e66fb2675e5882d148d51", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentRaven", "colour": "#B86104", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505999, "uuid": "f1dddc47-70b6-4a62-9bd2-ad1d0e18ca52", "comment": "Malware payload", "value": "a387edb6b6a15023f56aa906dfc80241b1c819b999c24fc8805f8e88df6c43cf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentRaven", "colour": "#B86104", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505999, "uuid": "2c017713-989c-4aec-bab8-1753d3a1aed2", "comment": "Malware payload", "value": "d28d059d1d73ff6a6f141e42dc5d61ddb3d52886", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentRaven", "colour": "#B86104", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505999, "uuid": "0392fb7a-52b8-46ba-8799-20d59408e345", "comment": "Malware payload", "value": "4be41a3ace8dc53ca9478d0aed0ac01fc6a5b0cdbade179a2c33881009e8344ae22baebe814812b27b54bc8275939a6f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentRaven", "colour": "#B86104", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505999, "uuid": "aab66189-4874-4a84-8961-8ac5e1747c02", "value": "T1EFE533985568D787BA790A4665BC36BCA4321C401DCF9F2BB322D5F3D46F80E661E3E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505999, "uuid": "203edf78-e185-413a-b5f7-2965175da23e", "value": "98304:vstpvvDSR7U5fBkV28ZEtIIwo6HZBIw6U9TbutpUhoYc:0tpvmR7wJkV2RtTn65BQmvhoYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770505999, "uuid": "667f46d7-c53c-4ead-818b-71b9b2777526", "value": 3153779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770505999, "uuid": "9ed0514d-297d-46b9-98cd-c0a654d2e629", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505999, "uuid": "d34ca55b-b82a-4ebf-8891-7d1893cf7b29", "value": "Dupe-Dupe-Utility-1.21.x.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fcc407-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474486, "uuid": "589e9d82-f998-45b6-91e1-406ba58a6778", "comment": "Malware payload (Mirai)", "value": "fee0e3a4d0cf71f0ddb9e5e2c6357886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474486, "uuid": "27f821c3-d333-42da-beef-0a2aac54782f", "comment": "Malware payload (Mirai)", "value": "a3bc6a5b3b1b91c003d860111ffcb4fa55bfa317085bf5957de445365918cd8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474486, "uuid": "4ef8f028-2229-4873-b58e-02e0d91f29b7", "comment": "Malware payload (Mirai)", "value": "2746890faa8f8e3077634cbce2ed4e04b2edde90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474486, "uuid": "a1ef828d-e04e-4f2d-8ea5-4d84ee88b271", "comment": "Malware payload (Mirai)", "value": "950b92a2084ea35896238c4f3c4ba296377b443115722773ff420b30c2854d3b10d8260bc688ef62180021606e6068ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474486, "uuid": "e6ee017d-b234-4822-bcc3-06a99799a03e", "value": "T19F338DA5C4B9ADE8D2148E74BD258E788763E100C6932EFAEE4486599047EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474486, "uuid": "4ae75515-95ed-4c88-bd34-f2a5988fcc37", "value": "768:waIwqwtOZc5p3hnYep3v0Gvdn/fAPs3g58cAlOSpE4rC/oIaNCy:wanqwtYduxxAPs3gvAlZpEyvLNCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474486, "uuid": "b18bd302-cc8f-47bb-aec7-981ccd49d7bd", "value": 51072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474486, "uuid": "ced455c5-6666-49a2-8798-23200ca6b02f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474486, "uuid": "1a38b457-9dea-4493-8f69-5f2e8324b894", "value": "Owari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172e556e-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491181, "uuid": "49fde219-8580-41ff-b6cb-9f31acba7281", "comment": "Malware payload (Mirai)", "value": "ccf234c4563519eb53835ddac86de7df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491181, "uuid": "a2b33f69-c200-4840-8447-6c9ddaf8396a", "comment": "Malware payload (Mirai)", "value": "a523f7af291965f2a522e12f1186f1146dd02b100720256f7dbd281ad941cc3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491181, "uuid": "cd7b26ea-dd34-443c-b20d-e0ad303c8932", "comment": "Malware payload (Mirai)", "value": "9b24a478cbbd1ceb441dfddb74a5268c96eab322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491181, "uuid": "feec3f2b-0797-4a82-924e-dda3bb2bc2f3", "comment": "Malware payload (Mirai)", "value": "7ff31d042ad684653a0f0578b7bc5981a5bb33074af5a1169eee429c90be9f4d81fa798b6a8793bed30821745df66b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491181, "uuid": "01bc40a3-1093-4ce4-a47c-fee8773dc3ac", "value": "T1EB930855F850DA62C6D4267AFB5E538C33131F74C2DD72068D14AB3477EA95A0F3B882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491181, "uuid": "3a649b2d-9189-477a-91e2-eb07688f9728", "value": "1536:7E7UuUyPhEQt4covBlOb6MUT32y2XOO6ynlAPiopHMbHIk9+qi5dLcIPQrD:7oO+EDnBlO2MzwO3nlAPpUkdc6oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491181, "uuid": "f6e135a0-9985-46b3-b983-5656d2b4da3d", "value": 91452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491181, "uuid": "00c02356-bdef-4f43-856e-9b634132a344", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491181, "uuid": "19a37983-37bc-4cfc-b926-477c1f66f1ff", "value": "catgirl.armv7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4baf324-0428-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770470857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470857, "uuid": "b4c0fa76-9790-4ae3-b4c5-f08593e44433", "comment": "Malware payload", "value": "05828868734b7d9da8a0e5c65c09f28a", "object_relation": "md5", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470857, "uuid": "170b11d6-0949-4fb9-8e3f-dac5975673a4", "comment": "Malware payload", "value": "a52dcfdb4c1ee1d8a2e9190606fef5f20368cf3cfe5e927eb6b74ed52119960e", "object_relation": "sha256", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470857, "uuid": "4e6d996d-3973-4d8d-993c-73e85449af04", "comment": "Malware payload", "value": "11658ce8bdb60f7af608b2de9fc4b732a7f6987f", "object_relation": "sha1", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470857, "uuid": "808dfd6a-f347-4ef4-ac9c-046a95d53741", "comment": "Malware payload", "value": "ff706d9f524908332033480052cf174e15a60e47d8ae7773718741bf1acecd43dd0d2b573ddc00da59ddd8c5c78d54ce", "object_relation": "sha3-384", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470857, "uuid": "ee333a40-0907-4b55-a4ca-1ad1a8e9a3e5", "value": "T1BCC59E22FB8290B2E4D601B062BE6BF75D787234572558CBE3C01D6A59202D3763AF5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470857, "uuid": "42677af9-8124-41ff-88f7-261214e875d9", "value": "ed3c6fe5f2fc90fbaf5b360ba051c76e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470857, "uuid": "3b56122f-7a16-47f5-b2b5-0d7eed851493", "value": "49152:mfC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MN5MnMznc2:7oLr9DITjJG0boO1EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470857, "uuid": "88e394bf-4c73-4db8-9771-30c4c24cd44b", "value": 2512896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470857, "uuid": "96212e97-b3b2-4f4c-853e-0ceef995e100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470857, "uuid": "40373c7c-e077-4d9b-8cd4-0bd0e1bc46cd", "value": "twain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b86fda-0458-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770491367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491367, "uuid": "568de6a2-5322-483d-bb1f-f84c84d5e487", "comment": "Malware payload", "value": "e4a5c4b205e1b80dc20d9a2fb4126d06", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491367, "uuid": "60635398-cd98-41f0-9a48-ce07f36546d7", "comment": "Malware payload", "value": "a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491367, "uuid": "5121b104-1c3b-4373-bead-6036267237d7", "comment": "Malware payload", "value": "e52a9f004f4359ea0f8f9c6eb91731ed78e5c4d3", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491367, "uuid": "40942378-cead-4a88-93be-5e5b1a9863c5", "comment": "Malware payload", "value": "19fdbbe537ced1575f87641a4dab8280df9209a90dedb0e9d4fd41195b82bd201d05510291c377b1ce0689b36e67975c", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491367, "uuid": "6b02f6a5-6199-4287-b0b8-a6fd312977b7", "value": "T1C2248D4AB2A40CB9ED778175C8934A06E37278514360DBFF03A08766EF2F7E1593A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491367, "uuid": "d83e0c2e-4c8a-4b87-8c55-fd4d775f6ac1", "value": "881b41496a1a292e58fa8299d6648f0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491367, "uuid": "68637651-a143-430f-8239-9563dbad95b4", "value": "6144:rnpW9LsEaMQZ7GfWqFDR3/KHinC64ZiuohzNTd:1W94t7GfWqJR3/KCn4iuond", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491367, "uuid": "4276ce50-657c-401d-8909-fc8bc94e2d69", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491367, "uuid": "b45ef1b6-ca04-41ba-9d84-7f08b15ae63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491367, "uuid": "4d10119a-ac76-4f86-83b1-f362a610b206", "value": "a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8137d2-0428-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770470819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470819, "uuid": "0fd08057-2105-4dfb-8997-8361b8e87b9f", "comment": "Malware payload", "value": "f47fc9dcc77c67dadbdb8a3be026d066", "object_relation": "md5", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470819, "uuid": "31327e47-c329-48fe-ab93-77ed5c1e2f7d", "comment": "Malware payload", "value": "a92a51e8cdf14be3011514531f03d3a20aeb1ff16808aebd201065fdc21cfc82", "object_relation": "sha256", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470819, "uuid": "67747f50-305c-4328-9030-5aee7c0b7ebc", "comment": "Malware payload", "value": "dde5ca085961ed8d7a55df61c8a2027993381ce9", "object_relation": "sha1", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470819, "uuid": "02dbeb32-cf7c-47e4-9480-dc07117af7c0", "comment": "Malware payload", "value": "cfca0e76fbe22b4976737fe764429a5b9554feaec2e7bcc195d7546858f93cd5298eb1e987a1c47065d63870e592c74e", "object_relation": "sha3-384", "Tag": [ { "name": "blackhatusa-com", "colour": "#AB65F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShinobuClipper", "colour": "#A28DF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470819, "uuid": "5b2a687d-593f-495d-a1be-5153e3370a8d", "value": "T1EF121A00FBE996B7E5BF4670E5E363504BB477522896CE3F28C811871C3279496A3E34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470819, "uuid": "28a955fa-7e8d-4b59-9e8b-9747c026c5c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470819, "uuid": "71c43c02-a8ae-4a09-bdb8-ed36a3025b07", "value": "192:ytWnMiNjxAPGuzGKm7gfsA1KAWk74yYyGV:ytWnMiw+uSK/P1KG7xrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470819, "uuid": "2c27ec06-7fcc-4ab8-a0c5-1aca78cabeaa", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470819, "uuid": "3df13bf0-55ca-4fdb-8033-091b777b2280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470819, "uuid": "8d0baaa4-7ef9-45c6-8434-ce2ca516d7b1", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9cc07f-042f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473906, "uuid": "3ed5dc76-3b36-4901-bc89-174301f54967", "comment": "Malware payload (Mirai)", "value": "8fab93ea4668c288c70ac1d1ba3c9bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473906, "uuid": "484ed0b1-ab8e-4dc6-813c-c0f7b7f16395", "comment": "Malware payload (Mirai)", "value": "a9a694f9cb390dc57ac582e0fac0753458194f9a708cec5ca315d3a75364db05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473906, "uuid": "4feebde4-0226-4426-8298-c9ae6d72016c", "comment": "Malware payload (Mirai)", "value": "86e29b3618e9c38cf2b9eb16a4b81924fd4f7c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473906, "uuid": "141a316b-2f77-4ad9-886c-04ca91c23d70", "comment": "Malware payload (Mirai)", "value": "b699eb9dd00ee1cbab7a9fc9dcfbf96f8d97d60ae95dede77e93cead8db67e489f4c65ff0f0e73e8514b725c78692019", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473906, "uuid": "1541ce23-ca0c-4c72-97ce-97b664ff4fb3", "value": "T1F2257C5BF2B371BDC067C030879BD7626931F07555322D7B32C49A352EA2EA01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473906, "uuid": "383b190f-df09-4129-9289-1a3875e10d01", "value": "24576:3wjWgERYmobS/h2IRzuWP2FTh4SvqZwZjMX:ZgEqmobIh2IVuWP2FFHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473906, "uuid": "536df48c-9498-43b4-a9b6-0c92f2b70b66", "value": 992064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473906, "uuid": "ebe19ca4-b17c-4fa2-bf92-98ba085e366c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473906, "uuid": "6c77c644-92cb-4451-a913-00fbd5eacee6", "value": "SATAN.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b2ae79-0474-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770503492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770503492, "uuid": "8d6d107e-9937-4095-a389-d3be601116c9", "comment": "Malware payload (Mirai)", "value": "e6b70ab7aae2198eb7170aafd760e6fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770503492, "uuid": "c960ad52-a1c3-42d3-9694-41f86cf8215d", "comment": "Malware payload (Mirai)", "value": "a9a96cc123866df23aa043f23e7374c6ff75f68c67359f93bb89a05f8c7b2719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770503492, "uuid": "2840a5e3-7be2-46d6-a2ee-d4320b83c7fb", "comment": "Malware payload (Mirai)", "value": "4c3e9c262a98b383d0ebb58cf08068cad64bdfb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770503492, "uuid": "5d7e899f-a693-4882-bc0a-91685bbc23ef", "comment": "Malware payload (Mirai)", "value": "7c503b5fedfe14c97914ca227d837ab3150dd87c31ce7a1691071807e261b0cd5ba68d1fcd8d039a5035ee0336b94c13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770503492, "uuid": "0bbaf583-8958-49b5-94af-de5a02cc741f", "value": "T177532A82FC81DA07DAD01336BA5E51CE37267399E1DE3347DE126F213A8A91F0D6B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770503492, "uuid": "ec39dad7-5380-4c16-9d01-456e2524bbe6", "value": "768:EZqtAATOSAWG/yi6A5LJAcZUO1CBeUS8Vg1xmKFD6/po7bHeBNu5bpsqnZUZ2Fve:E8AE7X/A54yOeUS8QxRu/MbpsCRFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770503492, "uuid": "a19d92b4-8b22-40ae-90b4-8fa31cece150", "value": 63756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770503492, "uuid": "9386eb99-733c-435f-b9b8-1072e424c6d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770503492, "uuid": "1c1239b1-a30d-4901-9dae-cc305970288f", "value": "mao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cb555c-0460-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770494828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494828, "uuid": "419d3fdf-d21e-4f2c-81c7-7aea62fa1321", "comment": "Malware payload", "value": "96a8aec8bd4adfe48f2a6d128eb48070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494828, "uuid": "4c4a9623-281f-4e1f-9ef4-84a769945f3d", "comment": "Malware payload", "value": "aa85cf1907509b2fcc3c7c9d61f71bed10812502a6fefc30ea80203621e467b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494828, "uuid": "e98d6128-bb3c-46d6-94ae-71833fc716b6", "comment": "Malware payload", "value": "6e8ef33c8d6ffc3fc3254ea76313923c2c08d235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494828, "uuid": "10dbf489-03d7-429c-a8d8-7a35d562cb8b", "comment": "Malware payload", "value": "b8dc55f9fc85a37fc1b8cc34e3c70e443595b41a3a700ad2827b0b7a6d050c2134e12a13c0a32091fd8c4e324ef2722f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494828, "uuid": "b6858762-547d-40e5-8c6a-5bff2fd20832", "value": "T11F03E0536752B6FCDC39D93689E70285D31F38055B2F97BE08A825392C76381AF23B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494828, "uuid": "08529a29-3c74-48cf-a4a2-0a43a3b9fb63", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494828, "uuid": "74a80988-579b-4559-8cc8-18ea33f23fd3", "value": "768:2nyJHubAUnDU+QA7EhPdkvSe5vSQE3gncL7KgXLbKwwVmusqhzLYwZAn:2oObBZQA7Ehlkvh0bgcLGobKwwSA+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770494828, "uuid": "dad20665-99a8-49f5-afaa-34d9918ad407", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770494828, "uuid": "56a30964-0197-4ba0-81d7-e9a72ce10bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494828, "uuid": "6191961a-342d-4e5c-af14-355accceb101", "value": "SecuriteInfo.com.FileRepMalware.32821747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14df4be-03f4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770448490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448490, "uuid": "c44df1a2-653c-490f-91d3-9b071a8b24ce", "comment": "Malware payload", "value": "5e9f7caa7efe823a72c93d6e5b6f3cfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448490, "uuid": "436e1dc1-ebb4-4be6-b9af-e5a07b48fda2", "comment": "Malware payload", "value": "aae6a54204f9ac5bbdcfc9a80b1ee34e2b579c33c65b883700bb2fc5d7995547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448490, "uuid": "1903b3ef-23cb-414a-b602-d7f574f13040", "comment": "Malware payload", "value": "6b32ebcaa934ba5b46f70b6b2e085b5e402b6828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448490, "uuid": "99ac9a66-b3ce-4690-9886-b52d4c09fdbb", "comment": "Malware payload", "value": "de98346858ed1d16ed217e9bb26dc4bded0e33c96430ccda95f9336e758c01cf57abf6f96541ce815ecb5dfe07265341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448490, "uuid": "ee85446c-68fb-4698-ba92-064f7632823d", "value": "T1EEC423E0E6EDEBF8A0D0A5F1BF04D3AE21398B661401806F075356776FD67AB65A013C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448490, "uuid": "0abeef2b-b58a-4216-96d5-5a8926ecdeb4", "value": "12288:l2ld7OnOoFleweKUZabU/HOcrl4JItoFPM1vXeeI/SWsLe1:lHOxweZC65l4+td1KSWsLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770448490, "uuid": "5e76bd63-a256-45f2-b00e-17d0fdb7ce4a", "value": 553667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770448490, "uuid": "850438dd-3c0d-42ad-bee4-c654bd71e04a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448490, "uuid": "b74a7c1a-77af-43d3-9bca-828fa7b58903", "value": "bizy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ea9949-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1770467077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467077, "uuid": "f6fdd065-8c40-4144-90a2-bcb7cef287a7", "comment": "Malware payload (ACRStealer)", "value": "2b19fd2d1be6cab4e6209df995b13a2b", "object_relation": "md5", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467077, "uuid": "7fc14dfe-d8ac-448a-bc90-6362c19271bd", "comment": "Malware payload (ACRStealer)", "value": "ac0a1cf3cd79aa907c915245782ba76eeb1af6e6636c60921dbd3167f8426f38", "object_relation": "sha256", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467077, "uuid": "77fbd5d2-ccae-454d-9638-d3f7b8cd3d84", "comment": "Malware payload (ACRStealer)", "value": "ef59150e63855e0e46385998c7fbbf57a2dc50f4", "object_relation": "sha1", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770467077, "uuid": "76a20818-63ad-4bab-bd57-b6d70bf9c116", "comment": "Malware payload (ACRStealer)", "value": "67bd351f99b9fe6c35864de3d7ea6f6126a8d33259423b20e6a0379d8fc9f526abf1e655e4732610394684d9f8f70b06", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-109-239", "colour": "#5D317D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467077, "uuid": "ae8d9bd1-f8eb-4bc6-88aa-c2f60c5c0c34", "value": "T18B0733A891EDF0531DFFE337ADE0330A4098955A020F821697684559E9B5FAB4E30BFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467077, "uuid": "d43871c6-7468-4310-8683-190392e4fae1", "value": "393216:czJlI92jaEMp71mJivlN9YBiai4KtKs2uQ060PovjpSmV9Irclh6fJ6XZiaiYf:EI92hMpZmkvjYYFKs29KovpCAG+Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770467077, "uuid": "012d3003-5fec-49e5-97ca-a5e4799fbf36", "value": 16963246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770467077, "uuid": "65f6c7ba-4ecc-4ff3-b4fa-9973366b9cc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770467077, "uuid": "cdcad3b0-eb71-4d92-aa48-da9b21b19af7", "value": "Setup_1770444028107.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0765ab-03fb-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770451511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451511, "uuid": "eb6ecb7f-2ccb-4b33-92f4-ddf53c63eb86", "comment": "Malware payload (Mirai)", "value": "d73bcac93936e1f29f5e31dfcc9bf34b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451511, "uuid": "fa0c578d-198e-425a-a525-b2bd5f76975b", "comment": "Malware payload (Mirai)", "value": "ad0962aec453fed293014e610ed45e98eb79c6cb460f2858b7e80eada2f31ba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451511, "uuid": "7f946736-601a-4f3b-a645-eb704e4ceb4b", "comment": "Malware payload (Mirai)", "value": "bae9786d5e89b80a4870f76e3189d0035a9a0098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451511, "uuid": "3b8e735b-7183-4c53-9fe7-9156f5435692", "comment": "Malware payload (Mirai)", "value": "1394ffd8cae6b130880b4b7a37c96f86a9cf4b68e2903e6f62a8fd1cbba0c740dd63785c7150a62ee8a3a0873ee75557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451511, "uuid": "e4fa6162-c453-47fe-8731-bf962cefab7d", "value": "T10B03288AF8029D7CF91BE77F84534908B5717752A0830B2A17A7FE937C721984D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451511, "uuid": "b5d3bbf8-4be1-460a-be52-98f5589de42e", "value": "768:FcsmpeZbI/SiKKUBLIJH65F2Iv+r6ueQ8Q8QUTO8zyvmDWl5mb:EaiKbc65F2Iv+rjeQ8Q8tO8zamDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770451511, "uuid": "2ac373a5-d502-4096-9aa7-755d4bb758ee", "value": 41068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770451511, "uuid": "1398714a-788b-4fb7-8c48-da8cf5f6fabf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451511, "uuid": "01269b9a-6386-497f-867e-c8191ca622f1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780b6eb1-0446-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770483613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483613, "uuid": "17de02ad-060a-40c2-9a2d-138ce455b91d", "comment": "Malware payload", "value": "1522ad913525e9eb40b69818f7f6fbdd", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483613, "uuid": "449e87be-51fa-4799-9270-ca273b15688a", "comment": "Malware payload", "value": "ad2b4abd2229a623f4b3046d4732fd686e059b5321b79ebc074d2df9f66da9ba", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483613, "uuid": "158fda65-a346-4096-b472-05b4eb6fe9c4", "comment": "Malware payload", "value": "56169e710ebbe22114d9e75d4ac3bbbe68caff35", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483613, "uuid": "31f20cef-e0ab-40d6-a73d-d35128d82d11", "comment": "Malware payload", "value": "3b381994ecdd699791a676d41472dbcb44b157303558caab6f13521cee90dea685f910da4534f377f3aef66638db64c4", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483613, "uuid": "cc5c070e-5de3-47d5-b908-0bc74a5e0d21", "value": "T1BCB533E0A8F7396BB1CF743A985A1120E62BCF073A477820E6855DDFF667D15CA0A4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483613, "uuid": "09808903-3738-4df4-a1ab-ce48cd8091c2", "value": "49152:j3T2IaYBPd2Te/BSIqIN4WSPvYWL/7bK9bc4ONX08RHR57XVK38h:j3pzB0y/PjN4ZbK9bc4E08tRb46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483613, "uuid": "64605e52-afa8-4b4c-b0ba-c5c85e97905f", "value": 2445827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483613, "uuid": "6e156809-d4e2-4cfb-866f-6d5bd049f0a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483613, "uuid": "bb0207f0-8c54-4239-a3d7-a2c03cf09135", "value": "Executor_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343b848a-0446-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1770483499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483499, "uuid": "1ea17ab1-2e34-46ad-992d-fae14779969a", "comment": "Malware payload (SalatStealer)", "value": "dce97eae376717d1f809e762889a89f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483499, "uuid": "d4581919-89fb-4017-b4a7-fec49706ea61", "comment": "Malware payload (SalatStealer)", "value": "adad69b3c87a7632d6d1beff6e60868c12d198a5db14644a7b0d3437bb6824ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483499, "uuid": "e79dbeb4-91b3-4a51-a68a-8f5d5ad739d7", "comment": "Malware payload (SalatStealer)", "value": "ea947258eb94cae026df2fecbf874e70aa286fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770483499, "uuid": "e7b00521-2cad-450c-9d93-251ac9c0e5bd", "comment": "Malware payload (SalatStealer)", "value": "15a5b2421562c0af937e46d4e9710bc4a872e3cf5be053dd9ffe01f5d1cead7a9b0bd7b6b1f784ff6f006e4b3b5b02a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483499, "uuid": "9343310a-db3e-4180-9b33-fa63666f34d0", "value": "T1BAC65B01FA8B98F5E9031835416BB23F63315D049B28DBEBFB547F6AFC7B6811926205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483499, "uuid": "6f08e185-7b73-4e79-a5a4-5add6ef7e720", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483499, "uuid": "5b97dffd-c0c0-40f2-9e23-8fee7a48c091", "value": "49152:r0R4Q1wsFEbWxy90ZlE0xOeo90dQkYjcMtBNx5N+llkSNNaXwGpY4uo7/49RQp4T:YuQ1wgxq2rllfaXVx/oNsUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770483499, "uuid": "3f0e6bd4-3748-4a59-ad79-9cb137779d4b", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770483499, "uuid": "bcb8119a-24e8-491a-853f-4cacfb450f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770483499, "uuid": "1031098c-9fe2-4331-9755-58e7f650e62c", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989d63fb-03f2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770447590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447590, "uuid": "7b4536de-760c-421c-b6de-dba0bdc745ae", "comment": "Malware payload (Mirai)", "value": "f6094f9f55b72284a66d20aa83614983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447590, "uuid": "c8c1ca8d-4086-4d84-91fd-9a5eae1f8d73", "comment": "Malware payload (Mirai)", "value": "b04d3ad2ceca9682a5bb2cdd0630739bcf4f944e3eed6ae06e3dc53d585f0a12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447590, "uuid": "58c6b22a-db79-4f21-ab17-841390fe6777", "comment": "Malware payload (Mirai)", "value": "c3e7aeed3da16595e4ce87ea9c64ab8d1bba41d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447590, "uuid": "21af63f5-1347-41ba-a24d-8d4e6766ec0b", "comment": "Malware payload (Mirai)", "value": "4a113652a603566dd38b33cd5c815ea20cf68b8b407341ce4cbcb02ed1f4c64b93f6041f2e946b6e9e2328707c8e17c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770447590, "uuid": "02f043be-1d1e-4d5f-ad00-d432a2537c7b", "value": "T18B13E503B945D4FDC58DC134076BBA3E882AB57E4278B6F6BBC4FB136989E605D1E804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770447590, "uuid": "7027a7a0-c791-4285-a532-f5ef14be176e", "value": "768:xQqo5NLlIMpQRAxZTFQ0qea5YzNGCOj9n5xEygoHrrHwFXb1XVMhZrMhMrMPV:Jo5dlIMpQR4ZhQ0qea5YzNGCOZnDEwYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770447590, "uuid": "3e36f523-4789-4d9a-ae24-ef03582a35fc", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770447590, "uuid": "86b61702-fb99-4b64-b108-994888fcc7fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770447590, "uuid": "84479509-a41b-4fb4-a39a-8dd1fbcfb352", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc9c610-03da-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770437374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437374, "uuid": "3fd02e26-29ba-4999-abbc-9051ebb6495c", "comment": "Malware payload", "value": "c8942180ef99700898ef1c12e9dd97af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437374, "uuid": "110ee6d4-6fb6-4975-b43a-27ad78c6402b", "comment": "Malware payload", "value": "b0da68651d303cebf9082f2ceb05d0ab82bcf31338374ab73191c98c1fb557fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437374, "uuid": "bc017268-d60a-45ee-b900-535619c2fd22", "comment": "Malware payload", "value": "74518fa24b6b9208f807f590c39fa4ffe2f430f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437374, "uuid": "5edf2570-c2f8-428a-822b-d8946a2e8f55", "comment": "Malware payload", "value": "a80bbcc94aaeae987a9676ecbd8e65b0f794285ac33526369c36c565503d4f965cb35fd791c636b72a57b472cf0665e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437374, "uuid": "7ae400c2-00a8-4f31-9cc2-d5b3f013af56", "value": "T13632C617A7B7AE1BC4D037770193072162E95F916124472F7D0D1C8E6E9B3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437374, "uuid": "62c77519-7be1-471f-82ee-b1f66e27c775", "value": "192:xvrOR1CQOsz1NxfAz7H9iG0GhWaDpU/O7Q89AGSybBqeif:xvrbCzfa72GwIU/kwGSWUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437374, "uuid": "86fdf305-617e-496c-85bb-99a239839e2a", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437374, "uuid": "b92939bf-873d-4ca9-be17-87838124c2f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437374, "uuid": "8ad4ae65-cddd-402c-b708-e3fdbceb8532", "value": "israel.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9149a6de-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461751, "uuid": "e19fec41-7954-45cd-95d8-aa80e483984c", "comment": "Malware payload (Mirai)", "value": "d702046934446c2dfc6b61186231ae5f", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461751, "uuid": "39add5d0-0784-41bc-9eda-1257e02fde4a", "comment": "Malware payload (Mirai)", "value": "b334d00076ef49df1f3975044b7fb08f7e81e18768fb6ed65ef20fa46edf7cfe", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461751, "uuid": "59e92fce-f4b0-4c9b-90ed-94d692b7141a", "comment": "Malware payload (Mirai)", "value": "3d83a5352aa1597f9ba927ced051de45767bdbc3", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461751, "uuid": "31736524-780e-4ed5-9b6e-8e66bff8628d", "comment": "Malware payload (Mirai)", "value": "798ea5d22a2fe55327c86209a35feb82f72a0907bdb556512f1d77de6c490594376a65c9770fe7babb481fda45c7129e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461751, "uuid": "ac951bcd-1ee4-4bd9-92e6-a93941b60d23", "value": "T15F767C96BC5D7462E6D879352F7603943339BC064F81C7232A14BB7CAAF63688F53660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461751, "uuid": "b8bf9523-7246-4026-b37a-bfecb0a3cbb4", "value": "49152:rhUefF+SQyyNPaXRZ0cpI8AaHqTRnt/k7MSGpWDlt2wOl/fm3Ek35Ea:rWefF+8yoXRZ0kI8BHqlnt8NGpBFOEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461751, "uuid": "d08eb271-6a2d-422d-af6b-dcd418c98bb7", "value": 7733432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461751, "uuid": "da39b593-6cae-41da-9060-0d8d6a087531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461751, "uuid": "24feec00-659d-4e2e-b49a-860a3c6fe0d5", "value": "ip6addrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e981f4-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474482, "uuid": "6c297a11-147d-49fe-b87e-53e1b4ba3ef1", "comment": "Malware payload (Mirai)", "value": "4a5a02cdd84385d057e2f3d404c189b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474482, "uuid": "bc96b8ef-3ee4-4670-a597-f400fafb543e", "comment": "Malware payload (Mirai)", "value": "b3ad0f5d232c1b44a5f7f1acbc4a997e1eaf1e77056ebf687a930e1b5c486143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474482, "uuid": "59a63f99-11d2-4e23-80dc-d2e486cfaca6", "comment": "Malware payload (Mirai)", "value": "82123211a5c91fae0f030cdddc32d71d83bb5a03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474482, "uuid": "c1c8e2a6-7cb5-4522-834c-716c26844397", "comment": "Malware payload (Mirai)", "value": "3181ef5429f1a48296e70eccd263ee4a4cb3b1c77157058d9eb938ba7fbf47eae29c83bffe691db220f4e8007480f3d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474482, "uuid": "3f4d39a0-a5b2-4dd8-ad65-54f8c6f489c2", "value": "T1352329C47482F9F8EC15057C317AD7729EB7F43A703ADDABC39994239815A01AA072ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474482, "uuid": "aa714aee-e59c-40a1-8d79-a2450a1f6031", "value": "1536:SZ4pyHAH8TgbrnOIjuqxqBNcnvkm92kdrkEU:qHAH6arnOIjugqvAvkmAkZrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474482, "uuid": "15b03e49-1499-4651-afca-3d9c343fdf76", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474482, "uuid": "493a9122-daec-43cb-876e-9dc97a186f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474482, "uuid": "1dd28158-222d-43f1-9efa-94a76908907b", "value": "Owari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd89c58-0451-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770488238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488238, "uuid": "bf6926ad-11a8-4828-9ef6-59d35be4cd75", "comment": "Malware payload", "value": "e3ef6627d06f1d9fc62b1db54f0203ff", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488238, "uuid": "e03d712e-dca8-4115-99bd-f60d5986ecef", "comment": "Malware payload", "value": "b423342e081c0b4ace357d426c0e9af45f54525edb0d29dac448dab3ce46de81", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488238, "uuid": "a2c84425-4fa7-4e92-9da3-87d8988d8d77", "comment": "Malware payload", "value": "aabfd4b6937404d44a5060748f29dec6491b6179", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488238, "uuid": "d44327cd-190b-43f7-afe6-c4b0d017d187", "comment": "Malware payload", "value": "e52ff6bbe6c599fce15aec9586523793cb78ec52f54d1505ab9d343c9a6714579504895591b9abae16f4778f1e646785", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488238, "uuid": "39bb9151-30d3-4306-ac3d-595fb274eea8", "value": "T17B951803F01156ABF01BFB7F9050832066B0F976860BF1E33B7D585EA9D76C58AA52C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488238, "uuid": "4f8199fd-6554-4ca7-b43d-9ae10ded9997", "value": "49152:uWyWxjo7O8zegcRO5pMxWTWDU/Q1W3XyWP8+Wqs1Q0w+65AzpQerd/1jeeheuU:u2//1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770488238, "uuid": "e42f5238-8800-4c38-a66a-f37c4152f0b4", "value": 1967317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770488238, "uuid": "ea2ccadf-59ff-498f-b9b3-26fd055cf271", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488238, "uuid": "a121438c-a7cd-4914-ba43-128d19f76dd5", "value": "Mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85180079-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491366, "uuid": "b41e0e74-1dfa-4688-9c2b-46d050f2dd46", "comment": "Malware payload (Mirai)", "value": "03bceaec4a99e45c3711cbe345031df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491366, "uuid": "7f7cd249-a828-45d0-a9b1-2c01ed98d293", "comment": "Malware payload (Mirai)", "value": "b52562d9f8454f2711e1e13819830182190825e02d985b2d2ff900f7f43c8a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491366, "uuid": "8ad35656-3824-40dd-b5a2-e9d4d1b4a534", "comment": "Malware payload (Mirai)", "value": "60620ceb758a6b35f216e109dfbbe8349c157bd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491366, "uuid": "f8755c3b-ce7f-4687-adb4-7a6e88d8ac18", "comment": "Malware payload (Mirai)", "value": "5878a920f90241d2c6c4dce6b64565534100dcef5e3ff60820da9f7626b30f4a5b78bb082d4208f13c74316f5bf6a269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491366, "uuid": "eea393a7-78e1-4a78-aafe-0ce651cb88b8", "value": "T10E141C4279418F12C5C522BAFA5E428D37133F7CD2DE72128D206F64778ADEB0DBA616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491366, "uuid": "6e6ad077-c1e8-4d82-b1cd-a71bc84caa98", "value": "3072:NSmBMj2sECignfbdU+Di2CXXjYzkba05EYjAEz8qDbLvNDJs5KWo:Mvj+gnh9PCXzK+a0uHEz/LvNDJs0Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491366, "uuid": "c32514bc-8d3f-438d-bf8e-2f8e66ed8e60", "value": 190608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491366, "uuid": "ccd2fe1a-f769-48eb-b164-693b33bcffb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491366, "uuid": "80ecc098-46f3-4f2d-9907-22b1371618e9", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d55e99b-0424-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770468965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468965, "uuid": "6de3d8a7-ac1c-4954-8024-a81e1caa52ef", "comment": "Malware payload", "value": "6fe2a2390b05276ef1dd4b7c39a4c54b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468965, "uuid": "9fbbed82-dda3-4ad0-a059-dce9aab77b45", "comment": "Malware payload", "value": "b6ff6b9d356fcfa872cc9d944c14294c65c416299c6451520753544f5f51a2dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468965, "uuid": "97d09519-c23a-4cca-90db-ebd45642945a", "comment": "Malware payload", "value": "712299a6213aa54e4fecc195bf378e44384d6483", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468965, "uuid": "2118c1da-0e5d-4c4d-8ef9-c153c936c391", "comment": "Malware payload", "value": "efdf60275624e1f9181d641a371d867e3c0db58cbe74ee5fce0d28c9a78b16ea6ad49347b4c107d06d64d9dabd92ee38", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468965, "uuid": "a212d217-f431-40df-8a9d-2ee300301164", "value": "T130E07DDA66E6759BDB3CAE48F46E82486441E3C870B2CE60E015587698DB10AB054FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468965, "uuid": "8513a5e1-bb96-4ea0-8e58-5d86a84dbdf5", "value": "12:3J3UWJQjxUW4qxUWFf0LKjxUW4CxUW4xUW4fAARn:3J3DJQh4yUKh4KAmdRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468965, "uuid": "330b436d-ac5e-44e6-9b0a-f8c7861f4275", "value": 394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468965, "uuid": "1d2708e5-4e8a-485a-a1f7-077958dde5d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468965, "uuid": "688f2918-7622-454d-a834-963730f77a55", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b982a1-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461760, "uuid": "077117d0-807f-43e3-b183-00b53e144f27", "comment": "Malware payload (Mirai)", "value": "9b8784c4bd155b2004f616c9ca7935dd", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461760, "uuid": "a177af25-e808-400b-92bf-18d7355ce75f", "comment": "Malware payload (Mirai)", "value": "b7dd882ea8ba12865db3b3d892be0997944491fcb369a177f1789fa3d8649487", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461760, "uuid": "48425105-6e12-40e3-8364-244e523f574d", "comment": "Malware payload (Mirai)", "value": "0ea63e5f9801372b5a9ff1ce1960bde0f394a289", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461760, "uuid": "8e313049-12aa-4432-bab5-c987bd70a65f", "comment": "Malware payload (Mirai)", "value": "bea2064b31c2b65e734c6a564298a1a9c71143d7c2b89119b4bf0caa72c4b2252a93ccfbb004856d383c9d3c5fa8e2c1", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461760, "uuid": "8041b934-40fd-4d8b-8fcb-6b1127bfbde1", "value": "T1B4865B42F6086FD5C9648D3385F34AA027722D056B329782E744F37E6DB23461F5AFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461760, "uuid": "18be702d-f360-4069-95dd-912ef50421de", "value": "98304:FmLckFOQIJ7vrhRW3Z8g2SGK9igVrhBEB:FmgkXZh91V9CB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461760, "uuid": "69aa74c5-8ce3-453d-b11c-c202fd41df7a", "value": 7995576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461760, "uuid": "e6074831-e42f-442b-b4c2-d2fd265ab781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461760, "uuid": "083dc76e-81d9-4066-bb32-32b906f3bd3d", "value": "ttmswapd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fea1cb-041e-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770466624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466624, "uuid": "eec5685d-65d0-4989-ac0a-183df21e9a5c", "comment": "Malware payload (PureLogsStealer)", "value": "50e91f0dd8908e00009368be9341807c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466624, "uuid": "f912b8d6-84ae-4349-a3ab-024aefe5d00d", "comment": "Malware payload (PureLogsStealer)", "value": "b7f45956fcc360cdbe6b5b8d7c510dcc46a8c802f0d40dcee5dc3f852ed90b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466624, "uuid": "1ca8a3ba-ca4f-48a0-97a1-f71100354007", "comment": "Malware payload (PureLogsStealer)", "value": "aaaa7b40be16c3287c844631d682aef1d54923d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466624, "uuid": "b1dabb92-1ec1-44f3-8f98-92b68f4e7b27", "comment": "Malware payload (PureLogsStealer)", "value": "5f049692f307f6b99ce0b125f764e4257364ba4622c8230c75350a0c96430929102b72db28f3307c69bccb508c55d258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466624, "uuid": "1ae37193-0f82-4f80-ab48-b91654ade2cc", "value": "T1D40733215A16E19ACDB609BA23E2D170564294027C049B4C3FDA31FE87EE472BFCED5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466624, "uuid": "f4787fd9-902a-4c28-a3bd-4cfc80286a3a", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466624, "uuid": "f317fc3f-7c91-4fbe-9297-e785ae630daa", "value": "393216:XpkfrOsCZ2bxlAc3qE7E/QpV9sVm1JHMp+/6ZdNrR8bwF/:XpCrZMBc6E7E/kV9sVMJspMAR8bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466624, "uuid": "a7ad799c-551f-4e7f-b014-392194ce4ff6", "value": 17576448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466624, "uuid": "65e0ad1d-6860-482a-ba50-f2df8e2af923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466624, "uuid": "c7a6da76-7226-4967-a0f0-cdc1bb5d0e78", "value": "Installer_v5014_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192b2f12-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1770466703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466703, "uuid": "b036c71d-4b51-4fd0-8fc9-d67b88ca08a0", "comment": "Malware payload (LummaStealer)", "value": "653871b13f9d24d4fcd86f53f3facd9c", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466703, "uuid": "8abab81a-f52d-4ca5-9b69-15b1738359cc", "comment": "Malware payload (LummaStealer)", "value": "b96764c6a0768d3ff25518624450efc112bbb024a9627adf3c7a693a71ff3fda", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466703, "uuid": "db0a3026-f164-4c09-a06b-f71e10b2e9ea", "comment": "Malware payload (LummaStealer)", "value": "21956c2ca43e72de6d7c67f51393fd53a54c715b", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466703, "uuid": "24cafb5c-4e47-4ea2-87cb-52a2184f695c", "comment": "Malware payload (LummaStealer)", "value": "3b25916ebf0b210d2e28b35f38095f98289ee767e4dfedd347019a2f999fe084152a70695e6949ad274a4887b17cf748", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466703, "uuid": "5c95f25d-db9d-4340-be31-b772f21c1e69", "value": "T1D177CF1677E88075D0BB9238897B9716E671BC21073096CF2254BA6E5F33BD05E3A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466703, "uuid": "d145613b-75c8-4ed3-8b6b-c4ced6f844b3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466703, "uuid": "7c3d20f9-dbb2-4c97-bac3-64cc00459195", "value": "786432:GA6UNpoFeHG9kAFNM8QXWIJ2fnC+o3LG:J6E6FeHG9kAFN8qnC+oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466703, "uuid": "21f5eefb-dbb7-4183-bd3d-ef4625ddd123", "value": 33908736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466703, "uuid": "43eb5f21-8b9e-4160-8c97-49375fb4e81d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466703, "uuid": "e2ac9fa6-4a30-4f75-bfa2-906c51ba1852", "value": "cx-programmer 9.1 free download full_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93157038-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468196, "uuid": "066ec690-39d2-4b3f-bebb-b98f1da7825c", "comment": "Malware payload (Mirai)", "value": "071d7a145177a509c6dabfde70d55308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468196, "uuid": "19fee8e5-e0e1-417d-a43f-a625eed3ecb5", "comment": "Malware payload (Mirai)", "value": "bbee83c69ed51a10902fdaac4f09850e712ea35a9bc031a4e092cb82e3119361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468196, "uuid": "69f6978b-8b54-42a1-83dc-10a4ca99f40a", "comment": "Malware payload (Mirai)", "value": "0bab68489b17387d9391686244973cf6d0789250", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468196, "uuid": "e8cd4d83-5690-4664-9879-880f3058b40c", "comment": "Malware payload (Mirai)", "value": "18d8d3c71b70b3cd7b68b69a28fa0923bd9ba11ae0d4d1c7390a04ab86bebca537d019271221844f14a75bcaa140c137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468196, "uuid": "97685791-634b-4fe6-897a-f7aac731be84", "value": "T1E4D33A12F58184FDC08AC1341B6FB63AA931B1DE1239B6EB77D4AF123D4EE205E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468196, "uuid": "89687302-f5f3-4e8d-953e-c7941c2bc089", "value": "3072:AkAIYNg85gU7Lfqn6LLfOA3g4HVoKMhPJD62qM9CZhwNX1bzr2ErYbJ4Aur:AkA3Ng85gU7Lqn6LLmA3g4HVoKMhPpsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468196, "uuid": "e2a2533d-25d5-4692-9d45-4a9052d035fb", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468196, "uuid": "b9a5a75c-6c41-4353-a573-acd7684d63d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468196, "uuid": "d001f050-9c8a-45f2-ae45-33ee8a60be60", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3340b0b4-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438830, "uuid": "81290139-f8bb-4dd6-b021-44cc26883da8", "comment": "Malware payload (Mirai)", "value": "6dabb4a18867ab48984f0f2da2178dcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438830, "uuid": "cb1a027c-2cb0-4152-9100-5a60807078c9", "comment": "Malware payload (Mirai)", "value": "bdb9bb2c04cc4e959e231fb9f12b84839486cb945d217c91abe9fd9097dbfdb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438830, "uuid": "14147ec4-9828-4aac-9364-0fa3edfb54f4", "comment": "Malware payload (Mirai)", "value": "ff8836344cce652c917a9e0415e3483e8c44c6fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438830, "uuid": "bd8500dc-7587-4fe1-addc-ed8580ce1090", "comment": "Malware payload (Mirai)", "value": "cbe2c4f843411c8e98c403d5da056004348bc95eb41572f3161a64492aa6fa5336b7f0bb9c5fb8e91da15c0b4dbac12e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438830, "uuid": "de198de5-2502-43da-892e-181024075a16", "value": "T1C4A30895BC82462AC9E413BEB57E12CE332573E5D2CF7213C8110B697B8A61B0D67F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438830, "uuid": "fa8193b1-1507-446b-a646-a116cbe88340", "value": "1536:FyqXakuKbj4O6KLDFTXerSWyT89CEBh9cdX/xk5sG/6EBdiX+Eus15Rwlb5YnXo:FP1uRO3EA6rQUSE3iux+bEO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438830, "uuid": "e2803778-a680-4281-9419-fe1f0ec52598", "value": 99940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438830, "uuid": "9e50a673-657a-49e2-af1c-ff3f2e26c573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438830, "uuid": "636d2f60-a5ed-4666-a46a-0604e582998b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300a3141-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489075, "uuid": "74519800-8d62-462e-86ac-e71a7f0987a5", "comment": "Malware payload (Mirai)", "value": "732bb9543407955c86cced3f7665a84b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489075, "uuid": "01cd20cf-751c-41a4-a990-a08b83cd8524", "comment": "Malware payload (Mirai)", "value": "be7e466546b91bcec0b8ac92b30c2301e8828ee9fdf90aa1c96c7d87294497a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489075, "uuid": "95861123-1d02-4232-8db5-90358788df1b", "comment": "Malware payload (Mirai)", "value": "ebf72d7ad5a822185fa3f2aa2d2a4dd6ca366fd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489075, "uuid": "66313bd8-d157-4523-8c19-0d1b52d5289a", "comment": "Malware payload (Mirai)", "value": "f571eca756b33b0a144dd30c4bad96e1c1457df62c80ee7c1cb3c4993a7f4f449c99a89d1b63eeb6778604caec54b5a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489075, "uuid": "436c5107-ab48-4754-9281-218c12391d16", "value": "T1C773015DFD7D98C7C99F0EEE85CDFB5608C8A35274C3DF0F9252D980A86550E60A82B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489075, "uuid": "76bdb8bf-3477-4d0f-a23e-e695770875f6", "value": "1536:HO/AULhv1Eqw7tHva/G2sri6GRQu9JVKZk4IT1uupCL:eXp1EptH2eirQuLqkJ1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489075, "uuid": "e02ab048-5ca8-4563-bcc5-0304d0d0b5f1", "value": 77232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489075, "uuid": "c03c16c8-6cd0-454f-b236-992c7ac79bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489075, "uuid": "8d52da24-8062-4eca-bd81-2647fe33c5f8", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1a1d89-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466973, "uuid": "9645a30b-3868-42aa-9746-020c968bf3c8", "comment": "Malware payload (Mirai)", "value": "dac72cbb81a6dc6f259040d6730cb882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466973, "uuid": "cf6532b9-b327-45d1-9fd5-fafb19b2ab93", "comment": "Malware payload (Mirai)", "value": "beb728166d20e8f039350c8356c7cd42e5e7bfedd07067b9a8c7ac3983a625a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466973, "uuid": "67e06061-5a08-45fd-97cc-c5aae12b5e2f", "comment": "Malware payload (Mirai)", "value": "787e00b1876b3c8ca43a716c98683b5d7686c5ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466973, "uuid": "fe00520c-deed-4555-831d-3f2affe3d059", "comment": "Malware payload (Mirai)", "value": "400d3e9357011aba2ca0ac32379f7cc220507b6f4230242885ce0eb05313b3d96b140668d9c8a49503bc947f4be591ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466973, "uuid": "4ecfc9e5-b597-42f2-8aae-e01d2f10b520", "value": "T104933A52FD818A62C6C126B6FB6E028D376653A9E2EE7303DC255F2133C791B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466973, "uuid": "438af88d-772a-49e3-aabb-dc8c17c7d483", "value": "1536:ZJJ77gnewaIstYqlW5zYItVv4CqvCw9kwlJzO1suzJeJCQsKiDjS:ZJB7gnewaXavv4CcqgzObCCQNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466973, "uuid": "82a6c903-6444-44bc-a9da-ceb2fc293ca3", "value": 89768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466973, "uuid": "6320f498-0f4f-4fdd-8d94-10de29275005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466973, "uuid": "163e2f0c-b500-40ff-8792-faadffaeabdb", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6935268b-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491319, "uuid": "6ddaf375-ff5e-40a7-b6bf-85fe11e559da", "comment": "Malware payload (Mirai)", "value": "7456756e03b90908f81b3224e02481fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491319, "uuid": "46ecc85b-3667-4a71-a77b-8e91ebe291e1", "comment": "Malware payload (Mirai)", "value": "bf42d964826b58577a85b56f272d80bb41db69d93e8207a5a370a90233b4ab58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491319, "uuid": "2c7eb77d-e059-4e38-b2a5-e4c087249d4e", "comment": "Malware payload (Mirai)", "value": "a3704184a782ec56975e30be7c2a0c675681450f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491319, "uuid": "9dc11cf2-8609-4a56-bb99-f2b1402acf33", "comment": "Malware payload (Mirai)", "value": "1b61995f9effe93d93c7f7d142a50b4e6632e01f7590feb40988d1c1de0be7e7210630e6b72e38cab2d9e1579919f6b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491319, "uuid": "d4a35059-cf23-49d1-b609-308d6f1d4451", "value": "T13943F2210191962B57A08CAADD2B861D7343CFB934AA78AB618CC6746EC7D0845FD4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491319, "uuid": "de45e4a9-6f78-41e2-8812-04985eb9aed2", "value": "768:0PyDIM2LXAI3QvZ/pZ0NMpkVgLz0r33Q901OBNK67KWWQh6UGhOXXHNGAHOvL3U4:0acXAIAFpCNMuVqwToNtWRJhOHt6zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491319, "uuid": "354eb7fa-32eb-45bb-b6dc-dbb547ca86df", "value": 60404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491319, "uuid": "3dafcf35-bd55-48ef-8d78-9cc6bc40e269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491319, "uuid": "3f204d0f-ebcf-4cb9-82ce-1fcd0c751436", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e00a33-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468199, "uuid": "2181d1e0-e0ca-4cf2-99d7-f8028a866e00", "comment": "Malware payload (Mirai)", "value": "5a222efa626c7c319f453ebaa3d32ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468199, "uuid": "ad98ff62-f9dc-4853-82b6-95b1b83d9aa8", "comment": "Malware payload (Mirai)", "value": "bfbc09ff6ca9160475925c3b9844a506da377fb77e4ead5cdb09db15fa8ba979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468199, "uuid": "7033e95c-1667-4cdb-9244-019f2725f25f", "comment": "Malware payload (Mirai)", "value": "91e6eb082d050d6158907e120cfa4972452c8ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468199, "uuid": "f5f55716-a6b4-46f5-815d-a210eb128478", "comment": "Malware payload (Mirai)", "value": "e2c1ba09a648508f1f9c197758d01956c833257b87d26d5c1fb74794bd408bb3a25c94863d67facef45f260a423c6196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468199, "uuid": "f3c6789f-cad6-44d1-bc9b-f0e398abf39f", "value": "T1E9833A56BD919A12C6C022B7FB6E418D372613A8E2EF3203DD256F2477CA91F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468199, "uuid": "afa00e9b-cd6f-4415-9678-aa53ddc15955", "value": "1536:IlconmvSqg/V7ThKryeEueFgPEtDbi75f/qwoCuS99sqtrtwcCnw11ZbMd5ed:IlcomvLgx6ED540tJE97trucEw3ZIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468199, "uuid": "8e00d261-070a-49ae-a00e-af0922226149", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468199, "uuid": "9dda0936-e706-472c-8419-006359fe3b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468199, "uuid": "e6e9a5ef-8c5e-4ff7-8b97-d9d66adab284", "value": "binary.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fd0732-0415-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770462646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770462646, "uuid": "a9a5d289-c30c-4f8a-9ce0-d186a067762a", "comment": "Malware payload (Mirai)", "value": "081690da6e1789eb5fea141be3ec66e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770462646, "uuid": "c5bba480-8f0f-4982-9827-fafb269d27ca", "comment": "Malware payload (Mirai)", "value": "bfe8d4ccf867a1b77254c11b2cf982c473ae5ae79cd5a9f9c9fa2d90808606d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770462646, "uuid": "450dc0fa-0128-42eb-b991-be7d0e7a29ed", "comment": "Malware payload (Mirai)", "value": "58a2e81f25e5a281e709d49b50e60490c6c23e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770462646, "uuid": "f03446f7-eb0b-4d10-834d-29cc29791316", "comment": "Malware payload (Mirai)", "value": "72a6c201b8f4ee76f887a52d9265947783b53c2487ea7b81e8dd25791280ec047d1400301c77ff67c262450120411888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770462646, "uuid": "1a9314b9-08c9-463c-9496-a7da46d54acd", "value": "T12783288ABCC5C602C5F060B6FB1F518E376643A8E3E5B153CD19AB29674F8A70E37211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770462646, "uuid": "20d71aaa-5505-46a7-98e3-28289904207d", "value": "1536:DcMAxs7yxEUU5DDIy+Z4fiP3tTrKnznGUucr42d:DnAxmya/IyKP9TrKnznG0rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770462646, "uuid": "af9ee187-d475-48e3-aea4-f6174caca36e", "value": 83328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770462646, "uuid": "a4037243-9c4c-4bb7-bb8b-c34013f1bd3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770462646, "uuid": "d8ca6ec1-9e4c-4046-ba00-0d84cf6e8841", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d1d0d0-0424-11f1-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1770469088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "cda91d09-21fb-4202-9654-ba83c893c101", "comment": "Malware payload (OffLoader)", "value": "a6d22c8320b7673b6ff3196c419036ee", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "xuanwcai-com", "colour": "#F32363", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "d82e5f38-495e-45ed-b3bd-12f3b5245dc5", "comment": "Malware payload (OffLoader)", "value": "c0ac6d5c5779923f66a8eb49c7683bf6d6fa30c428aac13c94c51fac90855553", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "xuanwcai-com", "colour": "#F32363", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "bc656444-2486-4cb7-8899-b21f39efbab4", "comment": "Malware payload (OffLoader)", "value": "6f2545cc697d5347ebae9cf45f8ff91d06eebba2", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "xuanwcai-com", "colour": "#F32363", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469088, "uuid": "f674b3f2-d65e-4700-b43a-0d65a1c8bc92", "comment": "Malware payload (OffLoader)", "value": "6e1de94be3c1c192ce1b95f3185d23d38a65aa5f9ad254dc9655a373b71561ea07cf97896a3e93007c9403ff7df6fbb7", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false }, { "name": "xuanwcai-com", "colour": "#F32363", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "a0dee041-cc8a-4a68-8cb2-e74d42e1fcc2", "value": "T185360237F289A73EE06E5A3755F296204D3B6A21641A8C4296FC7C8CCF791601E7F247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "93cd409d-0051-42f9-b90a-4c064005116c", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "183ecb7d-1af8-4572-8643-71ef9623d429", "value": "98304:/N66ZRCCibx+ZEpYS4BtIdRC0LV6eJP5TPN2q8z2fCqsr0VZjngxhpU:HZRCCibxVYS40dbVRTUdyhVJgxbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469088, "uuid": "f0dae273-fd4e-48b6-abbb-46029b25a657", "value": 5131100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469088, "uuid": "f19e45ef-88f6-43b7-aedd-3950382cc023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469088, "uuid": "b73179b2-751f-4853-879b-021cfa2763e9", "value": "danma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a3274a-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466969, "uuid": "a3158f12-08f5-4634-b6aa-31fdc1bf232f", "comment": "Malware payload", "value": "05c29e9c272ca6c90b665e754a49ff68", "object_relation": "md5", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466969, "uuid": "ab4c3d8a-8dd1-4e48-92a8-8d01322da004", "comment": "Malware payload", "value": "c0dd8b38e6a3b84d2b6cb403f2d13334f1a42dc77d7e0be6ba17e81eeee3ca6b", "object_relation": "sha256", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466969, "uuid": "01d5c101-56d2-4b1c-9579-bda3b66635b0", "comment": "Malware payload", "value": "1a60f5b28f032cfe2401e4c9a1f7028a27649223", "object_relation": "sha1", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466969, "uuid": "2f1cf274-bac7-4fa6-a6f6-0b2da5bd75a1", "comment": "Malware payload", "value": "24c12f8af077dec716bf9e0d109b98d97bb50d3ed4ab83cff494a3c5081ecc49b336032fadaea8da361eca4913fef125", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-236-99", "colour": "#6485F0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466969, "uuid": "492d73f2-298a-4f71-9312-04f8578be14d", "value": "T102E6519AD6EA4C41EC68007BEC1D89E9B1145E8D121C8CE3EABD7FF9047254B7CA7D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466969, "uuid": "92e44429-f5d8-4641-8793-609fa3bbe215", "value": "17230a6be708ae125261e63d695d0266", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466969, "uuid": "18e63200-d214-44c3-af0b-5aed1b9b0603", "value": "98304:TkAMbNTWeaqNy1U8+fygZjNR+K5HhMuQf9WdbpCfkO2KRoFTHsjcsI5o:wXUeaqggZzEu0fvoFHHsIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466969, "uuid": "852345ef-f2f7-44a4-9735-f1c2accc6cb5", "value": 14661496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466969, "uuid": "c3ba59b7-cd36-493a-8d9e-17141d7023ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466969, "uuid": "6a36715c-3155-40a1-97a0-ea626ed98eaf", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0986f40e-03f8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770449927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449927, "uuid": "3b474502-0533-46cf-88d8-6291d5aa23cb", "comment": "Malware payload (Mirai)", "value": "c4fdd150970e5baab07e1f714d9995b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449927, "uuid": "d0d16799-8637-4b13-8098-4534b659b22d", "comment": "Malware payload (Mirai)", "value": "c1ef87553f8440092cfb4dc1985066c2b75b85dd5f9fbc60b491cfd84c45db49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449927, "uuid": "bc8565a5-6266-4303-b2de-7a84b6faa270", "comment": "Malware payload (Mirai)", "value": "029d89bc79807fe69fc57f71fefa39d6d88f5672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449927, "uuid": "73641e3b-ac73-4683-9a9d-b12358985b16", "comment": "Malware payload (Mirai)", "value": "1e3f76a63e76a1c64caa577b19e5e73c535b0a3ffa86fafb7648b5f55b21d55c963c4ae21d27588430ebbbf9e2442082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449927, "uuid": "aa44ccd4-c950-4ab7-bfaa-6f6e744d9b07", "value": "T18C054A4AFC849F66C6D0227AFA9F429CB3274BE5D7D671079D2816343BC791A4F3A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449927, "uuid": "18587439-2beb-43c0-a95f-69687ca4376d", "value": "24576:wPkIh0OJnxowkGbxZL9B6OolwJTacm9pgVclmlwpY:pIgchoQm9eVclm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770449927, "uuid": "340163fe-1441-4bac-b3b6-61c195a1eb31", "value": 837072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770449927, "uuid": "914fa5a9-9704-4068-b738-172ec15177f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449927, "uuid": "9691bc97-8a42-4542-96fe-a290d7664d0b", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf23066-0425-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770469258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469258, "uuid": "8e6550ea-05fa-46ad-ae9b-5bb199c08088", "comment": "Malware payload (ValleyRAT)", "value": "b53f0250516e69d94b40fbcdfa61fe97", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469258, "uuid": "aebd79fb-b83d-4d7a-9d7d-f4610514e4c4", "comment": "Malware payload (ValleyRAT)", "value": "c2be7df2200f75d7518e74021fa052a634caa34dd69d028e04b238358ab912da", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469258, "uuid": "2901a358-956f-40f1-9197-cc3d39ea9cd4", "comment": "Malware payload (ValleyRAT)", "value": "d84a6bac8b05d86ef2523e9dffc01c3e48d757b8", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469258, "uuid": "44bdaf9f-9f3d-4fd5-90cf-dcc0eedc9d9e", "comment": "Malware payload (ValleyRAT)", "value": "7530f6a665bb548f4fd8868737ea23d13cd93cdcbd389ef1f4cb4976699b39d05e1a8a07c74f41b30f46da89e2c1b268", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qaqchawu-com", "colour": "#98E9A4", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469258, "uuid": "bd5b58ba-c7af-4cfd-832e-b49047a52844", "value": "T131B6CE57ECA059E6C0AAE2318A6791537B317C441F2127E72BA0F3382F76BD06E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469258, "uuid": "897b0732-09be-4861-b80d-bdd659b9bd32", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469258, "uuid": "08aaa380-91d5-44d4-adec-d1a53051ab3b", "value": "196608:0cUNgyHOOKNxbqHwdGG53MlL+t8QF9wkjgIkPd3334:0cUmbOKnmQARM8QF9jfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469258, "uuid": "a965aeba-64c0-4ee3-95d5-77fb67721a1d", "value": 10784256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469258, "uuid": "3b41a539-b962-46be-8dc2-cffb0479397a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469258, "uuid": "60412f5b-8101-4e1e-90a7-640f926a0a8b", "value": "Qaqnsj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c6eeb4-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491363, "uuid": "9bd075a4-212b-4b9f-92cf-e95fceb09844", "comment": "Malware payload (Mirai)", "value": "175add50b77b5dcbd1c6b98ef4c3a969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491363, "uuid": "64c01e4d-7420-4260-806f-b3e4ad1b9960", "comment": "Malware payload (Mirai)", "value": "c36cfbb28049d249129c91e4fc63c4ad05bf15336a8c117850d724896f7ad463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491363, "uuid": "0d6c8da5-2eec-4190-bb97-688dd5df02de", "comment": "Malware payload (Mirai)", "value": "4af347a391e282897114e2f62c65f6571b600552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491363, "uuid": "f4caa578-5087-48c7-90f7-31a166474e7c", "comment": "Malware payload (Mirai)", "value": "f2561cd063fd0027d768847cb7c3097331eb8d4fd5cb26930e3e37d2b5072d0c7ef16d9ebc81d13c144f6c4fc33f2e17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491363, "uuid": "5b54d237-1e99-4633-9771-9b9c8d2a6b95", "value": "T13AF30945AD029F01D5C632FAFA5E428833577B7CD3EAB102DD105F6527CAA8B0FB6612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491363, "uuid": "58a80ffc-c0f3-481f-a30f-04bf1ed70592", "value": "3072:2UfnaFsoS0pNfVeOifsbr8d9ucmOa9FpS/YAznfxPtfDVIdL2:nyFLfVeu/8dQZOa9FpS/YAzfLf5IdL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491363, "uuid": "0cc01c92-10d5-4247-ab45-f7cb5179964f", "value": 157424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491363, "uuid": "08eadadd-0ec7-4fbe-8496-cdb0e831226f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491363, "uuid": "44fac479-6e78-43a7-a2dd-4cff059d8dfb", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648ed2ae-0426-11f1-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1770469836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469836, "uuid": "6377506a-78e0-436c-99fd-0c9d17359ddf", "comment": "Malware payload (ACRStealer)", "value": "7f25e6a466e22ec59a7012cbabdb38d4", "object_relation": "md5", "Tag": [ { "name": "212-34-155-34", "colour": "#A850B8", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469836, "uuid": "ca34e22a-ccee-4886-af90-65c31c5835cd", "comment": "Malware payload (ACRStealer)", "value": "c49abbd422e0db4210357254489abab7be42ada7b5448e87a98d6e5574f00673", "object_relation": "sha256", "Tag": [ { "name": "212-34-155-34", "colour": "#A850B8", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469836, "uuid": "5e425010-5e17-48b9-b9b5-99ea02b1fc20", "comment": "Malware payload (ACRStealer)", "value": "3da42520f556d6916e1ce6b10437ffbcc582155c", "object_relation": "sha1", "Tag": [ { "name": "212-34-155-34", "colour": "#A850B8", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770469836, "uuid": "ab740f0e-0afe-4429-9b08-9e6e487eb10f", "comment": "Malware payload (ACRStealer)", "value": "8a676e8a5b518d23cb3a534b0d6d19098b59a76f2335e3e9060ee7c1445175f1ac8ca5a88d4dda2937bb734048330dca", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-155-34", "colour": "#A850B8", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469836, "uuid": "b610a73a-39ce-410b-85a5-056177891c77", "value": "T149E5580399964765C0BC517889DB923857323C9CAE511F8B37CCB67538E35B0BEA27AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469836, "uuid": "be65a762-65a5-4a6c-a6a5-40ad1e4d1e51", "value": "b326f5c500e93929ca209ba0e5610331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469836, "uuid": "6e12810c-c666-466a-bc2f-e85596fdbe3d", "value": "49152:vB0FTSx6H1APrdudcpo42JKsDxi3EjDox9ToCQuxa7Enp8:Z0FHV+0g2HDE3EjErToZubp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770469836, "uuid": "25344a3b-3fca-4903-bbff-2be3b52ddb01", "value": 3139480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770469836, "uuid": "fa828055-8b3d-4b03-84a4-5af3f331927a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770469836, "uuid": "34035543-e2ea-47ef-b551-43a32a945a84", "value": "sunwukong.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f0910e-0462-11f1-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1770495469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495469, "uuid": "0337ce7e-83c2-4323-80b3-d0864c115d1d", "comment": "Malware payload (Adware.Generic)", "value": "8977253e0281b50e75f816115b0c6d52", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495469, "uuid": "e04fe7d2-7bae-4ec4-b120-75fc1ef9cfaf", "comment": "Malware payload (Adware.Generic)", "value": "c50d0de6fe12d36aba376cdb8d6e093f8b43e20b39f33b66f12bc1aa9f073285", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495469, "uuid": "3ddb23d7-449f-40e1-9b1e-fbffaa7035ed", "comment": "Malware payload (Adware.Generic)", "value": "a962c31c982b41f9501f95cabbf1c2bf20b0d2ff", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495469, "uuid": "df9e0e0a-e8cf-4a1d-8356-fdf52c2490a0", "comment": "Malware payload (Adware.Generic)", "value": "5c3867d550d9cea8934f6c6c48aa8d01f0867120317310151c31869a6b0cb5fd493e5505e6d5cd0410751e6393a04554", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495469, "uuid": "0cc0c059-29d2-4df3-a531-5521bb839d47", "value": "T15585CF3FF268A13EC5AA1B3245738310997BBB61681A8C1E47FC394DCF365601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495469, "uuid": "5ccb0c73-4ee6-4fed-a16d-7d749c412288", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495469, "uuid": "d83b74d6-e42c-4801-ba11-6995b008bc42", "value": "24576:37FUDowAyrTVE3U5F/uZ8AI05yEa3yV+O4nThEirYptUVcXHdZv:3BuZrEUbZ44ThCtUmXLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770495469, "uuid": "1d54482b-8b97-403d-a437-b9b1dc7ceef6", "value": 1807912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770495469, "uuid": "4ff104b3-7e9c-494f-926a-645a28eb1c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495469, "uuid": "de00478e-d7f2-4307-8e38-34ec50ecb43a", "value": "cloneapp-2.15.606-installer_R-UyPP1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce295b3-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500667, "uuid": "83dbaaa1-5ec7-4106-8f45-1c2711b68f75", "comment": "Malware payload (Mirai)", "value": "19cac5d9013df4bbce9af23498cca6f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500667, "uuid": "b8083193-7bae-4919-8061-f8d4ea46ab65", "comment": "Malware payload (Mirai)", "value": "c59f8237fbdd01c1a13b5fbc6ad5068eb6360c3ec4085555237bf72186544588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500667, "uuid": "37355c6e-78ab-4dc9-b794-52f9a1592ef5", "comment": "Malware payload (Mirai)", "value": "f1ce7ea47e68ca76a06ae47cc86e86e4ffb906b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500667, "uuid": "400b4996-7649-49da-b74d-ce61e45aa038", "comment": "Malware payload (Mirai)", "value": "f099bf2f3c2bb073d5e35d693c9a97ed077c67b4fbe2d006de53299a7de95c76f2959f278a5f940ce69877f016e3bd1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500667, "uuid": "3b0c412a-1a16-44cb-90d6-02e6ac7ab618", "value": "T1F8344B45FA418A13C4D117BAF9AF418A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500667, "uuid": "7c5aa742-c9c2-46f4-be8f-508ae8c11f35", "value": "6144:W8tTPAXOBzabKacEK1dAnJd7VLfdfM/9hWfAU:W8RA+BzabKacE62JTp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500667, "uuid": "186b68d8-48e9-4f96-8a85-c453d6ae2ada", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500667, "uuid": "bc338808-a9d2-4c67-9339-57f42b694f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500667, "uuid": "2e35aa0b-4ee6-4fff-9ab8-fee2f0c0ffae", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b27909-0462-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770495507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495507, "uuid": "adec1ace-0168-4658-80d3-7bf6a9bdf342", "comment": "Malware payload", "value": "1010274b735c241eadddf6baa01da60d", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495507, "uuid": "a7cf7532-e91b-4817-87ba-8dffe21f2445", "comment": "Malware payload", "value": "c6bc87c20d4012a8405d97548b0759fb1352ed8934b5bcda4b51e0feccd91657", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495507, "uuid": "67d5ac4b-1eaf-4409-aef6-b79682e029aa", "comment": "Malware payload", "value": "d5550f14181e6e78bc2c03df6bc9ff92bdd5b7b6", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770495507, "uuid": "e8d51983-4dd2-4c83-9c2c-757a871d93e8", "comment": "Malware payload", "value": "ae7455db3c518d8bbbb992aa49c8582f5bf38fdc4d3fdb8c5645c2b6377d4b3dd1d20c3040b7991e8a707099fd257edd", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495507, "uuid": "01596140-104f-46c6-af87-6df7ad00a8bd", "value": "T1930733E741805D4BCCE8043A7C7B1B724A64DE96F907CA138BB7B2355FD3B468C4A1A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495507, "uuid": "a52c1f61-3496-455d-975a-34fe59f4da2e", "value": "393216:xq6ExqaSXi1/uPTrBsiLGi/qmEUTDuwSSl6WohKRGq6Tjw:xqiy1GPHBzSvUvdS6zivU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770495507, "uuid": "bece4177-9350-4012-afa5-2530308d2c95", "value": 17352878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770495507, "uuid": "f59e97cf-5200-4b36-bbc6-5b8d10db8cff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770495507, "uuid": "cbc6d2bd-1cff-4a95-ab6a-304e286274ab", "value": "inurl view index shtml bedroom_t=kynty9rargcqvbncm6oiomd8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dd09bf-0407-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770456393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456393, "uuid": "54771d93-f379-4ece-90d7-15c88f8fef7a", "comment": "Malware payload", "value": "7727da391fb661d31687261719ae25aa", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456393, "uuid": "297f64c6-e116-459a-9a90-152913925b3a", "comment": "Malware payload", "value": "c783f5d67276c1d6d58cbff4e9e004270a3a23fc492cc7d20152d2ce3e472d40", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456393, "uuid": "a57afbcb-c9ed-4b42-9d99-04859605ef62", "comment": "Malware payload", "value": "219f350eca2d64420c503c466a72d2ea12c93afd", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456393, "uuid": "2687491e-b401-4b91-a102-89aead8529e7", "comment": "Malware payload", "value": "d2868610c7062c56792218590d7bf21bb0f0376553af026fcb38c6b121d8ffd990a4e74f916e2045774c478084bccfb2", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456393, "uuid": "ac292a0c-689f-4481-9a86-60300baff8e3", "value": "T1B355231471906A3BD0DFA0750BC78A71022EBE2CBC44A50B3756779B7A327F58EA716C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456393, "uuid": "7efe9343-8952-4c5d-848e-90a6d0bc81d0", "value": "24576:CyRstwz2JxW+AqNvcOuJolvTEdRru0PKaIFxUQv1QDYeOhhsgNfjfrBO8Cm2op:vRstwz2JxdAq5huDR57IQQduYrxw852o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456393, "uuid": "eaa9e82f-8813-4666-aeed-be2e857697ad", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456393, "uuid": "3cb13086-e4b7-403a-9ac3-15214e86940c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456393, "uuid": "15366201-4427-4db2-9138-a2b0df0e5e57", "value": "SecuriteInfo.com.Other.Malware-gen.28514174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f79f17-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500657, "uuid": "b927d6cb-1323-41c4-987c-75632aa40dc1", "comment": "Malware payload (Mirai)", "value": "05930f45e663633f66a3ec7fac554d61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500657, "uuid": "0c00d506-3df7-45a3-9c64-a895aabbe647", "comment": "Malware payload (Mirai)", "value": "c7ba5c58c1fecd81a472a5d7461c314fa3326c64a3cce240e7931bdc2e9c128c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500657, "uuid": "97a741a9-8352-4dbf-91dc-904d426933b1", "comment": "Malware payload (Mirai)", "value": "7459ae3665243d597491c226ac6445d3499fc4c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500657, "uuid": "e2fb7cfb-1184-46b6-b992-741443d12c73", "comment": "Malware payload (Mirai)", "value": "af53312a32100520783356a77ee5ff48027f66d6cc0832ca5ddb4ea11f4d177c288c2c3ee775bc6061c2411aa5447466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500657, "uuid": "fe4e3f79-bde9-41a7-87d4-9b702ce1b1c4", "value": "T13CC33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD0AF123E4AE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500657, "uuid": "8418fb05-3fbb-4d4c-a000-62f97e853841", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmBKGHzNzQSRN6Fpjygajc:jrguLRkHQo8SsGT74p1oB4n2pvalsBz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500657, "uuid": "0226758b-05ac-41f0-a9fc-7b8c4cfc65cc", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500657, "uuid": "45455b8b-7360-41bd-b8a0-1329b3acc02e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500657, "uuid": "dd8b9cd8-d8e2-426e-9d71-4d9fb390366e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0b590e-03fc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770451864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451864, "uuid": "ac4ece24-af20-4a6b-b125-220d1f643fc9", "comment": "Malware payload (Mirai)", "value": "0b6ed218495ac3572eafa7c332042f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451864, "uuid": "7dea60e6-9ce6-43d5-92a8-d5bea0baa326", "comment": "Malware payload (Mirai)", "value": "c95bc168cb36fcf5d4920bad48abe3d65a5ff22cbcecbc1b01409d8dfda42833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451864, "uuid": "80cb93ec-c7d3-4e7e-ab98-68e8226f2638", "comment": "Malware payload (Mirai)", "value": "045a42d127f52700a08bd7116b2a246b64f2c37e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770451864, "uuid": "741b4c9c-e6be-41ec-b686-10d2953f7055", "comment": "Malware payload (Mirai)", "value": "a0e4736b85f2ac2e35e205fd4d9fe3aeb849bad7574aa58487c23f69e716104734d363c150dbdbc0a2c829161294657b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451864, "uuid": "3d805540-f274-46f8-9ba2-5c6c614b837e", "value": "T13F031B42722C0E17D4B25AB4293E56D083FEBA9020F4F689655F5B9B8B35E3640C2FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451864, "uuid": "d6cdcf9c-00b9-4dd1-8904-80da4cec9a94", "value": "768:mNspAj5uSR1gRhWRInXJZTSZOSczF02qSBIqLp8m:Es2I+YZmuqSB5LWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770451864, "uuid": "d7082e09-1de5-413d-b254-29b2a3cc66a4", "value": 38084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770451864, "uuid": "c3f7d734-53b9-47f0-979e-63e151c98dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770451864, "uuid": "6ef5b965-12f2-47bd-87b4-107083af4e03", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b67ce29-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500664, "uuid": "569cf632-dfc9-4867-be11-7ea085168425", "comment": "Malware payload (Mirai)", "value": "dff4c411c1d9a3f6006c55f4d1431518", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500664, "uuid": "1bdfe390-04cd-4ffe-a4f5-151744242120", "comment": "Malware payload (Mirai)", "value": "c9e36574baef4a61603b766ce73a4430001161e14f89f5d618882225c3d96258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500664, "uuid": "6f29e332-640f-49df-847f-16f1f5c9501e", "comment": "Malware payload (Mirai)", "value": "e53b7940e0bff0dce12c191d49aeba1f4ba2bf69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500664, "uuid": "bef2aa9c-eb47-4be6-983f-1519946c85f1", "comment": "Malware payload (Mirai)", "value": "f55cd56bab566a55c90cb408612dd01aab56f9066c5795f72193e50c72ba82ee035fb18778127c74c382efcd57f3c9a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500664, "uuid": "ab3e955d-32b5-4deb-8217-6676915feb97", "value": "T1E4D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500664, "uuid": "9215f133-c250-434e-98eb-a1e49358ee21", "value": "3072:oWGIf1/UwfhJdU80r2tbYUaDGMsMA9TKRt:oWxN/UUDGibYUaiMsMApKRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500664, "uuid": "327e9e0c-695e-4e0e-a456-3516410974a9", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500664, "uuid": "650a54e1-0b4f-4587-b727-82be979e2883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500664, "uuid": "328140f5-bed6-4f6a-9596-63e86156ba79", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ba073b-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489078, "uuid": "ec87c644-0fe4-4327-af7e-6e62ae1c2df3", "comment": "Malware payload (Mirai)", "value": "72c1947eb8081ee2c7df1cb8bffc9769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489078, "uuid": "13275844-06ea-416f-a554-63bdb6c11bd0", "comment": "Malware payload (Mirai)", "value": "ca19356feab036261ae1ed8c21ee77c0a13e296c7201cc64a275595df3df85a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489078, "uuid": "574f48cb-18c0-4d27-8e50-8c862f4dace3", "comment": "Malware payload (Mirai)", "value": "3471827a4c4d1c5cc4c49093af17f4d788c22049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489078, "uuid": "70dd0c75-84a7-4c67-abb2-dc799da9e0ee", "comment": "Malware payload (Mirai)", "value": "9d11c533ef84bf5914d677a862dfed9f98ef5a1d928fca5d4aeb5a88819257f55efd2d472894d5c5f52f1af5a94c555c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489078, "uuid": "ffdeda85-6e59-44a5-b720-9681483e7d0d", "value": "T1F573017608FB90D0AC61AABDDD68C485EFC5543506FDE06326BB1AFC65C1417A4AB0C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489078, "uuid": "f437cc80-c95b-42e0-bd1b-e025c9ca21f5", "value": "1536:HWjRWJhcLTHr0j40ePDDdgH32WgKvSvgnvRi+3mZJ65HmGL0:2jQJeTIUcH3VTvQu8embCHDL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489078, "uuid": "04df1967-f101-4921-9966-481d79fd1751", "value": 74616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489078, "uuid": "d29fa628-fa45-4b6f-a100-b27dab231f00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489078, "uuid": "989611d5-3a2e-4bb8-8790-b88c041381e8", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eec5b8c-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473343, "uuid": "cf661ab0-63f0-408e-b46c-706c5639bb9f", "comment": "Malware payload (Mirai)", "value": "4a7880d9248df70f2d9834da4f934e3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473343, "uuid": "7b98f276-4cb0-4c15-8092-2ca15c77113e", "comment": "Malware payload (Mirai)", "value": "cb330547cff7c9174cd4107004034a6da89387e81d722dc82ac2010cab57db6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473343, "uuid": "d6c219e2-f672-4dfc-8585-d67d22764404", "comment": "Malware payload (Mirai)", "value": "aad857a4126d5ce6b0b5f381360af5e8987f3239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473343, "uuid": "e1ab60e4-17bd-4622-bada-9145538d30e0", "comment": "Malware payload (Mirai)", "value": "39ef2d929d2d17bb5e9e43de675e2f4bf25b4915d6524fe923aff3f55d7e70953f7996e4faeef817cec26e25fdc56faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473343, "uuid": "3e70ea50-3703-4ae9-b271-3dfc1e122a03", "value": "T115034C03A54144FDC58AC2B0AA7F9573DA31BC6E1238BA5E6BD07EA01E31E61371F744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473343, "uuid": "d0807a18-22c6-46c9-b192-e84faef32bd6", "value": "768:99HwWHuNBv36MDbFA7qsd/XZqyKdkg0YLHre1QsAH/Mk:99H7SxDb7iKu9YLHre1Qs+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473343, "uuid": "6c1e7ec4-eaf7-4625-986d-6e43d3fdf8f0", "value": 41344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473343, "uuid": "7c7ba43b-5506-4cdf-a4bf-419dc494117d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473343, "uuid": "d81b6810-5e37-4b84-a3f8-bd257d1805fc", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59541355-0424-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1770468958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468958, "uuid": "3833b84c-a73a-49a7-afd9-573d5fd94049", "comment": "Malware payload (ValleyRAT)", "value": "29d7e08ce21ee491e7b05642bea80b7c", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468958, "uuid": "58acc50a-c1c8-496d-90e6-99e4b9775d03", "comment": "Malware payload (ValleyRAT)", "value": "ccb99f61c3d72c3b99d4d0e8ea93d7e8561870bc095ab003315effd7d95dbf96", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468958, "uuid": "366923c9-6e0b-488f-aa7b-8b7dbeb01435", "comment": "Malware payload (ValleyRAT)", "value": "e4c8cd4f0e008ba2e6ca94c0fed6400a4c644768", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468958, "uuid": "c97f2159-bf52-46c1-8b2c-dac5f57d407f", "comment": "Malware payload (ValleyRAT)", "value": "f3d09882eee29b5673856d19a634aa604bca01e57e452136413eff6d9f73eba22554a58b6c46f5e509f5c027785becab", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468958, "uuid": "6580c12d-ed5a-4f7f-a5d8-21c6fdfb8caf", "value": "T165083321B16739A4D61FA3BFE0B85FC884307DE1B317E96B23787BB145B168261B1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468958, "uuid": "e9d4f827-445d-4e70-9deb-62f3ff4b5bc0", "value": "1572864:sl7SgYK7KnE9m9hBmdn5TSaxDZe3iEf3cT8uDESzccn8VeV05:sl7SNdE9mYHTSaxDY3jUEYb8Vi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468958, "uuid": "d40484c4-038c-458e-a848-2ff601624348", "value": 79570432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468958, "uuid": "2268b89f-641d-46e9-bfec-2ff026d7e7a5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468958, "uuid": "7bcf1328-43cf-4381-948b-20bbfe9848a7", "value": "chome_leate_win7-11_v1770446103.277629.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158630ce-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491178, "uuid": "e69b5bc9-b3e1-48d2-9436-4c67e00cf61a", "comment": "Malware payload (Mirai)", "value": "4a1130b35eff03e3a56cce38ee22379c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491178, "uuid": "66a0a502-06b8-4364-ac04-b269f3ab3ae7", "comment": "Malware payload (Mirai)", "value": "ccbcc412859772a53f7694f897570ec3bbda19cc1ca8a816c45c728b22c73b02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491178, "uuid": "7134e663-9671-4dfc-9dbf-0679a6f33ebb", "comment": "Malware payload (Mirai)", "value": "23ffc0262dbf59899ea208b2310194cf4bc5db69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491178, "uuid": "635325ee-0932-41f8-8354-d480cb517625", "comment": "Malware payload (Mirai)", "value": "e1dc6e79318f55ee528093b3e65ba7c73e81941d41c2fc96c41ae9a2f4c37daf081a4b1ca192adcecdb28d4c258931a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491178, "uuid": "69bb668a-4a06-45e3-8190-486c6a49da42", "value": "T1AEE32A46BEA05EEBC46ECD70062FC30721DCD98A92E5732E727CD94C7D6A30649D3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491178, "uuid": "0f2ff128-c6b3-40dc-8a99-ef3d05ae5528", "value": "1536:plv4Y2e2uuWJEbxBf2xaoPtZmi5u4AbWte48YC8azdXNVxzjboxrLoTCEvpmsyR1:rv4Yp2uCbjf23osaz9ljUxgRxmsWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491178, "uuid": "96a71596-fc11-4d87-9990-734a84c163ef", "value": 149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491178, "uuid": "e39f3d31-41ed-43dd-92ff-1c954f68f7b0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491178, "uuid": "e0bab648-a76e-4eae-936b-f312c3046ce7", "value": "catgirl.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4c5b21-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461687, "uuid": "0ee8c1de-db17-4c4b-a7bf-f9fd9eccdd3f", "comment": "Malware payload (Mirai)", "value": "b825719ce28cb5c98562b8d01d64c04d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461687, "uuid": "7288a4fe-107d-4d77-a980-a6f36177dea0", "comment": "Malware payload (Mirai)", "value": "cd03078fcde4aa64b1c968ebcf91de75b674e391c73d62e5a45d800fef9e8b83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461687, "uuid": "bccd3601-e055-464e-aa99-088891834266", "comment": "Malware payload (Mirai)", "value": "4689ab0c992425f4c174cd9f9221f8378ae9a416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461687, "uuid": "73be7975-d4da-4a1e-8d45-abaa7322a448", "comment": "Malware payload (Mirai)", "value": "63495bc2bb7d125345af1f8c94e2d95fc70ba28eed5bd95a4c198d3da2596b7587e116cda0f51ee4caf0d292eaff95cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461687, "uuid": "81b54930-8beb-46ea-bc7d-f6ebce6aed22", "value": "T17FA5336092D9095BB611EC0C72EE85F51F1CE199B0278FD0EB13882BBF2635D9C2E674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461687, "uuid": "3b2dfd47-6c2b-4dbb-bcb2-c29875677101", "value": "49152:P+vCj4fFz1mfKpm+N/hll4gAdoaykji4BWzeGgNBomw7etGmDoehaiJk:P26CV1mfKpm+FhzM1yH4BWgNBLSetIek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461687, "uuid": "b0939bcf-fdbe-4b5e-8e69-6db81469a351", "value": 2139876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461687, "uuid": "235c6ac2-f59b-4c73-8e5d-9b623190bf33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461687, "uuid": "441ea2a0-41b9-40f1-8e4b-462fe7097af0", "value": "ttmswapd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8e2003-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489073, "uuid": "77af3f0c-a613-44d4-bf1f-11ab45e08961", "comment": "Malware payload (Mirai)", "value": "c9f2f2143becc8529d22c366d7d1cdc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489073, "uuid": "8dbfa780-10ed-4090-a373-4b3373f2e188", "comment": "Malware payload (Mirai)", "value": "cdcfec3eb1f70b5b1ae61ee693adffbc1db37ae6531b2dd070e54258f14e497c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489073, "uuid": "4ff5db17-dfb8-44c4-943d-65f94b57d702", "comment": "Malware payload (Mirai)", "value": "f6f20cd3b6f091b4c80b0ca5cdaeb3c78ba935bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489073, "uuid": "f25be586-939e-4fdd-a76f-d379321622bc", "comment": "Malware payload (Mirai)", "value": "a56cc9d3bf5de31c6ec5cdd2100075aa8d9e743c64b9a1d48230a288edcbad1e3b0c3b0f67f05bafa7b959fd62478e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489073, "uuid": "ca884751-b3a0-4e5a-8d01-42a2d50e3c53", "value": "T16E7301CC162A828CF9FCC23A06F0A3A0162095D08519FB99743597DFE9DB2FE287B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489073, "uuid": "6bf89334-53a0-405f-a15b-aca57887c087", "value": "1536:OtQMA04AFFiyBA8/2IYfSXAexZEWXTeZmJmJnlrvywmVJui:OtQH0zFzBA5bfSXAMZEMqZmSnlmwmVQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489073, "uuid": "440cfcf1-4d6e-459f-9cbe-e0b73ce15e27", "value": 74892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489073, "uuid": "a53825ce-f42b-4c79-9ce9-1ae0cbdbcb67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489073, "uuid": "da84d4ba-9356-439d-a913-8968fa5cc16b", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33141876-044c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770486074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486074, "uuid": "6479351e-d9ff-44f8-b2da-aabea3091159", "comment": "Malware payload", "value": "45ffbeca43cf81289506ab57a9767fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486074, "uuid": "5dc49112-462d-43fd-b439-f330259dc9de", "comment": "Malware payload", "value": "cf64a6c51697a3c7efb517422eb4e32c9dac686eee5ce8209280c9d09c4aaced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486074, "uuid": "06e8670a-3fee-4447-a9ec-03c4309e2889", "comment": "Malware payload", "value": "986cf3f255d726e0c698080a19b22409cdfdd390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770486074, "uuid": "8d8bc9d5-0882-420e-b5ab-3f6f50c8d2d7", "comment": "Malware payload", "value": "3c16c8f13ae0c28ca828c8168f2bbaac05de3e3b0764c48cc2a3187b6bf7989f9a85df08a146e53fd81a836027065965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486074, "uuid": "fbd9aac1-ec4c-404e-a0e8-fcb08206b84c", "value": "T145E55943BD804666D4AAE2369CB162517730B8588B3633D33F53A6B81EF67CC5D3A358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486074, "uuid": "1e0f40c8-925b-4198-bb7d-8317f773238d", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486074, "uuid": "9ec67eb7-e2b8-444c-86da-2447c8f26817", "value": "49152:A31cNZPTs+9C+H4UxW4fhW9GUityTd4izZMVMsSaMbrZDxHK3rdzhMDSkK1gv9z2:WKo+954T4ZkvIo4ngayDxHKRNMDr9zfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770486074, "uuid": "c63843bb-f284-4459-9a61-9c0ede91c039", "value": 3040520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770486074, "uuid": "3cab3bf0-7492-416d-b77d-d6618f5a3531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770486074, "uuid": "82121726-502a-4213-80a3-2e7005be2090", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8179ba10-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491360, "uuid": "34467ece-ac57-45ed-8f8b-7f8339d70ef5", "comment": "Malware payload (Mirai)", "value": "54f48da32a8edfef2d3236c2c3b880f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491360, "uuid": "58743ccc-d1f0-4232-ac4a-b61c0397a8f2", "comment": "Malware payload (Mirai)", "value": "d07003bcff2b13c545a84dc919a3cee6755a47bb3b1ba2f123181ecd8d31c6b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491360, "uuid": "d703cc04-ef4c-451e-bffc-b284adf39067", "comment": "Malware payload (Mirai)", "value": "737ca6bb9c1aa247e4ff05c1d3aef3cb0b45dec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491360, "uuid": "843b641d-c5dc-4166-aef4-8614550d56a6", "comment": "Malware payload (Mirai)", "value": "619511ba2791d562e9b665c091000de356ef6a08317692a39d9bb520f97af2048d3b2a567e10c7d698dfeeb0cc50fa75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491360, "uuid": "cd9a8210-b7aa-43f2-a5f7-ad13afbda59d", "value": "T173040742BD419F13C5E222B7FBAE428D37156B69C1EB72079D21BF503B868DB0E36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491360, "uuid": "a63f4e05-8c85-4252-9004-5876596e48e0", "value": "3072:scIvthAZcEdZGFjwx+8bSexwp8itlWJRKS9Zno4k4y0me4JbuhiSj/0lH:scEXl89oV4y0n4JihX/0lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491360, "uuid": "d7f597cb-d52e-489a-a5e3-70e9bb93af6e", "value": 183796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491360, "uuid": "70508538-2564-4182-9c8d-806e9559d6df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491360, "uuid": "85e82a20-ac57-4e51-8d3d-7353508168d2", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a38dd00-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1770489173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489173, "uuid": "74d1696f-1354-4f11-bd74-a4bad498ba7a", "comment": "Malware payload (CobaltStrike)", "value": "b0d13fb92171a04210283bec65de1e19", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader.CS!dha", "colour": "#98A8FD", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489173, "uuid": "5d5069e3-2f34-4823-8ed9-eaf9c09b0923", "comment": "Malware payload (CobaltStrike)", "value": "d08e658268829d195f5c2621dfb2b99eb03f4caeacba67b462aa908416da49d1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader.CS!dha", "colour": "#98A8FD", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489173, "uuid": "8398b2f9-f786-4e42-b785-bbff8bfdce12", "comment": "Malware payload (CobaltStrike)", "value": "421c6ae3902f7363aa708e61cbf64257a26f4f10", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader.CS!dha", "colour": "#98A8FD", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489173, "uuid": "9658feaa-1736-429e-ae4a-fbeee36501fe", "comment": "Malware payload (CobaltStrike)", "value": "227eeb754a26003a8f5772264c076d8962add4b4d48514db3dc56b66737b7302eb6e0bc1be4940e7da2af74fe024e150", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/TurtleLoader.CS!dha", "colour": "#98A8FD", "exportable": true, "hide_tag": false }, { "name": "TurtleLoader", "colour": "#647BEB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489173, "uuid": "815f8d5a-be43-46a0-b8e3-aa7aca80efd9", "value": "T144322B46FA614CFAE6690239C57B451EE079FA036322A7CF23BC01262F613D271752CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489173, "uuid": "b5708f2a-d595-4b0c-ac8a-226835ac6396", "value": "94dfcb980c8d4ed2d51e1f4ceb72b39a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489173, "uuid": "0ffea46c-ec34-4cb0-9d0a-67ccad7cc537", "value": "192:vmzQNB2OtjCBvGWuNNp32zM3Q5tfl4+l:vSQNcGjCpE0M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489173, "uuid": "7ae6a998-ffe0-4518-8f76-906b089a7509", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489173, "uuid": "17ead8cc-2d96-4e45-8d0e-92022c6e0279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489173, "uuid": "e2a40fca-8875-4b81-87fd-70b82085feaf", "value": "apito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4844e863-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489116, "uuid": "18e1481c-b3d2-4f0c-ba48-29e8e0b6165c", "comment": "Malware payload (Mirai)", "value": "c05f11064dc59cb5810098a09b6aff6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489116, "uuid": "4ebf7dd8-f6ce-4df3-8a30-4d864ffa6421", "comment": "Malware payload (Mirai)", "value": "d20771a6b92c65cbb91a8f16d70bd73d7dfd91fc5a4616e3b031c17730c292fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489116, "uuid": "3c1835fb-ba37-401e-807c-0b7e1e3bbab9", "comment": "Malware payload (Mirai)", "value": "f4e89585a673bfb83ee3965f1b0e82de3b215946", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489116, "uuid": "8d8520a2-44d6-4c4a-aa41-fd88fce95c3f", "comment": "Malware payload (Mirai)", "value": "d7151b343aa18c278e8019979710e56273a129f715f725e99b3e42b09ea800fd9820e96634052c070fd783a194369f24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489116, "uuid": "c72f74cd-8527-43db-bfd9-4e3c7f35761f", "value": "T186043A85FCD19A12C6C622BFFB5E418D372663A8D2EE31039D265F21378759B0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489116, "uuid": "f4dbd64a-8ad1-4869-8f3d-e46cbecdbfc0", "value": "3072:LPGhybEelG1Kc9gjXg2qxdz53g4fIQZZnAO0Yw93:LPGwbhlGU8Qdqxltg4fI4ZABYw93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489116, "uuid": "49b4b792-e798-4ee5-9517-686ca9b0a56b", "value": 188640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489116, "uuid": "1713a7d8-21a9-4685-8f90-dd61f861bea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489116, "uuid": "ffc89be0-1225-446a-82b5-519b17581ed2", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071eb945-0452-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770488577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488577, "uuid": "d93097c2-d928-405c-92a6-bbb27a484f8f", "comment": "Malware payload", "value": "0d2a0e75118df43fb8edb403ac30ac0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488577, "uuid": "35b06e60-eb5b-4375-b828-85ab57cc536c", "comment": "Malware payload", "value": "d3426b7f47e10ce140f3ecd86ea05025906be4f762c02bb461047f776a8d5199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488577, "uuid": "f3a4f6af-2cc3-4be6-986e-04e2b0d5d569", "comment": "Malware payload", "value": "c276e2722bcd0e6d247424013a10793fc3e8041d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770488577, "uuid": "11a4b0a2-ca41-4503-a878-a251b4ed6ba2", "comment": "Malware payload", "value": "0e707694ea165265a1a3971e3550c25ad62ebd75b04db2aa2c3e217c27f88a9a3da7ea406c45211ff2231b843f71e219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488577, "uuid": "719b26ba-5044-48eb-8cae-985fce28b7d5", "value": "T10B66CFCAD16B40D6CC067FF598142BC39B3056324A34046836ABBE595F739FAC11EEB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488577, "uuid": "cd882f6d-f8dc-4d80-a1cf-0fc845cb881a", "value": "09bf3c2c0d1e1c721043f5ca267758f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488577, "uuid": "e4a354d1-19f6-4f57-98c9-e77ceb39fa8f", "value": "24576:YDAm1kjg+oZUjdzLkLBzINHLhpb4yO0ak/+E+oAMdKp8fgiQyQmPskpVZpVgTGsP:YDAqcFNwo9qn45Ze31Oxjo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770488577, "uuid": "9a76f34a-5221-4f95-8b5a-fc1625407f1d", "value": 6875136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770488577, "uuid": "796d0105-9d0e-4d54-958f-309b7bec447b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770488577, "uuid": "602f98b3-1b0f-40b9-b102-49de986d420a", "value": "d3426b7f47e10ce140f3ecd86ea05025906be4f762c02bb461047f776a8d5199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da9c692-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500668, "uuid": "4787d463-1ebc-4d42-a542-d745baf77dd5", "comment": "Malware payload (Mirai)", "value": "d3effef22e64ca95c56b02322bae4a4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500668, "uuid": "2b90c070-4044-495d-a913-2ea7ee7d52fd", "comment": "Malware payload (Mirai)", "value": "d35419e4673a9973c3f930e4cbefa218805ffaa2d72419c6641926a52fd3801d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500668, "uuid": "7290c318-30f8-42f6-a8fb-2a754f4522c1", "comment": "Malware payload (Mirai)", "value": "970abb6ff6fcb3bd9c95d0e9937d485bc83732d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500668, "uuid": "d77f2800-fa18-4689-a29d-340aafdf7716", "comment": "Malware payload (Mirai)", "value": "1b6be2e5672db05b7dc4e5a161d3e4d95c9241dfcb36e6d77770f8e1339587e5fe7acdb02b8b5d09359646bcf474c0e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500668, "uuid": "33ce7993-7276-4fff-be2a-6fe2f48bf37f", "value": "T117E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2577C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500668, "uuid": "b8957dc3-98c3-428e-a74b-4ed6eab45645", "value": "3072:CotWnBLigk1Tc3bCC0DvZe1k6aU6zL6EiueCo2kq:VWnligqTcLCCqeS6axIueckq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500668, "uuid": "d7a2e6fc-77b8-469c-a192-1e3ead9a6835", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500668, "uuid": "69d4b052-01ac-445b-b2ac-cd5378ac6fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500668, "uuid": "b93e77f7-f122-4c3a-ae72-5d1271514cde", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4917f63d-044b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770485682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485682, "uuid": "af15402b-7d9c-4d5a-9d93-998349dbf45b", "comment": "Malware payload", "value": "153a09fb627132939c91910c31abfdb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485682, "uuid": "78a6cbea-38e0-4b97-ac57-381775bd0b45", "comment": "Malware payload", "value": "d39fa8e2d179e2d0c8a51994d07f45bcd49157edb5b711b2505615b978642a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485682, "uuid": "a633cd11-c387-4cd6-8542-c1f1c8cc55c1", "comment": "Malware payload", "value": "dee740e16b085d15c6e7e0a76b50056c781adef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770485682, "uuid": "13bc0f8a-45eb-423e-b467-289906ec67ed", "comment": "Malware payload", "value": "8dd3bac61cfe9b4f5f8be757ed1c9f2023e707072669ae58e95c0db982cd7f5d6b3906258f80e2c213f78555eb31260a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485682, "uuid": "8fe77225-a30a-458f-b3d8-7324308c2e48", "value": "T12E28E01663E112AAD577D138C79BA603EB72B40713309BDF329C03652F63AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485682, "uuid": "ac9324dc-2a08-4af3-ae12-41612559e063", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485682, "uuid": "1590f7dc-405d-4594-a73b-072f9bb9dafc", "value": "1572864:5VDG5MiP2aVxUXXsT9wda+8XuVJBOg51EKIDudNaFxH:5VDG5NVycyzZBOg51Eodal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770485682, "uuid": "ab33ffd3-e63e-4f96-afa5-5dcb35a99287", "value": 95692758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770485682, "uuid": "d18bbbac-ba7d-494a-949c-b9e337a88667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770485682, "uuid": "42db22fd-a2f3-4307-aec7-9e1cd26497b0", "value": "CarServiceTogether.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6749fa15-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466834, "uuid": "70eefc1b-dff0-46bc-8414-590aeca1ce73", "comment": "Malware payload", "value": "97d0c432f0d77a72ff064a04e356e073", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466834, "uuid": "a77822f5-a7a5-48b3-b7a6-8be1583c8883", "comment": "Malware payload", "value": "d3ad1e1d4d66deacf0563bc48d85d0e792ba586b87b551a6bc25e54b4776f25a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466834, "uuid": "4e4ba8af-275f-4e0f-960e-045dc21e625d", "comment": "Malware payload", "value": "7cb6f3e5760184953a23eca37827ba75de5b6631", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466834, "uuid": "6a5fe694-2fa8-4620-8727-5ed9952d1e9f", "comment": "Malware payload", "value": "c26cbc19222a6a7100002cfd278829c738c9ddf3a4596a74e90c66656f225ccf3787aa37bb8f4f7a098565859776eb13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466834, "uuid": "9dde37ba-ff71-4ed3-852b-065a9b323628", "value": "T1B8567D30B5B68469ECED00F1A2BB59775A6D1D04773484D3E8947C943CB01E2A3FAEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466834, "uuid": "60907c49-83e0-44a4-8446-136aa5eae084", "value": "41c32693477d1b5435c0e09bb2654b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466834, "uuid": "7eaf8471-eca4-41d7-b437-1ee573519cc7", "value": "98304:5n+Y6vybTDhTSSTSaQz+fAWBfVrc5r4HeMeGq6Q+0ZQ2zU:5nevuhTSSIc+Yeo0ZQ2zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466834, "uuid": "8888db30-137e-4040-92a6-574001f90a11", "value": 6153048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466834, "uuid": "614c1483-5dc6-4192-a481-de95bde3091f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466834, "uuid": "cd16e1fd-a872-4121-9046-8cdaa27c1de2", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c51c27-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491177, "uuid": "17ee6b88-1c17-4ba9-868a-6566a513d88e", "comment": "Malware payload (Mirai)", "value": "67cce5c64baa8b8b6408750378dea2da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491177, "uuid": "700c3a15-a0c7-4436-8ca8-84886ae9652d", "comment": "Malware payload (Mirai)", "value": "d756448ef43b8640911a7171bc2c1864646289ab7cd8eb541cd0b6f61fc44591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491177, "uuid": "bb216732-087b-47b9-a358-37eea1840979", "comment": "Malware payload (Mirai)", "value": "58e8d12fafa93e62d3d349bead40da338e6b69f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491177, "uuid": "a1005d12-178b-4768-827f-190a5641b40f", "comment": "Malware payload (Mirai)", "value": "59b2b00a01197b2d85a0b3fd2ecfd9f051ff1fccd555e0cfb1324e9de1bd54af4cbcb566523dd398e76be2c7f38d762a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491177, "uuid": "3455696f-7d91-4be8-afa2-6d75787f55fa", "value": "T13DA35A48FB83D0F9F29344F2026BE7AB56308D149016EBE5FB0E3635BCB1716494A66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491177, "uuid": "c296b588-d725-4db6-af46-fb4abbb71f54", "value": "1536:MkpX3ickOw+cmDkCyzLg9Q39YWdSNaZ32noOO+LKCaFOBigLS8VorTWGQ:MkUbIaRngh6SNaQoELNaYcgQTNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491177, "uuid": "7a9f10be-2d58-42b8-a7b8-46751c7c23ab", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491177, "uuid": "bc8427ce-b83d-4a38-9e0c-cc2fefcb2720", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491177, "uuid": "c5344528-f032-4c56-a2b1-095ea8b0d3ed", "value": "catgirl.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcebce3-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489072, "uuid": "4f9a6613-6cd6-4cb0-a801-72a936018d2e", "comment": "Malware payload (Mirai)", "value": "152ecfb3e78bebe7c1597589a9fc32e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489072, "uuid": "af25d481-17dd-4ec9-860d-156249526e61", "comment": "Malware payload (Mirai)", "value": "d7b37561d7784af4d512b32bf345a7e3c3586edf4775516193244f8a1152f386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489072, "uuid": "664f1848-7833-43cb-8407-66a8222c38d7", "comment": "Malware payload (Mirai)", "value": "fa499a49508e60e09fd078757d6076bfe5d0e002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489072, "uuid": "7cf3159f-e4c5-42dc-914f-351fc4803d66", "comment": "Malware payload (Mirai)", "value": "eed4667015ea805eac4dffb4a81dbf3634fc55a4ec530bfe90257d9563ca413c1a1cfdaf600297238301d92abc706a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489072, "uuid": "8338e008-ab7c-43d9-9b40-d8f6a3586f2c", "value": "T18DF38D22C861AE98C1258479F561FF395B539A5242831FFE2AA7C7718047DCCFE063B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489072, "uuid": "903157bf-3200-4510-bf51-64d2165ce930", "value": "3072:6GqIhZ+ajobEqnee0PIe/ZHQ3haoltM7eUr/ONpLWcyGZZoxi:6GqGRhNZHuao7r7ac9mxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489072, "uuid": "1e6a0869-151c-4a31-b54e-e39ebb802907", "value": 167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489072, "uuid": "97134ed9-cd6b-472a-909b-11347a8f035d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489072, "uuid": "e0760fc3-5c3e-4084-8ead-3581b042c7d4", "value": "executor.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1882b7e5-0407-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770456394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456394, "uuid": "4010604e-c7f6-46c6-93aa-bb6d20f611bc", "comment": "Malware payload", "value": "5dcbed1fae79d50bd94d6d9c7e692f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456394, "uuid": "27177924-a227-4769-b35d-ff095a7b90f4", "comment": "Malware payload", "value": "d890c39dc1644a16f99142a73766db35676b386d6319c6b0f82e8c88ea821a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456394, "uuid": "c15ba64f-8e59-472f-b80f-27db84f1bc48", "comment": "Malware payload", "value": "6d9f5f9b48b5995283330e19611f57103174bb81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770456394, "uuid": "0937cb74-5729-422c-b8b0-629b4babf52f", "comment": "Malware payload", "value": "5411e188e9b11708a1f206a95475c69696126ee9c4174e47b19738144f798a218838517bf0babcc4a3ced8467c253358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456394, "uuid": "6a090883-e1e5-41d8-a2e0-2b345f024e20", "value": "T1ECD2F712E6D8A974F26B46B31C338B6C66F6FC3006809E6F687C7E1D0E3558258B1B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456394, "uuid": "62694400-5ae5-4daa-8005-2ccd4f18b15e", "value": "3b8905cddce46446726dcbe11887f83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456394, "uuid": "42d85a8b-3157-45f8-b338-bf6f52eefd99", "value": "384:/Thf9gflG91T01ZFmDeIDFx57KnrfUOi:/NilkV84DeKFx57Yr5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770456394, "uuid": "a8113241-3b69-44bd-b220-a8ecf7531614", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770456394, "uuid": "a5080ec6-c547-45af-9b91-6f719d9af04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770456394, "uuid": "b1b2826f-005f-4051-a4be-03331d201b42", "value": "SecuriteInfo.com.Win32.MalwareX-gen.78385468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a1050f-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491184, "uuid": "74423b73-3aa6-4082-b55a-42340725ef8e", "comment": "Malware payload (Mirai)", "value": "a4eee1dfc8251c933027febab4a54693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491184, "uuid": "a1dfc985-ec85-4c07-9f05-7ca3a1b07664", "comment": "Malware payload (Mirai)", "value": "d9aba1fe886987326fe5533d887d22d399217e1b1b38542ebfd7ca0eea84b3d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491184, "uuid": "0ed1614f-836b-407c-9ebe-e0e12527b167", "comment": "Malware payload (Mirai)", "value": "eb6e085d15b127cb01e1d23fb74d3db4c7d56b07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491184, "uuid": "530deee2-5555-436e-b072-6a1bd6cc01dd", "comment": "Malware payload (Mirai)", "value": "c437aaf41ec3b8aed6fe9853db91e7c5306c7373cb071740cd8f433e10e45134eae1aef8c32276c6d3d98221615a89c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491184, "uuid": "4d42f19e-9447-41d7-ab6e-726048f2d347", "value": "T1D7A38D6CBA0E7C41D2D7D3BDAD4A8BA171273DD0C752C2B2BD01A30DD4E6AD4CAA1917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491184, "uuid": "fc872061-7104-4780-b1bb-81a9630494e0", "value": "1536:6+435H//JHtbmhDvLD4+TEqHeNdGZZVS2qrz4xJnPorcEZCz5sQoWATKaualIrRj:D435VtbmFT3HeNdKZgeJPdNsQSTKfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491184, "uuid": "b923c9eb-dffb-43d9-8afe-96158c4c5960", "value": 104144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491184, "uuid": "9715a893-b5ab-4c0c-abd1-a204c578bde6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491184, "uuid": "b0d67c9a-efc2-400c-8c54-85e8f41471f6", "value": "catgirl.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600f98d9-0450-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770487868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487868, "uuid": "719f126b-3c45-4012-8eb9-84ddab3adaae", "comment": "Malware payload", "value": "0a9e35d3c75cae4f72b63ffb62fd51c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487868, "uuid": "94b5591f-c218-4f4c-a4f3-a2ffcbfa1a37", "comment": "Malware payload", "value": "dbbbbfa676fa3d6209120249a7afc5db757bd7362c9ff7c6dd6d0e5f61a34835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487868, "uuid": "54e642d8-54d3-402a-b32b-f3af29d22ccf", "comment": "Malware payload", "value": "afac7515d2ac6349ec97b10889a2ae2f24a7f3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487868, "uuid": "08748e7e-1e50-4671-b077-aeed4db21f52", "comment": "Malware payload", "value": "0d6b88882333600a5d901f226d9bdedd57678fc5af5957f991b3f3a47a6503f3e534cb9993afb5c936882ad08a6f5a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487868, "uuid": "b3b7f039-e23f-4b73-bbea-255aa354771e", "value": "T1B1A5F134C259CCCBF25945F168A1574238537A63D33A5AFB5264F3ADDA061C00AEBB3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487868, "uuid": "bff7d256-505d-46cb-8985-6917c4eca691", "value": "8a4ce3087bdf40c7b66139698159e2bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487868, "uuid": "82e6d7ef-908b-4aac-b6b9-0eeb65f26cdd", "value": "24576:Yrp7wQLGW4UQLLeLHejoeuMV+mNKB/iL:YrpwQCRUQLLsHkLuqNKgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770487868, "uuid": "40d62c32-26cc-4361-9adb-8834fd530c00", "value": 2228736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770487868, "uuid": "5fd3a368-afd2-4dc8-a05e-931b522208bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487868, "uuid": "b810c7a5-ac85-4547-8066-2b60c741bab8", "value": "up_boot_xw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e43a94e-041d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770465907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465907, "uuid": "05e74370-ade6-4dd7-a0e2-908545b34e26", "comment": "Malware payload (Mirai)", "value": "d6da1a42b9f8587ee3bcf9e0e2163994", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465907, "uuid": "4ccdefb0-3c65-488c-8148-74e869deb7bc", "comment": "Malware payload (Mirai)", "value": "dbee43cda2d0e1c020f69f99770593d0c81a0968dbe57edc51fd7239cbdd77a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465907, "uuid": "f527a1ca-c1f3-4f6c-8c3d-5aed49bae52e", "comment": "Malware payload (Mirai)", "value": "937844bbab102645a7156a40d0ee69d0dc986ad6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770465907, "uuid": "7d68cc85-68af-4b30-8eff-859bb7e69979", "comment": "Malware payload (Mirai)", "value": "945c7cdefa29e14d104d86a91c1dd9e59379bab16862af762a441f20253641b9368ee2b87ba4abce038dac211a313136", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770465907, "uuid": "af7f757b-b62f-469b-b0bd-3769f6602458", "value": "T1B3716DA6CA0311781C995766ADBA11EAF045F3E234E7FB0FB5982CF8628DF015885DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770465907, "uuid": "7f42ee0c-322a-47ea-80b5-b0444538c1bf", "value": "96:iP3d30x3q3E3IB3uE3J323V3I3S3O3z3+wz:QNEx60YBf5mF4i+jOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770465907, "uuid": "ec029088-7b81-434f-a27d-21b50250c9ea", "value": 3754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770465907, "uuid": "9881bd1d-d26e-41a2-b946-879c00986b88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770465907, "uuid": "f3878b44-8033-4f8e-a281-91e2c30bb695", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0744fd-0428-11f1-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1770470600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470600, "uuid": "2fccdf21-af21-45dd-b1a4-396b735c8970", "comment": "Malware payload (EternalRocks)", "value": "1a3781468d8dd15372a96e6005d0558c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470600, "uuid": "43a1179c-5bad-485f-a68a-4a2d83330a93", "comment": "Malware payload (EternalRocks)", "value": "dcc692af7198136d36361885a54743d762a86ef8cc785c09d6d93ac2b21f9744", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470600, "uuid": "d21de58c-9751-4126-a82a-c00fe40d9773", "comment": "Malware payload (EternalRocks)", "value": "fe3038e6ab3795fad75788fb65ef85f29cfe79f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770470600, "uuid": "994ac9d6-6b6c-43bb-906c-0a43d7eb8004", "comment": "Malware payload (EternalRocks)", "value": "14f491782f5a9b4c906af271aff8e5112e8e2a5b87398988c5e9b0e91cd31c1e7f0f2709eec77f9a8e164418ced83cd4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470600, "uuid": "bdf2d829-a6ba-47e1-8547-6230c17ced25", "value": "T1FF956C117F1748A612CB4EEEC5BBB134DD2090CE620AA4F872EDB25A75D8E7D4389D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470600, "uuid": "38661d5d-5e63-4518-9584-54196bbbc7fa", "value": "12288:d34RUNwz8KHHXBLwWNiCeBUCDprmwKOH1RN/XNr4WoxmeSVattF6zQw9PttfbgNn:2RUNwBHHXeW/QmwTHBX5AJttFUVAVIox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770470600, "uuid": "ecef7f3c-92d4-4572-be4f-abea084fd106", "value": 2046611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770470600, "uuid": "948584f7-49c6-4460-8dde-6afada633494", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770470600, "uuid": "7aa883f1-7ac5-49e7-aa41-952c365aba5f", "value": "panfish.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08655c7-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437376, "uuid": "8663587e-55a5-43b7-acbe-995dbae69537", "comment": "Malware payload (Mirai)", "value": "6a28bfa54e79538a8d57cf99e6150b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437376, "uuid": "83aa89e7-c155-497f-b0e4-db1358827e7a", "comment": "Malware payload (Mirai)", "value": "dcd4c4bd88c396ef60fc9ebd58b4d69e8dbf84d353a69276618453d6cb1acbaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437376, "uuid": "4208c71d-4bdd-4d3e-bad5-40fb5f6dff1f", "comment": "Malware payload (Mirai)", "value": "eea57140b6cc7790d234567d1eb2ac4caeade659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437376, "uuid": "e90fd62d-752e-408a-8c5d-d12d04ffe844", "comment": "Malware payload (Mirai)", "value": "096cece63956d74461d90755dea884f7aae7f7d8d4e8aff2d6ab25c82c7ac47fb69e86f7cf3c6614c0a8bf0ba0add6b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437376, "uuid": "a9228cf8-e96e-409b-aa9b-31d9d9f713fe", "value": "T17EA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437376, "uuid": "49e4cfcd-d576-43fc-956d-95aa6b5158ca", "value": "1536:7aufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAx:VbU2RC4kPCtSzWu3/3L1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437376, "uuid": "a2b2ada1-0c9b-43da-9fac-30257b3d6d75", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437376, "uuid": "6a8590fa-5fc8-442c-8c31-a114f84cd0b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437376, "uuid": "46327cc6-33fc-4f70-a6bc-47461b3dad65", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ac405-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1770473342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473342, "uuid": "fe8147ab-9f3d-457c-a829-5d8c0bebcb09", "comment": "Malware payload (Gafgyt)", "value": "1ab8b2f1e715cde576c25721cfa81175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473342, "uuid": "667013e9-aeda-41e8-a4ef-a7ac6437e49a", "comment": "Malware payload (Gafgyt)", "value": "dd098a43466e55a25292357ec41e6445c0abfbc710ee8e9575d371b16f5fcb94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473342, "uuid": "88bb5834-681f-42d3-af30-2a2b4371dfb1", "comment": "Malware payload (Gafgyt)", "value": "4cf4a3318c58e653cdb01dde662dcb87faac946f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473342, "uuid": "61711ccb-c260-4ed6-a549-2923bc0a1d27", "comment": "Malware payload (Gafgyt)", "value": "15dc051e37b3e3d5aa4b9eff997f1f1ac5b5a358aeadb5a72dcd2704ef1b435f751ca776f751b23b801c43f4f16611a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473342, "uuid": "6ac0c1eb-6526-4b90-972f-e6d8fded00ad", "value": "T19C137A32F5602E61CC20567AE461C9B983415DE261D62C7ADEEEF05C01BBE4EF9CD7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473342, "uuid": "c17f873c-48ef-4c8a-9876-63de7d875953", "value": "768:P59W3e1VaOspugJYpDjtQJA3XHVZ0uQNUGLa3rJz:PW3vug6pVQK3XHvJlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473342, "uuid": "b54a0241-6fca-4e65-af3a-769d0d1462a9", "value": 42772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473342, "uuid": "f4bf1bf4-c3d5-4c1a-9f1d-35bf551e8d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473342, "uuid": "cce789fd-5457-48c4-9dbb-1ecc94516d89", "value": "bot.superh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797d116a-03f7-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770449685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449685, "uuid": "60efd7a2-8436-474b-b2eb-c6962cdfa700", "comment": "Malware payload (Mirai)", "value": "a754713932997c3916882e9fb12b934d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449685, "uuid": "3a17cacb-4e37-4e28-abf7-d51ceb1e7ed7", "comment": "Malware payload (Mirai)", "value": "dd3ac0556430d5afb1577479870bfbd8740fa37543dfaec0164a6591c7038934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449685, "uuid": "432ae2b7-412b-4f48-878c-f95e79b79870", "comment": "Malware payload (Mirai)", "value": "9adaf1daa24d4a52eee2e1c35f983c7391de26a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449685, "uuid": "c2982c7c-7960-4dd6-b4da-06168c20585f", "comment": "Malware payload (Mirai)", "value": "2113954025f4d631c6be0f479ff46c56b4ff39b4b58ae37ec96812b47ca5eb1a8385ac4a0746017c74aeb913e9a70534", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449685, "uuid": "e313f8c0-93da-4936-b736-c157c97eae23", "value": "T1CA043B6AFF16C93EC246D3704EFB81BC5334B0B41720A70B3A65666D2D25AE4CE07B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449685, "uuid": "fef0923e-13f5-4f18-bf0c-58957966c413", "value": "1536:MGucDexPjdzkm2USOA14r0n7jrJlvwUD3xJ6olnlQ6ZlITax8s3F9ooZJit+gCcj:O3PjqmdSGEP02lu4Zbbzrkv2bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770449685, "uuid": "cfaadc98-275d-4478-8f05-d9c0d26d753d", "value": 180584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770449685, "uuid": "813e5006-dd6c-4b9a-86af-675763411aa3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449685, "uuid": "d1105ec8-df1b-44a1-a4e6-cc1213037dee", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b464a89c-0479-11f1-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1770505618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505618, "uuid": "4535b16c-debf-4948-9635-71f856a4c0eb", "comment": "Malware payload (njrat)", "value": "55c85c7b390cfdf0f82cdec0c8bebcd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505618, "uuid": "4fe9347e-5cfa-4e17-a56a-1d642e47a8a4", "comment": "Malware payload (njrat)", "value": "de4a52117da22ace7c927b2355a20af7091fb0461828daff9fd1eae90df7adde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505618, "uuid": "42e2f222-c656-45f4-8ad6-66619f0b4462", "comment": "Malware payload (njrat)", "value": "32f3d17eb6a783b836021492e1718905fecfb641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770505618, "uuid": "3edca5c5-42e1-4700-bda1-7570879ba75e", "comment": "Malware payload (njrat)", "value": "599bd757efa967ed60b2d0a51039e52c5e84b10af10daaf6e0e128822503e7b7c1dc0e1a347d2014ae0a3e761f07c59c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "PulsarRAT", "colour": "#E36295", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505618, "uuid": "175706b7-26ce-498c-801c-38c7853655e4", "value": "T10325CF9077F4850BE1FF1B75E4B149494BB7F8569A36DB8F0998A06D1EB3B408E103A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505618, "uuid": "397fa004-baad-48c5-9270-510fead0ae57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505618, "uuid": "c30b9081-ba17-498d-9ca6-53de9adcd94f", "value": "24576:0F/pLxJzck+uGW/yFoBkkAQ2HejktDEWcrY:0F/pLTYjqqanT2HBEWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770505618, "uuid": "2adb3101-1293-460c-a331-b7c302c50d6d", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770505618, "uuid": "97240126-a5f2-482b-8537-22b02e862902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770505618, "uuid": "cae38e33-321a-448f-bcf8-3a44e231e12d", "value": "Flow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a15500-044f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770487637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487637, "uuid": "40425ae7-18d3-4a44-b2aa-a8551c706d3a", "comment": "Malware payload", "value": "72e51db8f13ab86cdea38c7fb166c35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487637, "uuid": "371c4cba-f29b-4e7d-98d9-601edc021fd2", "comment": "Malware payload", "value": "df1169c7cc4088b88acef6a0b69c4faeda9afdba1d05f7cc9dbc526db619e4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487637, "uuid": "d495c473-d629-4a3c-9522-af57e02566eb", "comment": "Malware payload", "value": "6c545f00fba89fd4d72ec5304080a3a757d08bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487637, "uuid": "8d4ef9c5-e458-4e79-ab23-c48e61e91b4e", "comment": "Malware payload", "value": "71f27c1838acdc41d3de077059b66249d238972dd0d4eb7c38993b143eb0dac71d3fae9ce76ff3bc697d198f73bf46b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487637, "uuid": "605ae507-c1d6-45e3-ada6-26cb3c5a4948", "value": "T18EB55B43BD881670D5AAF2368E7062513630B8588B3637D77B91B6B91E733CC5E36398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487637, "uuid": "e1a603c8-ce10-43d3-b1be-b14f03ee6a03", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487637, "uuid": "95a295eb-f1f9-4339-9192-5c3923cf5611", "value": "49152:uyDrAWj8Bm78piidaL/Rq4eyKnIr9yxjcS9zTqIiZgKHXK1MD:Bb2m78Qi0NqqKIRyGS9zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770487637, "uuid": "37843ac7-67cb-46e1-8d0f-2a4d182af361", "value": 2376704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770487637, "uuid": "28e153a7-a9cd-4333-ae23-479e5e46e628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487637, "uuid": "f513d0b1-9e78-4aa7-936d-b4cfa81e754c", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8c778c-041e-11f1-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1770466598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466598, "uuid": "1dd273f8-dea7-40fe-babb-2f62b39dcd76", "comment": "Malware payload (PureLogsStealer)", "value": "af4ff2dd41ea5bdcb6db44dba35f1319", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466598, "uuid": "7f1be34b-5c44-4c9c-ac51-1d5f40cbb764", "comment": "Malware payload (PureLogsStealer)", "value": "e051fd042368a3dbdda8ba75ff1730eb828577b0295e82e90c19ca2a1f44051c", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466598, "uuid": "86e5d2b3-9599-49ea-ad81-759391a26224", "comment": "Malware payload (PureLogsStealer)", "value": "a712df1469709d1b98e46207dee75b3e9e3401ad", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466598, "uuid": "48fa1ba7-7889-4ffa-8db8-7f5a44956911", "comment": "Malware payload (PureLogsStealer)", "value": "7f4fe3feb43b5f3913c12c9d8207a68697ee89f46efd41ce06787bb76a4cfe0c753924e0886c9190b79b7438cd3ca577", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466598, "uuid": "9cb9ef74-b156-4e4c-8383-99c926dcfaf0", "value": "T13E0733215A16E19ACDB609BA23E2D170564294027C049B4C3FDE31FE87EB472BFCE95D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466598, "uuid": "1f272097-0049-4f30-a061-a7fc9954ee0f", "value": "393216:ypkfrOsCZ2bxlAc3qE7E/QpV9sVm1JHMp+/6ZdNrR8bwF/:ypCrZMBc6E7E/kV9sVMJspMAR8bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466598, "uuid": "9a379b9e-7717-4c2d-bd2d-faaa48d12fb6", "value": 17631232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466598, "uuid": "c84f6d74-305d-48c5-abaa-06631be683c4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466598, "uuid": "36632fc4-7867-4a60-8036-60275611e88f", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bafd92-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461674, "uuid": "6c43f513-ce70-417a-9a5d-56357448a632", "comment": "Malware payload (Mirai)", "value": "0a33cba4bc30eb976ee49a36255e18e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461674, "uuid": "d9fb7873-72d8-40c7-ad63-ecf8c0e4a471", "comment": "Malware payload (Mirai)", "value": "e0780cd7c40793806c7f8b5d7e3b32e9da89bae9af7ecb28e021f324c3f0ceda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461674, "uuid": "a51bf2fd-cdcc-42d3-ae93-cf12f52bab01", "comment": "Malware payload (Mirai)", "value": "8d399abdaaeaca8e8ac44282c1ff83a04a909b24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461674, "uuid": "c3471b3e-cb00-49ca-9467-623f9ad191ce", "comment": "Malware payload (Mirai)", "value": "e0fddb5567305bc4c3af2e3d4abd0fb85a16c3fb873d9f8936cf7b5c46c4265fa38ab37588aa74dcea40de86b9af8054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461674, "uuid": "c39514b8-df27-4d84-b91f-09b816905118", "value": "T17BA533713B27A135263C2731D969F4D6C0FA5A31A3C411B3505664F322E3BAA4B9BEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461674, "uuid": "c3364ea5-5fc8-4544-a33e-de28d319931e", "value": "49152:HjviV/dJaLU1XogGLR7htffKRO8/+4jRTltdOlmO0eXlpgwyGS:DvSYU4R7h1iw54j9ltwlCeXnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461674, "uuid": "ff45d200-7f67-4769-89e7-089ed424ca76", "value": 2094468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461674, "uuid": "87ecbc40-8d59-436c-a973-398f5292e690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461674, "uuid": "56558bca-6651-4c6c-b88e-a71182fb882a", "value": "ksnapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a12cbd-03de-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770438825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438825, "uuid": "007040ae-2615-48f9-b153-a0f93d9fd05a", "comment": "Malware payload (Mirai)", "value": "8f11700a9452b3510ac1a85e7f85c5a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438825, "uuid": "4e7525d7-baad-459c-a2d7-b58b59f963fb", "comment": "Malware payload (Mirai)", "value": "e0c8c3d199b65a68ff138d9bebce6eaddee18972db2817bb32542101c40baa34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438825, "uuid": "20777ede-563a-4d4d-934b-133792c3b7d5", "comment": "Malware payload (Mirai)", "value": "299a7f637c29504532d475d2006f9c11c7c4845c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770438825, "uuid": "0f53096f-e2ca-41e3-b74e-4463c283bd5b", "comment": "Malware payload (Mirai)", "value": "9886a20471853fa839d5d4ea67c2c9261f276c9735afa4e3ab9064b5fe8bfd30f43b31f33e357bb09af033ef988caec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438825, "uuid": "c95d8acd-3bca-405f-b391-2c711ee17f8c", "value": "T101D39D31D86969D4C0904534B8F4DEB617A2A4C4415B1EBB3AD4C5BD0087EB8FA1EFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438825, "uuid": "d97b40c9-5ca2-491c-92b7-70699fb3171a", "value": "1536:vaecp35XeVxmg8wtD2gPUVr5ZX7HX5x0KuSRxXL8nYj1T+DxK35RK3k/J0a8pOs5:vCRZ00w2+EH7Hpx8YjMY3wk/ad16ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770438825, "uuid": "c8589327-017f-4547-b0cf-e9ee83eb6630", "value": 132620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770438825, "uuid": "3d60121a-1b07-4d0e-a840-3cf9ce41c425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770438825, "uuid": "232092ce-073c-45fd-b202-10d3a6f77e54", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0a3c52-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491324, "uuid": "350d4a1a-ad0d-41af-9e8f-1678f84091bd", "comment": "Malware payload (Mirai)", "value": "2a1ed8f41681ee7244a27563cc94c96c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491324, "uuid": "1a6ed31e-875b-45b4-87cb-b2c593b973c3", "comment": "Malware payload (Mirai)", "value": "e33c374022736ffd062776b005e1d9666e73c580dc0c3b26921c9ac75e7b7207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491324, "uuid": "3425b608-cfde-407f-a182-4446ce985910", "comment": "Malware payload (Mirai)", "value": "9d68c6352fb59eb5445f8691bb30106b912e4c6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491324, "uuid": "6b37d266-74f5-4336-8dc8-ae6af4aff6fb", "comment": "Malware payload (Mirai)", "value": "73dc8edbb6c96ce57d99bb65512b47c671f7fd9b0095852a8528084fa7c4fba2d370978e6cdb3398c81b7a611d6b45bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491324, "uuid": "7070adc5-bf3e-40f7-871c-5f574af12ab3", "value": "T12653027499A9C8798701863EC9A4C694FF85897CD1FF84B88B594FF8C19B41FA6B0086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491324, "uuid": "59b7d27f-f51d-4c53-a7d2-87ce061b3426", "value": "1536:INuaGN6rWAuQaxTuMJxuayjnFk3QYzgz3ttwC:INC6rWAybxuaEnFkFzgTPwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491324, "uuid": "90fe8f2e-89ab-483d-8cdc-ebacf6b3cb06", "value": 65376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491324, "uuid": "6cabc0db-85c9-4545-b86e-dd43a703ecfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491324, "uuid": "08dbef9c-fdb8-45d3-b44f-1ab312f2cbb7", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4462336d-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489110, "uuid": "9f97118e-df83-48c3-8c63-8dc7d09c24e3", "comment": "Malware payload (Mirai)", "value": "de1cedab97c1ea705bfd91baeb1f353c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489110, "uuid": "abd5ddd7-54b8-47dd-884d-f0184d3e6331", "comment": "Malware payload (Mirai)", "value": "e40d7bdba03732e954fe294395236f6842f983bd2fe2e738c0306f74b40da921", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489110, "uuid": "c17909ff-b15e-40e8-ab3e-a2c7253f94fb", "comment": "Malware payload (Mirai)", "value": "c109fd149d53ec8daa4d97d85a9d944ea1f1dcf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489110, "uuid": "6a1b8611-a620-40f3-a879-cde32cfd7b86", "comment": "Malware payload (Mirai)", "value": "2b8b1da0894bc94ef5f8a12d96c1f843e96b8f2aa7f0484db8f46601e9c97c892ffb5ddb1473185f7ee58d891c714308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489110, "uuid": "69005608-435e-4d98-a28e-38510df1e461", "value": "T1BD34F70AAFA10EFBE8AFCD3705E91B0524CC541722A97F367274D518F54B68B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489110, "uuid": "c87d06a8-b398-401e-afe4-32ba3aa0847a", "value": "3072:xyzgjfEb/NNNNNNNlCTidBdi4hP/RGCBkEqklJF+mn72LN6ijrjSmhgKGA:xyzcEbSTidBdBhP/RGCNtln+mqTrRgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489110, "uuid": "b84d1c74-e818-4bea-96c2-b20f995d83b7", "value": 247716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489110, "uuid": "e91639c5-43a4-40d8-97fb-1f640278be64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489110, "uuid": "95f8078a-f303-4783-97b1-9a2b28809ee5", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b323479-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "1612ff1a-856d-4d4d-8330-9d4ca4532fb3", "comment": "Malware payload (Mirai)", "value": "ee80f903d531113536d4f46a1c4d73f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "8212ea5b-973f-4cf7-98f0-9c3621642f3f", "comment": "Malware payload (Mirai)", "value": "e5aece94322ddec976b52b8cf08948bad332c1df96f599806049ab4f28c38ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "9b32e5d4-2278-4afe-b8e7-e0b7228deebc", "comment": "Malware payload (Mirai)", "value": "8f2d7e1410717cc72f1b5b32bd6e00364ccc9e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489094, "uuid": "3a74fc74-44a6-4673-9c31-8e58f8d393b9", "comment": "Malware payload (Mirai)", "value": "af712536c47f6bf6c8765c5a1b3117ffa2f952328a6a97164002ffae9509d32830928a35b0674aee3c2dca8615c3a0d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "da17ead9-1703-47aa-af5b-35ea5d877526", "value": "T1E7342A46AA814A13C4D627BEF69F424933339764D3EB730699296FB0378779E0F23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "36eb4419-59b5-43bd-8870-0151c1a1d335", "value": "6144:ZneqealYGYIrFA6baidcOoIuwf8hhks60cHM/RJH0:ZeqelGbA6baidcOoIxkMAcs/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489094, "uuid": "638aa1c5-09cb-4741-a4d0-87a875a77887", "value": 246392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489094, "uuid": "e0fbe42d-cf7b-4ed9-8d4f-1f641c18c92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489094, "uuid": "d5ddaa97-4395-4c26-8d16-61be185724f2", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa54661-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489066, "uuid": "e5122889-273d-4c8b-95e8-56298e8034fe", "comment": "Malware payload (Mirai)", "value": "cd084d3c0754422276104fbaf1721d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489066, "uuid": "4d3de178-8570-4bbb-8a15-b282e0eb54eb", "comment": "Malware payload (Mirai)", "value": "e6173ca1ccdadbc9e1836f23e2b084f1860ea5539d17abea2ff19717a08e39b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489066, "uuid": "b26e3663-9e3d-4bee-b533-80c17aee0927", "comment": "Malware payload (Mirai)", "value": "33512a2ae05d2939fda47f2ce901b0e67e43abc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489066, "uuid": "488864c9-f014-45c4-bae5-5ec37c33b0d4", "comment": "Malware payload (Mirai)", "value": "06db8eb90317fb5233e2b29dca6672869bd1aec1720e00a6c54cfef2c370547e650bd418c43c1ba4e512e5641bcf0e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489066, "uuid": "cf0181a3-3d29-46a2-975e-d9d516e9d4b6", "value": "T19E43024785EAEFBEB276027108E8381F4C01581E0B9944ACFAE035BD43967699E74FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489066, "uuid": "28b574a0-8e4e-48ee-8fe1-aa1450ff7a79", "value": "1536:sOdN1chQCHWGI5ZDlX3V1f3gre9zSJPr/WI1dPTs7MAn+nouy8HyY:siN1QmDlHV1fNzSJPr/ndPg7M2eoutv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489066, "uuid": "6101c2ab-e36a-4636-8bc0-5d55ac9507b8", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489066, "uuid": "541f4ac4-fb04-4340-8f5b-a9e8a51ed94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489066, "uuid": "3e8ed211-205d-4075-94b9-fcba751907c8", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ff98c7-040f-11f1-a129-42010a9c0007", "comment": "Malware payload (Koadic)", "timestamp": 1770459928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459928, "uuid": "58be40f0-3121-41e4-b9e6-036cf24ff41b", "comment": "Malware payload (Koadic)", "value": "ccd7c9da6bc9914fcd89d63ea06d0c38", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459928, "uuid": "3a22fdc0-ba74-46de-a167-d95f2407e873", "comment": "Malware payload (Koadic)", "value": "e69007a9004cb14a621b44be45ce6b30ce68dc1a40243a4e06c29e1b0be7a7a4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459928, "uuid": "b38c32e1-1a8a-4c6f-90a8-a307f30fc044", "comment": "Malware payload (Koadic)", "value": "3356991e6fe8dbb821ea29f9f3f67079302679d0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770459928, "uuid": "756ce8db-bf4d-4b94-af7f-532c94cb2475", "comment": "Malware payload (Koadic)", "value": "7a023cfc6529e84270994ff9a3cb75dfabffdade73503a5c2a37335cdb1a3aef964186f201fd54e646fb6c88e0244d5c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459928, "uuid": "cbcec6c9-494a-4ceb-b707-ca6de00956ac", "value": "T1ABE623644EBDAB2D3308C59CD297939F208BF47DA27CE18FD89BF6A31D872169452530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459928, "uuid": "3d41865d-b6d1-40b0-80d3-23a047f8b233", "value": "393216:G99iBtmYxR2HkPMTFoLVES1Wq4F6rIeU3/Kn:NBtmIIHkLEfqh0X/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770459928, "uuid": "0520df46-0518-46e0-a438-82f59d57b495", "value": 14021160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770459928, "uuid": "606f01af-1cb4-484c-ae10-7aa5d856dbe6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770459928, "uuid": "3b75bb50-9490-40ed-aa54-2b928b38955a", "value": "PPZTuAsEUYpajFq.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcdbd50-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466735, "uuid": "230dba8e-e4c7-496e-982f-561090b95a93", "comment": "Malware payload (Mirai)", "value": "c05586060481e42791acd43edf02be0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466735, "uuid": "84f53f7c-da28-40fe-8f85-51c9985f8399", "comment": "Malware payload (Mirai)", "value": "e72392fa25638b5e1ff720e99cbcfc997cf3457db33cbafbb6978b0d56f89492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466735, "uuid": "f93d95d8-359d-4c7a-9ee7-7306a86f4138", "comment": "Malware payload (Mirai)", "value": "17d071559a51f7b997e53f85d2067ccaa0ea55e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466735, "uuid": "addef6fc-6d9c-4145-a989-07ceaf6f71c9", "comment": "Malware payload (Mirai)", "value": "9ab90668b3b5a3f5a9229c4a22ac14f462df2dcafc430dd5bf261bcf4d2e27f7f3541465e35927a4babbda6a2da33f55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466735, "uuid": "85e44fec-3c1f-44a2-9b76-2a5197eaddb3", "value": "T149255B5AF2B370BCC567C030439FDBA2A839F47A11122E7B21C496353D66EA01B59F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466735, "uuid": "f8ceda19-e5a5-4946-9be4-4d161b03da9a", "value": "12288:M/Zfjsdub6CKlRQAusD6vod1zJ+qJbDoGdsB+418k8yyWsE05+YvfmCKM8Z8p8:MpwdbRQAusD6vozzrDoMsB+4CYYvuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466735, "uuid": "0b5628ed-001b-45fb-a368-1ea2ae980ad6", "value": 1032336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466735, "uuid": "8c7fc9ec-9bfe-4047-9c68-fd79f241ba95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466735, "uuid": "85d3dce9-db9a-4399-8b10-e70f05cb45b2", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cce8bc8-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437262, "uuid": "fac5e8af-6028-483b-bb67-e5ac2824172b", "comment": "Malware payload (Mirai)", "value": "23f0aaad66436bb574c943af5569ba0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437262, "uuid": "8eb23bbb-721d-42b6-a072-9a71b8eec322", "comment": "Malware payload (Mirai)", "value": "e75b5cdd7dd8c9e41a0d56edd6a0ec02e090d815f36a59abb386f32843f20387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437262, "uuid": "cb2899e9-047a-4b6d-ae2f-0e43a9545a07", "comment": "Malware payload (Mirai)", "value": "ddd214bde9e12bc5948f9a60128efc21240a8a04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437262, "uuid": "9cf1c0d6-41f7-4861-ba84-b7fbe0e0dae4", "comment": "Malware payload (Mirai)", "value": "d1776cbf3685f661b06009e788e79e093e225bdea110e35bc754440eaa5f92b5eb6799989350356aa4901df9160790fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437262, "uuid": "87b3779d-4259-449b-b756-1652f67c46a6", "value": "T10AE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437262, "uuid": "60864d85-5a14-4fba-abf9-266daa875ffd", "value": "1536:p+eTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxfdbK:pdlybKpzEOfGQ+vEubTt4ouftL4TdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437262, "uuid": "6687f161-1d28-4580-8631-62908cef303e", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437262, "uuid": "f08c7adf-b509-4624-a13d-e8b879057483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437262, "uuid": "f090a6e1-648b-431c-8bfd-0d3cc2cc95e1", "value": "israel.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f20099b-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489101, "uuid": "c6c808de-7e50-4e84-a5ce-80b67a472ab6", "comment": "Malware payload (Mirai)", "value": "433a303395e71c34f5cac172c139d2c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489101, "uuid": "8c9ff247-882f-404e-bba2-4afc666309bf", "comment": "Malware payload (Mirai)", "value": "e800659bf5f1347f9ec28bf2b0ed3151b746b003047df1190d1d6fdb20a5c646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489101, "uuid": "0038592f-71eb-48ea-aac5-0270a503d4a9", "comment": "Malware payload (Mirai)", "value": "804516a6a7c306f5ee3e9c77235ab0946b2dc62f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489101, "uuid": "91e5d14b-86b0-47e3-8191-19f79d6612a8", "comment": "Malware payload (Mirai)", "value": "c793fb78a7d3bb3e88e6cf9690fff28710a13683e00c216ef51a6d1d11e1b6f21b6d5918e9439cd5d11a020c94f91670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489101, "uuid": "935e039f-8867-4ff8-bf5b-07e870f75ddb", "value": "T14FE36AD5E78FD0FAE84241352076B7265AB7EC3A123DDA43C7B88A3298939D0C51676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489101, "uuid": "030b5726-1a4c-4415-aeb5-567492f773ab", "value": "3072:C+rEOui1ze7Frpr5aBHWqwDCz4Z3a4J0BPDYKmB/:C+oOT1ze7XhZKHBDYKmB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489101, "uuid": "b7ddd0e1-0bc9-457e-ade4-c3a3f0110b34", "value": 151820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489101, "uuid": "4d35a050-0bb8-415a-b5b9-2ddce34862a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489101, "uuid": "e0893d3a-13bc-43e0-8283-ff78d73240d8", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9957cba9-03f2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770447591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447591, "uuid": "20f246b8-f3ad-4d15-9b87-e74d1173be55", "comment": "Malware payload (Mirai)", "value": "8000e621e1b03fa7665edd75f2703afd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447591, "uuid": "9de55e64-384c-4cf9-94af-e1a703f76ec3", "comment": "Malware payload (Mirai)", "value": "e86fddf92f8786f242311aa96280ef8dd9afc29af13426f318096b5f30158e51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447591, "uuid": "4c9efa7f-49f5-4d83-804b-74244e76d465", "comment": "Malware payload (Mirai)", "value": "f5af4ab54b2839207f54f8ebabe8ad8b5934daab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770447591, "uuid": "c706d3eb-caa4-442a-ac02-6f5ddadbfa99", "comment": "Malware payload (Mirai)", "value": "a49f71b4b794aaf7f1c60eeb0bf9e76b217c6a0e273d4d722db292b9ce47bb3b0085cae7870193f7f8ee236f5b536ef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770447591, "uuid": "6e117e0d-ffaa-45c6-a7c6-03f2296fab9b", "value": "T151330981B8818E25C5D413BAFA2D018D331367A8E3DFB2129D116F24778697B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770447591, "uuid": "54a7dcb8-5f7d-4b91-af5d-4b643e003694", "value": "1536:UZnttHHhcJOEZBPpKGlJMY5OPhITiiKK9vT8:UHWJpLp9LKK9vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770447591, "uuid": "b51bb3a0-98ed-4f4e-9b21-5ebc6411ec4e", "value": 51992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770447591, "uuid": "4e064410-9190-4a2b-aa3c-d1f746ecec44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770447591, "uuid": "edf6e52e-166e-4b12-99e4-1e34744b68a1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1671f654-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491180, "uuid": "c1e23d34-f36d-4b30-b3ee-af0640d5940b", "comment": "Malware payload (Mirai)", "value": "07a86d85650f94df78e8deeba6cd1e80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491180, "uuid": "37486f7c-fcf3-4adc-bc81-b3782fa7fd0b", "comment": "Malware payload (Mirai)", "value": "e8b17e27303094c954bac12062a327c757ba930b3d55c0135fb9a14e9f5f77e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491180, "uuid": "d0a91318-a0c8-4d81-8b06-400ea7888d69", "comment": "Malware payload (Mirai)", "value": "ab57c7b4128a37b2ae0caab18e05cf853049e507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491180, "uuid": "0e9a887e-0b0d-48af-8586-5a1539e4cccb", "comment": "Malware payload (Mirai)", "value": "88e9d75b036a3c35f9645f84003fbc2a92cf169db3fa0a21e2c3bebf3a5e1df7645fffef85820eed34b7622a4f4fff58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491180, "uuid": "60157e7b-e1d2-4042-980b-3f2972694594", "value": "T1163486292A22DF7FF66C82344BB38930579936D626E0D645F26CD34C1E3125E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491180, "uuid": "74198b23-e947-4254-b253-4fffe0c61277", "value": "3072:700b3b4Cm6HWPKDjtMoG+rbT/C1LPuOMqenQEDZG1h/:IWrY62PKHtw+rqBP3VqDkv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491180, "uuid": "e567f2a5-3adb-457d-96e1-0af98e9593ec", "value": 250588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491180, "uuid": "cd898c88-b5cf-494a-83d3-6d7bdbc4436e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491180, "uuid": "d771fcd9-58df-428c-9a8b-3deda7d91e2b", "value": "catgirl.mipsrl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d9f505-0464-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770496580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496580, "uuid": "cbc5b75c-5d54-468d-8db8-1a8288feb404", "comment": "Malware payload", "value": "892e2a7a42b86503ae3863a137b9b638", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496580, "uuid": "63ad47e1-58b1-4b5e-9437-f71123139afd", "comment": "Malware payload", "value": "e8c81c91c32feabf7b2fb8f1a04e160ff0e24b558af5ea2ab56cbc7818be6651", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496580, "uuid": "077b9242-46c4-4b65-89ec-60d9f28ee7f2", "comment": "Malware payload", "value": "0fbde291b2e3f339084f70b90f2dac035f82f48d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770496580, "uuid": "559fb021-1a65-43c0-8033-dc544c28f69c", "comment": "Malware payload", "value": "8aafaf7088290964f2377fda46c7815334ea199b9e86aa71d894e9e002b79ae68281c275b539a8db0dd81e2aaae521be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496580, "uuid": "228adba8-41ef-4b78-a222-1b0a9be08b78", "value": "T12225F1C059D6163D5E9CB476210A0F3FEAC2FD6D04983644AFA0F985DEEB708D26CE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496580, "uuid": "a6cba7b8-bf29-4bad-91d9-89968818d1d1", "value": "12288:Kk1Woc+cTsOp+mfpW4S4K7g4SQIAYAKDyyzN/rjB6GqHtWHdHoMl789Ol:p1WLKspWK+tKDhzN//cGqHw9IMR5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770496580, "uuid": "50d0a9f4-7347-4aeb-ae8f-0c347257f42e", "value": 964073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770496580, "uuid": "6574d2c9-f712-4668-89a4-36583093e412", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770496580, "uuid": "63f0260d-cb34-493a-a78c-20dce8a7d36f", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c23be17-046e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770500665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500665, "uuid": "2a9de046-f257-4fac-8fc4-a29cdb917b93", "comment": "Malware payload (Mirai)", "value": "acfc76e81974ecf360a54a1f397ce26c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500665, "uuid": "f2574054-1a95-4054-94ac-0faf3ea39235", "comment": "Malware payload (Mirai)", "value": "eade6b7f8090eee9d51b04e065e4784cb1460d774d214d5583d18a1e064a0be7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500665, "uuid": "e3b9c0b0-9075-4896-83e1-c7b9da9c6c1b", "comment": "Malware payload (Mirai)", "value": "bda643a0788a41f0eefcb65d439500fc38d77295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770500665, "uuid": "5e710c85-c213-4555-b920-24bfc318c804", "comment": "Malware payload (Mirai)", "value": "4234b1916c22df31a543c537c9b30d8a1eae5d35ef98e8b579b904e818eab1b18c1e5990b92849d3782530ddb1995e3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500665, "uuid": "3eedb817-5c34-4bbd-9d7d-558203fd6aff", "value": "T1E4D33A2275791E2BC4E0A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500665, "uuid": "af1eefa7-cc27-4455-9c47-48763b7fc2a6", "value": "3072:nZUlV+Fawd99IVWFjKc7RgysOFe30Hi09lshKwXh:ZUH+FD99IVWFt0OgEmhPXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770500665, "uuid": "a1e98212-2300-4e0e-a183-9d8c297b59fb", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770500665, "uuid": "267444b0-ee0a-4b7a-8034-d04346b60b66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770500665, "uuid": "63a065fc-59d2-4a9a-b9a0-f1f78f912888", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19577029-0458-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770491185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491185, "uuid": "40b1074b-b1e9-4410-ac73-4b52eb5fc0c8", "comment": "Malware payload (Mirai)", "value": "10cfa58e4c41340483f03311c26355a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491185, "uuid": "be2b924f-985b-4b0e-b05a-2bdaedf37f66", "comment": "Malware payload (Mirai)", "value": "ebdd79ea6d99bacd88500f20a327885d1eb24a4e19b9d0289d6e9ef1db434490", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491185, "uuid": "2ba14e93-8b7d-4942-9edf-2dd823292ed2", "comment": "Malware payload (Mirai)", "value": "66fbc012a698371ffefec974cf965392c9ce5c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770491185, "uuid": "aa446a5b-1bc3-41cf-b9c6-c1fef7665df7", "comment": "Malware payload (Mirai)", "value": "84bee3fce3690993b7fc865392e484ac497adadfd3e57f08c16853d2eb89fde93c8f85f45fe97dc7699bae650ad7a6d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491185, "uuid": "afc39563-1080-41ea-a66a-c0e56e99b430", "value": "T111931806B5A290FEC19AC574869FD667EA31BC5512107A7E7780BB343E33F312B0D662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491185, "uuid": "8635de05-a0b8-4077-9b32-537299bf1352", "value": "1536:JoCz2Q45eEygBRiJ7a+f8fpiFAP6Xu4+O/kqkL9iOCor5b1/:SmdOe5gBgN8QFru4cIa5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770491185, "uuid": "be7e8f07-e6b4-45dc-94cd-b001471b4141", "value": 92120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770491185, "uuid": "ec82359d-7849-4751-9943-6caf98822b45", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770491185, "uuid": "d1700a79-7a8b-459f-bd81-ed60943a4bbf", "value": "catgirl.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9083dbce-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468192, "uuid": "ed1101fe-5584-49e0-8505-e9e2bc000c95", "comment": "Malware payload (Mirai)", "value": "82f34b10dc0878d60d323cae3e6116dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468192, "uuid": "e3f96474-9ea3-46c4-b573-7d51e97d4eb2", "comment": "Malware payload (Mirai)", "value": "ec73eec47a94cbb303241d74edc43112aefc83a9bb5d848c9fb442fc7d0142d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468192, "uuid": "5a8e32ab-4173-4aba-81cb-17fe31300d3c", "comment": "Malware payload (Mirai)", "value": "5b0dc86023bee427643d190e178595b27216234d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468192, "uuid": "78d28697-9597-4d42-a340-5e1cde2823d5", "comment": "Malware payload (Mirai)", "value": "0353625a26682f7e3bda05b5074437b326a9efc3b1f9fe50b9d00697b13c61358c7489b857a4eac3d73259af106167cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468192, "uuid": "7d5a3729-38b9-442f-853c-ca989eab277f", "value": "T1BD835BD6B400DD7CF40ADABA4063050AF531A3514ED30B37A367FD9BAD721A85A2BEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468192, "uuid": "067d6b8b-3abb-457d-b9d7-0b3d16b1aa58", "value": "1536:iyi73c9MIP47KUAtoaa9NFx5aGG8/+7yJjv7ot8syS9iPSM9eFXXn01u2bUuiR24:R7M3uO19Nf1G8/AcDosfSOep6bUNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468192, "uuid": "e3d74fc8-59a4-4851-afdf-b296dceaba7f", "value": 87564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468192, "uuid": "1f5e64f8-2444-494b-be4d-acdde379214d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468192, "uuid": "ca396530-7d93-406f-bb03-b850301b125c", "value": "binary.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8874479-041f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466971, "uuid": "7ee331f1-d614-44f6-9e62-e3645eeca948", "comment": "Malware payload (Mirai)", "value": "d8bcda69f3c88f6b06c6f89ac1be47fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466971, "uuid": "e17ca9ca-bd46-4f33-aa54-17dc04e45361", "comment": "Malware payload (Mirai)", "value": "ecef2e89076196da21aba676e47258e38726a44f10cc1b654713a5f23ba64797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466971, "uuid": "f1b1621b-eda4-489c-808f-7c61b30112fa", "comment": "Malware payload (Mirai)", "value": "836926f5d5ac72da9694acf3e64ad9a8464bbff3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466971, "uuid": "736a87a3-f6a1-47c3-b3e8-994f841de0a7", "comment": "Malware payload (Mirai)", "value": "d79d53f718fa741ad2483dfceda0393784d43ac3281162b4499a72eefd566bcc26264723a087e146946228f5bdf75412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466971, "uuid": "6629a8b3-c1dd-46b3-bf54-749530352ef1", "value": "T1BC332902967C1A2BC4E0A7B711B74372E1EB2B954194E68FBD660C4FEF543501ABB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466971, "uuid": "a7a433f2-56bd-4274-9e35-8e55dfddde68", "value": "1536:6QdRL0t6F3jnUGrn7drTQggQsztJhdqB+:lRlUSKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466971, "uuid": "a46c8b27-07cd-44ec-a685-7c7149e555cf", "value": 53724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466971, "uuid": "27fd9a55-21a1-4c83-9dc7-ceb9bf83d4da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466971, "uuid": "a7b6bffc-c6ab-46ab-8342-14c033b055ab", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa6ac0a-0460-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770494838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494838, "uuid": "8ed1f26a-1c96-4002-91bd-15c37544f149", "comment": "Malware payload", "value": "17aba3258755bc420c54f8a079208c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494838, "uuid": "cb226801-9542-484d-a0e2-9336b54cc1fb", "comment": "Malware payload", "value": "ecf56354f1699c343bade1e4dfab9eec25b370b53cde1f2eb1d8837ab25cac44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494838, "uuid": "b14a85f9-2847-4a0a-a2a8-33a449f29ad3", "comment": "Malware payload", "value": "bf370df72f60181ae4741a83f20f733d9435d82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770494838, "uuid": "784e1ad8-9555-4e53-ba44-bbfb70acc552", "comment": "Malware payload", "value": "cb662fb45e952095e16737c85f70c5956f0c1b553d1c270db94fdc4a0be0cf90f6007e416db9655ccb523a4f7c449c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494838, "uuid": "b98ebfee-20e0-486f-a431-a4127657d40d", "value": "T108735C1AA34318ECD61BC5B086EF6733BA72F8B756309F2F5754DA351D10E902F1A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494838, "uuid": "ac91cae8-1269-4447-8685-d605014b01a4", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494838, "uuid": "a4257271-e500-43bb-b519-8faed9d4cca5", "value": "1536:15l8EoNLDd0E7ccWlWUEvwznKklGgYtRFC:rl8EoLJPWgFwWkl22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770494838, "uuid": "3c621f37-0e79-40ce-b44f-1190fc25d87b", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770494838, "uuid": "ed40a84d-e489-4cc5-81b8-00cf6ec610d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770494838, "uuid": "1f450e8b-1cc6-484f-8374-a9ec1022e127", "value": "SecuriteInfo.com.FileRepMalware.32821747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b32ca1-03f7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770449684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449684, "uuid": "13e57137-8aa2-477a-bbd2-3d837a041c1b", "comment": "Malware payload", "value": "45f5d9dfe38c7e5b5b9c2d896ad91b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449684, "uuid": "b4a8aa95-2948-4942-bcb5-6739cbfdcab2", "comment": "Malware payload", "value": "eff0db0b8e5df6de9ed8eeda5788cd0dbe3930bf0e318770aedd3aacfb3b09d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449684, "uuid": "862cc2b2-c093-48bc-8615-02ad2b241308", "comment": "Malware payload", "value": "32a1f4e76d884f45f3fbea20d7668bad9456f7b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770449684, "uuid": "57ec7b48-3c55-4062-9841-3eabb301c11b", "comment": "Malware payload", "value": "a4ba7566beff9812976b101dd6c1e400d165304c81cea80b194f324e45039977c3029404d0d1830197de55fa9e24f36a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449684, "uuid": "231c7f1a-0e4b-462c-81ee-a2775004642a", "value": "T199157C99E786E0E0F16300F1125EDBF30934A5365053EAF6FB862A6674327526F1732E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449684, "uuid": "51157aa4-28ea-439e-9c38-7338e8c7ad1e", "value": "24576:Syq30UVhTrh8UvXW+qPiIsNWRR0xvESaYmtWwTRp5J:SvhTrhpvG+qXCWRax8bkwV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770449684, "uuid": "05cdc9c5-c8d8-4399-833b-10e790cfa54a", "value": 928780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770449684, "uuid": "9c3705cc-a057-444b-b21f-7b9157a93aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770449684, "uuid": "7ee16023-ba1b-4043-a222-5bf927ab0f60", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31136ffa-03f1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770446987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446987, "uuid": "89af9c96-3746-45db-8655-8d5212e7e3ab", "comment": "Malware payload (Mirai)", "value": "8022402c97def3d5076ac40bb725cccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446987, "uuid": "4753a9b4-6a79-41ad-b581-3cb376692d59", "comment": "Malware payload (Mirai)", "value": "f1d007c3398c3d6653b5efde3e2aa025a06c6d11ab62c2455a75db03eb221d8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446987, "uuid": "ffe96c98-7427-4ef6-b689-394da315279b", "comment": "Malware payload (Mirai)", "value": "a9c2906d92bc6ec7a7bebf09af27be3b35f18907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770446987, "uuid": "89b6e43c-aace-4edf-a366-369544449aaf", "comment": "Malware payload (Mirai)", "value": "bb3b2fcb6a63da67dec9167cf05adee89a4b16607e80f96266d298420fd5173ffbf770faf4290f3cdaaba10918fae29a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770446987, "uuid": "55e70e04-479b-4070-82cf-8e7219857116", "value": "T11243A416BF650FF7EC6BCD3749E82B0524CC650A21E87B3A7934D818F61B25B49E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770446987, "uuid": "69a9d55c-9402-426f-a1df-c2755936b8b6", "value": "768:x4EJFBsExxd6AI5BQeOfeKUhtv6bxXic8DbFWy:x4EDFIwvfpUhR6Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770446987, "uuid": "d5957ca0-7bca-4011-ad45-49e9a627e3ab", "value": 55236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770446987, "uuid": "1d090f45-9b45-49be-9fc5-243734278f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770446987, "uuid": "21392c89-fafe-43ae-b337-705bb4284a91", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ca2776-03b9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770422921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422921, "uuid": "d1cb6ed3-2afa-4def-b647-208509fbfed7", "comment": "Malware payload (Mirai)", "value": "4196366eb31cce793feaf8c29877aa77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422921, "uuid": "0d9687a3-4072-49d7-a82d-672bc49888c8", "comment": "Malware payload (Mirai)", "value": "f2461f98dc9b4eed39caf7a48d61e42dc9b3cc72d7a8447626e6734f71083e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422921, "uuid": "c5b573a1-b052-4362-88de-908eb3daff30", "comment": "Malware payload (Mirai)", "value": "a1efbd0703af493aecec70208cf7232647d509ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770422921, "uuid": "64b193da-538a-4533-a3c3-f43086af4062", "comment": "Malware payload (Mirai)", "value": "abda7ff618b3129e74de579dead8af9c8ede4b715e3ea7455c543f6d5e47d1b35bbb88c88691d5c71070386798205d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422921, "uuid": "bb990a0a-131d-4453-832d-8be1e421d6fe", "value": "T18AB3C509BF651FF7E8AFCD3749E9170524CC641A21A83B3A7934D928B68B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422921, "uuid": "ab06775e-69ef-4129-bf85-47353d291cf3", "value": "1536:MVMagnSlz/UAMsGjlyby9uU7UKI9n1C8VZenX0sYtcqa0MTq:MVMagSlzbM9jlyby2n1C8Ve0Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770422921, "uuid": "718bc11f-5125-4176-b913-4f8d23b70192", "value": 109320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770422921, "uuid": "77d4d063-2a5e-4f62-8b7e-58092338d8f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770422921, "uuid": "b06b4601-5bc4-4f91-b89b-fa5c00405fcd", "value": "binary.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4193229a-041f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770466771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466771, "uuid": "fce12dc2-fbd1-4523-bbae-3c0758769d26", "comment": "Malware payload", "value": "b0101b666d1cd93e6bd719c734d02f19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466771, "uuid": "3a43fff5-5891-4b7b-8acc-3226414bc9c8", "comment": "Malware payload", "value": "f38224bca1df533c4669b3c0e696374e85aceb5a64fec140987006f1aaef9566", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466771, "uuid": "c77b343e-7ac4-4f52-a575-15e115ec0b1a", "comment": "Malware payload", "value": "13120b2837aac522d8feb8deec85ecfd7e2693ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466771, "uuid": "d2db0ead-4721-4f63-ac9f-d75fe73f150b", "comment": "Malware payload", "value": "fc15a52afc2b705fabb03d78d80d1a928cbdee83e5f63868f047de3223e9c828fbcd98c0cba72664f970717b92dba429", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466771, "uuid": "6093be98-b0bd-450c-814c-ffbedc3165f6", "value": "T1F3567D30B5B68469ECED00F1A2BB59775A6D1D04773484D3E8947C983C701E2A3FAEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466771, "uuid": "54727a77-2da7-489f-9405-5d10e7e1aa09", "value": "41c32693477d1b5435c0e09bb2654b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466771, "uuid": "90db7ab1-4e28-4a59-bb68-55050d5fb60d", "value": "98304:tn+YTvybTDhTSSTSaQz+fAWBfVrc5r4HeMeGq6QIxpvO1ZU:tnfvuhTSSIc+Ye+xg1ZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466771, "uuid": "0f60cfa9-eedd-44a9-be0a-cdabfa938d2a", "value": 6152024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466771, "uuid": "084aa46d-8fe4-4e35-9979-b20bbd33c27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466771, "uuid": "54911bac-d5cc-4cbe-800d-ccd4706f3026", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ec6ef0-03fd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770452226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452226, "uuid": "899470e1-02e0-4760-986a-8897c7d516e8", "comment": "Malware payload (Mirai)", "value": "f126cebe7a6341fef72130504dcf2217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452226, "uuid": "b2df5491-62bc-4024-93d1-92d579e7661e", "comment": "Malware payload (Mirai)", "value": "f3896613abc226d72d4d2f3cc68d20717729ea0fee2b3d9cb8bb754b8d746daa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452226, "uuid": "b24c5afb-07e3-4b84-8369-14937f835a8b", "comment": "Malware payload (Mirai)", "value": "faa29ff171efb7164691337c4a063601a490737e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452226, "uuid": "92291d30-6b9a-499d-a645-75a1ecade6cd", "comment": "Malware payload (Mirai)", "value": "e6ec24cb2ea46232e68188b7f02430703984fbc3ad72e4347772de86a1a2de61c9f79f6afbedfe5f885884b4495101c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452226, "uuid": "373910da-d36b-4b1e-9102-6feb983ba98d", "value": "T113439416BF650FF7EC6BCD3749E82B0524CC650A21E87B3A7934D818F61B25B49E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452226, "uuid": "170515df-5a39-458b-be9e-a89dcbe98bc1", "value": "768:x4EJFBwExxBuMI5BQeOfeKUhtv6bxXic8DbFWy:x4ETtIwvfpUhR6Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770452226, "uuid": "48406b49-d02a-4420-b267-cc0f203e0026", "value": 55236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770452226, "uuid": "61d370b1-8145-48e0-bdd3-d513424f8063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452226, "uuid": "d957155a-c284-40dc-b795-f9b89c8225ea", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a64e781-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461739, "uuid": "97fc157d-5d2a-488d-8712-6da4fabd8cf5", "comment": "Malware payload (Mirai)", "value": "71174cc3080a72fd580b3e999596a2d8", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461739, "uuid": "72a8e020-02d3-429b-91d0-493a3ece1ec7", "comment": "Malware payload (Mirai)", "value": "f49252e37326313efedecf47a41aa4d373aaf9ba5e582faa69382d120e83473b", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461739, "uuid": "b72d5292-2d46-43d2-8139-d1e23ead6acf", "comment": "Malware payload (Mirai)", "value": "66dcbecb7c6587439ddd9cc72591f093e761d246", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461739, "uuid": "492e952a-52be-43a0-8265-b916f2e4865c", "comment": "Malware payload (Mirai)", "value": "2cc48d3d4f6053daa54ed12a0d7108ac37322382df5d416063e97786a1904af4a95506a5710ee058f6e9c702df9a8bcc", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461739, "uuid": "2499c926-9c15-45b8-bf91-9f682728bfa9", "value": "T13E961A137B2CE71FC619613459B2CAA8272A1C5646D7941BB381F318E9F21BC5DAECF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461739, "uuid": "9a583fde-a340-471f-a481-5c5a63c51d01", "value": "49152:WwCKevxo/503x+hA2bux1lJWlmgcSoh5Ww9zk1sPHW22nDCNc7oiofYd1OX0lJ7l:9017STw9zhIy0lJ709AtFnEjE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461739, "uuid": "0a8b640c-5cb4-4673-a06c-d9ff573eab08", "value": 8782039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461739, "uuid": "73447ed9-0d92-435d-9c98-4037db32fe32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461739, "uuid": "23249a65-a63e-4ead-85b6-2931543fc777", "value": "deferwqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9a3a8c-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489097, "uuid": "507c92d5-e93a-43ab-9a5b-3157796d9863", "comment": "Malware payload (Mirai)", "value": "2f8ba041f44f83fdce588c367fd37b6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489097, "uuid": "f525ba73-731f-4b27-a8ff-ec6768213091", "comment": "Malware payload (Mirai)", "value": "f512a8378187da632f6361215648ef576cc3799285a23dc8eef4ce70572c1aad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489097, "uuid": "f70b6827-3d0b-4de6-a99c-4d375d98b279", "comment": "Malware payload (Mirai)", "value": "4bcbc34d9b5472d4d8858fcd2cdb7348920d1ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489097, "uuid": "03f8e548-b258-48b9-97fe-aed7e7b8a6d8", "comment": "Malware payload (Mirai)", "value": "0f1fb8966c54284c1860a5b406e200397900cafae365d915d143fd1e836b70ddbe74b2f0ec65c862d1707ccb3243bc29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489097, "uuid": "3e01531c-3f5a-4e9c-9598-a2a58d73dd41", "value": "T194044B02731C0907D1532EF02B3F6BE193EFD5A125E4FA45654FAA8A9172E72244AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489097, "uuid": "ac9848f4-a1ff-45e6-a6ea-a31acb4d4cd0", "value": "3072:NEYnekiip5S2nLeDUxWp3jZ8SXSlQCSAW:NEG5S2nLeDUxWp3jZVXSl2AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489097, "uuid": "eb25cc65-3d3b-439b-a878-34dac73b03a2", "value": 187224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489097, "uuid": "883c6ab2-50cc-4cd4-8823-5ea3b97653f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489097, "uuid": "9c378b74-92d8-4b6a-8a7a-60b731a04bb6", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648534b9-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461676, "uuid": "a0209f84-4b3f-44ae-aac9-61507a7cf2e5", "comment": "Malware payload (Mirai)", "value": "50e511c32f819c019fd7168e8f682cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461676, "uuid": "4fb1f7c1-6f06-4952-b41e-73e36316a662", "comment": "Malware payload (Mirai)", "value": "f5e49cbfcae78ecf40345f48bc73490ff379c0175d30e4f913e4ec04715c6896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461676, "uuid": "e2f31540-7e7c-4249-965d-25c580d37804", "comment": "Malware payload (Mirai)", "value": "5dc5df6fa602d6518ba4a7a2c27fdb03a464bcd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461676, "uuid": "ec6c25f0-21e1-4146-bf07-a3d45c651fdd", "comment": "Malware payload (Mirai)", "value": "5397cce063618d664e2748b43dd512e246ebdb06bfa18b72d4e312c6d196a7f40b1d6327c2ca7d02fc7019f3bee0bc69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461676, "uuid": "ce106849-e58f-4cb5-82b5-51eb31c8942b", "value": "T15595333C09A73BD3E7ADD092618D036116B3B154D44EF27745232BA35A759BB2C3F1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461676, "uuid": "6bb6f6e5-23d7-4416-bd4e-878cdaad4d79", "value": "49152:i5uGrEcvvC1WrCWDa5aP4zirxRUZ5f6/5m0uKc:rCHvCArC/MP4484/c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461676, "uuid": "1601526d-7ac3-4e11-9d09-4164f6270d26", "value": 2025480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461676, "uuid": "5d5441ed-97e9-4a58-8c7a-da6d390e05ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461676, "uuid": "8f284e25-9ca7-47a1-a8dd-dac8f9c1cd56", "value": "deferwqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4951bd-03da-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770437259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437259, "uuid": "dc6d183d-c92e-4053-b2ba-1d563544459a", "comment": "Malware payload (Mirai)", "value": "d28043bdaf56523c4eb74de6fe1d0b6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437259, "uuid": "52427e92-7e97-4b7b-96e1-06e86a3a0949", "comment": "Malware payload (Mirai)", "value": "f70bd2634d5d34c8793f37e4c4b8679736c9121ad86b0c3fa056cbb31c20bc98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437259, "uuid": "b9fa89dc-dbf5-4108-8f83-48c29560ba05", "comment": "Malware payload (Mirai)", "value": "3648d94704d904187a3f40f68fad6622155afe3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770437259, "uuid": "85df5ab6-b467-4943-aae1-5deea0dea032", "comment": "Malware payload (Mirai)", "value": "59bec73403a3cb717653c05c48c951c39722da61ddacb70764e11677bcf7b430156865bd912fef5a7ae4e2d9323c66fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437259, "uuid": "4f00533f-1d93-41f7-a1a2-c872b33c8bee", "value": "T1B8F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437259, "uuid": "bd2b4008-1400-42d2-8676-ff42495b4212", "value": "1536:7dMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpqEn5p5M/LW:b7vDtrnPTR71gmX7Dy7fMpqxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770437259, "uuid": "0005f9f1-69f3-4892-a81f-fbb6c19f7bc2", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770437259, "uuid": "25a43cfa-4847-4566-bdd4-74f75b4fc3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770437259, "uuid": "8c38b4a3-6bee-4c3c-ab90-9a6a4be48b49", "value": "israel.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ac23a1-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461757, "uuid": "88c27f9b-8015-4964-9547-77733e5d0415", "comment": "Malware payload (Mirai)", "value": "f3a756f624010d887368b647bba961dc", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461757, "uuid": "cdd7bf39-61cd-4c38-bb83-d3567db28924", "comment": "Malware payload (Mirai)", "value": "f7b7d9d73fff66f144b397b1077753efa6809ef59f6232c234f7720a437247f0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461757, "uuid": "8185da9e-a615-4b79-9201-f16b9832c9e1", "comment": "Malware payload (Mirai)", "value": "f35612ad8aee5bd8ac0294fa720ed083cf7e671d", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461757, "uuid": "75424354-56ee-4d25-b352-5ff196a15c17", "comment": "Malware payload (Mirai)", "value": "e78aaef2d338f925efcf4e683d0f67515229c14b35232d02cd0064eebfa5fa3ff08aa0bcf8dbe32dd9caff9869283127", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461757, "uuid": "4d35e466-d983-4941-8327-83f0b358b356", "value": "T12E96F805AD853BA6C42C4F7490EECA5522B06D145AF18A7A2560FFEDBC722787F47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461757, "uuid": "8ea0fbe3-9e0d-4296-89ae-d562fc31c048", "value": "49152:MEXIlW9MsQ/yDO85puJkeM1/1ma3dIxHW22A5/qLxnoA/I981CuSMcDYg5EP:WN185br1/lC5UtSMcDhEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461757, "uuid": "786cb4b0-d696-4b0f-903b-6c0190a8f63b", "value": 8782039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461757, "uuid": "e47d9c6f-797a-4fba-a44b-2dfe005ca694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461757, "uuid": "c3564bd6-fa1a-4b68-b2f1-02f168c5e35c", "value": "devfreqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebed950f-03fd-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770452454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452454, "uuid": "ffa72145-4f09-4c96-a0bf-3664895191b8", "comment": "Malware payload (Mirai)", "value": "ec438d5754860984aa55d5bc94dd21de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452454, "uuid": "1f949c8a-4334-45e6-830a-832afdbd4dde", "comment": "Malware payload (Mirai)", "value": "f7ff91c6aac93ab4abdf2ed716b07b8fb5ce85c4c32ac6830d64c35165a75b14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452454, "uuid": "2eede7e3-3e53-4ae8-8d87-3e474bd34ce1", "comment": "Malware payload (Mirai)", "value": "dc1dcb4bad072716c0be65691c2912a2671e1cad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770452454, "uuid": "6eab0f37-528d-44a2-8b69-0a0c1b1a7a2e", "comment": "Malware payload (Mirai)", "value": "628e1093f5053e16dcd4ef5bf591183631e69a64aca2351e2377c5234b2a7bc8bb1a0e0e9ac1f0d1e94f24f6618625a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452454, "uuid": "3bce6ef9-3619-40a7-8965-5ee1d8710733", "value": "T11FF229C0A983ECF4EC2606751237F3769776F0362129EAA3D7A9D933F841611E60729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452454, "uuid": "6fe4cd02-b55e-40ae-8313-fd1f6f4084cf", "value": "768:ex8ifmCuPOAOctERNaN3QWHsUAH/8m10nCgeBJSYTM:umCuPOAOctERNaN3Z2HEs0nCgevSYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770452454, "uuid": "e8197a21-4517-4059-9474-281a40f634e1", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770452454, "uuid": "d7e6c18a-1aaa-4707-a62d-ec9fdebd64c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770452454, "uuid": "5750f700-6a7d-44c1-984a-f882f07caaf1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d50af6b-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468187, "uuid": "c2a317a6-5a66-4782-99e2-2850b2a1439a", "comment": "Malware payload (Mirai)", "value": "8c8b005e92229f7efde35fbd0a5479e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468187, "uuid": "91186d75-a085-4ed9-a13f-018419e6deac", "comment": "Malware payload (Mirai)", "value": "f88b792dfae97ba3d9512ab456971fd66e38430a7f4f1b17440b5cc609d843a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468187, "uuid": "4c6c60e5-9c6a-49bb-8f48-3deabc23b9f7", "comment": "Malware payload (Mirai)", "value": "49ac99b80dbd2052ceeb4e6e8e49c739074dbb39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468187, "uuid": "01484bfb-07d5-4992-911b-997e4c948cba", "comment": "Malware payload (Mirai)", "value": "885f1ed9f18ba3986bfada7180afc931e0116b24fb4ae151b15c47713ca060eaabd0a1284710d55c0b2880348e5607fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468187, "uuid": "da43fd07-77ac-4a8f-aaa1-52f12900af53", "value": "T15F01FC8021B091B4B4ABE8E64E335C1C30C590553D872CFD3CE5A8D73AD9D02B2423ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468187, "uuid": "0d2b1b5f-84e2-46b6-8d03-eddb28914e57", "value": "12:YkF1kcClZF70S9CSHFnCSHF0CSHFWGbhFS8wMFM5gFJN2GbhFSKwMFMDgFJN6A1B:ZDkH/FbpHFbHFKHFWGVF+MFM5gFb2GVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468187, "uuid": "4f2ffe1d-9aa5-4d1f-a6a7-bbbc91a2a4af", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468187, "uuid": "c684613a-1671-4281-bf5a-e46422dfe0b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468187, "uuid": "467c244c-aec0-4ce8-b5bf-c1323a5413e8", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba42d98-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468184, "uuid": "df870cfb-edfd-43e1-a922-1d083b1ae8ac", "comment": "Malware payload (Mirai)", "value": "bfd6f79e8423751281a404ca9ab3b8e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468184, "uuid": "51ba09f1-cec9-4b4c-9741-662c94a39996", "comment": "Malware payload (Mirai)", "value": "f88d1b748f0069bb450352facfca0a5141e73adb51f527280562e911b68f0fe7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468184, "uuid": "87e6302d-ecee-4d22-aee0-d859d1b4ecb7", "comment": "Malware payload (Mirai)", "value": "4a795b3cc29b75b8cd0c8fa391116ea3d01af77d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468184, "uuid": "8ff5f71a-04f3-4381-a36d-7dff661977ae", "comment": "Malware payload (Mirai)", "value": "6e9418aa9335bd3776d902294573c0cd3b88921d742a4a73d82042844f3d300c8c139076f5374c48f582cfd76a456050", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468184, "uuid": "26650acb-9dd7-4419-b2c9-bba063832197", "value": "T19CE1734BD0916A71BC64895BA3973546709090EE86CB9FDA3AFC35BCC18CEC47EC19D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468184, "uuid": "b92e6b63-6815-4979-91d8-70596e323b34", "value": "96:eyYcb6+09ykssigO2USTCxRqDR29yVQMUduYzsigTaXxTIDR2+b9cDyvsigVvcxu:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468184, "uuid": "a3341b37-076d-4ba9-8eb7-f23986149069", "value": 6896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468184, "uuid": "687f4d40-e8e5-4037-a1b4-722f918a46cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468184, "uuid": "42bd4761-0fb4-406a-b63c-3343e8fac31d", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a13be7b-0422-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770468181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468181, "uuid": "bea1c4ce-9f64-4a77-a6c2-39a7f1070cb8", "comment": "Malware payload (Mirai)", "value": "d3ca716c5089f1375ea1f00b8c874607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468181, "uuid": "abd5f294-28d5-421f-81b8-b779d198b275", "comment": "Malware payload (Mirai)", "value": "fa2d1182491111a335c1266b596054eaae4eb5b64d6b9521923bdf5580e1a435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468181, "uuid": "edf31620-35e7-4700-8f03-22413bdc38c2", "comment": "Malware payload (Mirai)", "value": "cdfedf82a9dc3b864467113f13ea6c6489a73d0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770468181, "uuid": "342fbeeb-c3ca-4f20-9cf4-786f027e231b", "comment": "Malware payload (Mirai)", "value": "2a62527802e9cdef92d121a2596cf77b26fb50bb0d56145688a9863729a1e6569d4fca1e1be688ec294f58167391efe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468181, "uuid": "108916cf-ccfb-4ed4-aeab-7bfc3d9f989d", "value": "T1A1734B0277180A47D1A71EB4293F27E193FFE99020F4BA88294FDB4A8135E73554AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468181, "uuid": "951123ff-7cf9-49f0-867a-fc242a4baf87", "value": "1536:R6vCWJWR3Kqqmz2dPHPKf+sMmJR3o3pjLQB+hC0QZwHTR:cvCWJWR3Kqfi5mJR4FQB+kkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770468181, "uuid": "079034ca-a007-4a4e-be3b-b33c5e3620fb", "value": 79468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770468181, "uuid": "219fcfe2-1b41-4763-b8d4-7ff1fbcd0367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770468181, "uuid": "ca03a7c8-dac3-4f60-b6e7-4fc00133cf15", "value": "binary.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42266bc3-0450-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1770487817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487817, "uuid": "d01e58cc-a54b-4cce-9265-100eb363a011", "comment": "Malware payload (GoToResolve)", "value": "4fc02f53affa50b86e271dddadc1b212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487817, "uuid": "d9ce531a-25cb-4318-bc47-8fc7c9083804", "comment": "Malware payload (GoToResolve)", "value": "fb5c94c6c881b9c467c19233371d50403db03c2fce03b7d2ea33866ce99d2a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487817, "uuid": "85ba5ea7-8785-4d83-aabc-618f4e059c95", "comment": "Malware payload (GoToResolve)", "value": "4f55e447078decbbe894614795cd6d898c520d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770487817, "uuid": "2580e9bf-8e1d-4626-9b6c-71854b129acb", "comment": "Malware payload (GoToResolve)", "value": "d4cd6b1736447a7a0a81399ab9937b7c1f71be20ca683da9400912ea110c29aa01a58116b51cd316672ce669d4d45e35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487817, "uuid": "9861d300-eba0-4d5f-94f7-f1fb8a7bd1fc", "value": "T1843733717646C175D05121B16D68AFFBC2ACEE34977609CBB3D85F298B304C23B32A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487817, "uuid": "2c403fcc-6c0c-4310-b700-202e46679201", "value": "669c6ad64920732b55f250261305867b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487817, "uuid": "8d11b762-163f-4630-8784-8b66c875c992", "value": "393216:V2913r8REizYFWEKSRNN7B5dkn88yymNaenueGLFFZ7LoNf81sZe2N+7cp1aIcUg:o9qEizYFWEKUXN3k8dyOuREZeq+Y1aI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770487817, "uuid": "26a46281-eb7d-47b4-a673-41161e8e822d", "value": 24496648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770487817, "uuid": "b9bc324d-f531-40cd-b330-36a2f9d5aa1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770487817, "uuid": "38e7e9a2-9866-4894-ad83-615b2b4f5892", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f2df29-041e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770466616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466616, "uuid": "445cc411-2daf-4807-a255-c4a274d8020e", "comment": "Malware payload (Mirai)", "value": "643af0da3a1f2fb5b5ca657af681e53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466616, "uuid": "a5d3583e-b752-4ed8-9fde-a07e1bb68b2b", "comment": "Malware payload (Mirai)", "value": "fb76bac1e046aa4433a9b1cb36c95e038b8174b948c9edcc4ecb74bc8ed40176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466616, "uuid": "efe11c24-cda2-47d8-ba8d-a537b3a86382", "comment": "Malware payload (Mirai)", "value": "8d9b0b95bb2137ad17c25b9608bd11fe027022c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770466616, "uuid": "0d50ecf9-a26f-4024-a39d-669239fc93a2", "comment": "Malware payload (Mirai)", "value": "a6d0b589a8e5877e652fb7cc308a96667f7768eca0cc5093bd5d321ccc3565fea611c09f19383ad81cc067da75116caa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466616, "uuid": "e23d1bf8-beba-4ebc-892a-1bae70d53b17", "value": "T15B93F8CABC858B10D5D525BAFE0E618D33538B78E3FA7103DE185B2A638AC5B0B37551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466616, "uuid": "6958fc36-baca-45ce-be45-7f46ffd0067d", "value": "1536:zgn2GWgiVZXN6iHvnO4u/+ENdYfFaITvns+j53iGbjrJnMQ32lLziQMAe/9:8iVZ9VPnxu/+ENSfFaITvn7ViGbjrJnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770466616, "uuid": "bca3809b-be8a-4240-a3a8-0b5c092454e9", "value": 89712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770466616, "uuid": "33674eca-d33e-465a-a695-e3d6bef8efc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770466616, "uuid": "2debce00-72ad-41cd-9369-73287bd9b4a3", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289d0b72-0430-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474031, "uuid": "334745d1-376f-405c-8028-108b8819947f", "comment": "Malware payload (Mirai)", "value": "3357c715d15e38a92d9a1bbc6fc357de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474031, "uuid": "6eab9ce0-437c-4e67-99bf-1aeed3fee0cc", "comment": "Malware payload (Mirai)", "value": "fc322a9c55e352dec88d56335bcb37582a9bff821b1ae6a41dcb51ab38f6290f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474031, "uuid": "ef77d688-1154-41d5-bd14-c348f789148f", "comment": "Malware payload (Mirai)", "value": "c0f8881838b48cfb4722ec25e31cf57de83bb280", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474031, "uuid": "51588162-e675-478a-be68-cb4cf4185d1f", "comment": "Malware payload (Mirai)", "value": "df8c6d135a7ea9b0bf3d6dd8488b1ac5054186b07d2b42fc27fbb15c5e763d8b3a5cfd579351cf8e91b6e59aeb9bd36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474031, "uuid": "3abac362-a9c2-4d66-b4de-17a3a3eaef94", "value": "T162F46B237B21DFA5E314C67005F3C7515AE520620BE2508AB27CC7287A61A2D6D6FEFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474031, "uuid": "be3d9b24-6080-430b-9674-8f20e1f9fd3c", "value": "12288:F+g0Y4NxfiNs+Hct89zmH/743dOepqffdOweOXo8pZx5P/lH8jVGesV:Fd0Y4Nxfes8M8pmHUgfFOweOZJp85GeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474031, "uuid": "2ade295c-9aa2-47b6-925c-3520c4244382", "value": 762160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474031, "uuid": "f927a717-2a5e-4371-8811-edbdbc9f5fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474031, "uuid": "19d7161b-78a3-406d-ab31-60c533e11450", "value": "SATAN.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942069c9-042e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770473352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473352, "uuid": "a72aa5ed-f0df-4cb4-83ee-9c2a11648d1f", "comment": "Malware payload (Mirai)", "value": "93ff1c05304cd887668301a51ace144e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473352, "uuid": "2a6d79bc-ffc5-4303-b7de-651d68ed0ecb", "comment": "Malware payload (Mirai)", "value": "fe3a89d2657f1476bebb63e1f8374f371a27a4ebd51e4d288cf9e3a37b9faa3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473352, "uuid": "65146c40-d3f1-4c0b-af85-987410317ea2", "comment": "Malware payload (Mirai)", "value": "0f54f247ac14034f398b0ec026449e99a3b1bc02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770473352, "uuid": "85e1aa3e-04df-4d4f-bac1-b3c93a6edd35", "comment": "Malware payload (Mirai)", "value": "976ffc1a0f3353bb0e030b201db070d01202bf3bb54adebf17293765e81d203e9e791fb9bc46021de6922709ec6b14a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473352, "uuid": "09b64cbb-a086-4bc1-9d94-a8afabafbde2", "value": "T17B53F80AF9829F11D0D531BAFE9E55493313ABA9E3EE7102DD206F6027C68DB0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473352, "uuid": "4552edb5-ecdd-404c-8504-20d93e375ffe", "value": "1536:J1nAdKvRJazmpXO2LLpB938rZwr7by+QTB9lfai9nG0eGa:0KRVjMrZwr7by++ZnGDGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770473352, "uuid": "227936ff-bae9-4c53-93f9-046c21b0ea73", "value": 64056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770473352, "uuid": "7989b125-13da-40d9-95aa-d2836a62c47a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770473352, "uuid": "421e18b7-c890-4d60-996f-03ae4ed4d517", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b92f43d-0453-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770489068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489068, "uuid": "9aca70cb-de40-4023-98db-20b1eb88c960", "comment": "Malware payload (Mirai)", "value": "a78ad5e34509bd848b18b13fef17339d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489068, "uuid": "b903fbb0-4332-4f1b-993a-418383dbc151", "comment": "Malware payload (Mirai)", "value": "fe3eb117b923a5de1728ee810fffe05930f9939ccb2bb9ad29e2b06bffab1784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489068, "uuid": "f5e89a90-3fd9-47ef-b37d-5fab2d685b78", "comment": "Malware payload (Mirai)", "value": "c853ea90f9593a1e92d253a86f5e797bb606edf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770489068, "uuid": "bd253056-af41-45ac-9fbe-171071dd8f01", "comment": "Malware payload (Mirai)", "value": "701c9bcd736fe89489edafbf5651c93eccbdd97711560861cb06a757fb8cbc7fb26a67243febe1e9134ea22213b7d22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489068, "uuid": "63d84c3f-abaa-439f-ac59-e917c5c95257", "value": "T1165302C2F2F5F571E8FF017C62DEE91B1B21C548E600AEDD0BE8D1798482ED56724592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489068, "uuid": "329b7de8-9acf-4cc1-bf3b-ccd1aa993a94", "value": "1536:Usy8V/g8AJCjTRB6XlWvQyOF3BkkZRnd43EGCmxnouy8HyC:U7kY84CjTj6Xl8ORBkkZRndiEG3xoutp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770489068, "uuid": "3930edfe-6c8d-4d4c-9883-d7a58df5f115", "value": 61304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770489068, "uuid": "daab7f7c-f3af-436e-acfc-5289884963ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770489068, "uuid": "e2afae3a-6cdf-4ed9-90aa-3f0d71fd957e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353e7c28-0431-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770474481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474481, "uuid": "725ba2fd-1ff9-423d-9049-2034e73b1413", "comment": "Malware payload (Mirai)", "value": "8368ebffe318fcac07874937c5b97fdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474481, "uuid": "5aec89ff-da66-4447-a7a7-d835a96b58e4", "comment": "Malware payload (Mirai)", "value": "ff1102d22747b85d9afd3244c02638ea0a0774d7eb287ba45aa431d0bb79fc6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474481, "uuid": "032cb436-a0d9-436e-a630-3326da011001", "comment": "Malware payload (Mirai)", "value": "9a77c5cb91fa0000721958306620d340058b0c85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770474481, "uuid": "e970da60-1c72-4335-8f24-c3e6fa8c9af7", "comment": "Malware payload (Mirai)", "value": "3d290ca144c514f378c0b4ee68073082d7de884ed5260083f3e4d12bd9c956381cd82577a33b3003a558d75fb48c833e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474481, "uuid": "81066033-6380-4a23-97df-d662ddc67628", "value": "T15623F8C27892AA39C3D0577BEEAF418D331497D8D1DB3357C8281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474481, "uuid": "d3d38b15-5ad4-4f99-9e89-cfc3a8cad25a", "value": "768:HR7nhgvz7/a6M1yyj69CFLUEZmY89ntf2OfFGv3kNmekTtk7wCVy/rCxHghW1/K7:VhgHLM1oBY89zGv3kNmekpfhWE5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770474481, "uuid": "a5934847-c720-492b-bd59-14e7426bb9ed", "value": 48792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770474481, "uuid": "d685cfbc-3cd1-4da4-9e41-40071c5f3c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770474481, "uuid": "f0ed6685-e472-4bf2-aa84-fde48c19ce77", "value": "Owari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce92cb5-0413-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770461744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461744, "uuid": "51eab8b1-14aa-4dbd-8621-ca27913cd3ca", "comment": "Malware payload (Mirai)", "value": "fff11ee60953832e3708220b4e37b670", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461744, "uuid": "def98dc8-a444-434f-b273-156ad0ca0417", "comment": "Malware payload (Mirai)", "value": "ff15fdc4d572eeb50080b754649fd4a4d44372c4f23831455bba2fb9c4a6e3de", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461744, "uuid": "8c351c33-6046-4cc2-aed0-ed95f1d7d086", "comment": "Malware payload (Mirai)", "value": "c5089887f318adfced7622706766bf1a95c69a42", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770461744, "uuid": "1fcf1cd3-eab5-4f96-abdb-8636683d1b48", "comment": "Malware payload (Mirai)", "value": "794021ab6bd7de76f49f61035333325954e8089afaecdf3e934e0b137ca2e560ed67afbffb987c88d17fe46d81893eb2", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461744, "uuid": "c9203c72-e05f-4912-9c5f-98fb0397ffef", "value": "T1F2861947B8A24942C5E83A37BCBD80C832631EB98B8756576D05FE3C3ABE1D90E35754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461744, "uuid": "14f1bece-5175-4fbf-aecf-7a083947b126", "value": "49152:g6jc7Uw0R22zHmngCw761jOi7Da4SfO7nTCScjypZUu+0kdxsDHiXg5E8:g6NwymnRDZ24DrUu+0kdxsDHiiE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770461744, "uuid": "d7845ae7-914a-4a8c-9d14-196dbece1fa8", "value": 7864504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770461744, "uuid": "d85f4f97-41e0-4c01-bcea-2f9b0e43ffd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770461744, "uuid": "677f820f-1bf4-4d1e-9a93-c3d1d8fd945c", "value": "mdsync1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1309361b-047d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1770507066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507066, "uuid": "71510e5c-190b-4a2d-b172-f1fe5e652c33", "comment": "Malware payload", "value": "5357fd09e76776e244847ed3518f32f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507066, "uuid": "36b3fe50-d61c-48db-9186-fde09bb10891", "comment": "Malware payload", "value": "ff6e786ffbfd18c5c54d29e9011fab81ed45c7cf261b7aa999c0f1fedc7d62f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507066, "uuid": "f61da16a-7cb4-4717-94a2-de081ce8a7f6", "comment": "Malware payload", "value": "b98624f1f552fe84a3cc9d8ca4b7fde12aaf0151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770507066, "uuid": "39cf4500-effc-41d1-8714-bcf4bde1771f", "comment": "Malware payload", "value": "389176fff2bd6a14b92edf0409aa8b4d56cb408514ff1797afb590f47a12be3c836ab6ea6d5399849c74dcfc6e130422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507066, "uuid": "682453ae-e575-4175-bc73-096f5ada89bb", "value": "T197F7337181E1045BE073987AA573CC748E5658568756C3FB8BCD8B8A2E271D2BC3DBC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507066, "uuid": "16745138-95a2-475b-b403-cc519c1371e1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507066, "uuid": "6a4b452d-6a0c-476e-af54-f5ae05ac6af6", "value": "1572864:KfjqEXs/8+VPyAiF5R7mP9daWnp+AJvZlxq7OW7/Eoc2PnEM:gJs/fV0lm/lIAJvZlk7p/nhPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770507066, "uuid": "f5377d28-3c86-4ec2-9286-5143f19ac195", "value": 76969583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770507066, "uuid": "f4ee91fc-efe5-4f01-a19b-b06cd4eca175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770507066, "uuid": "6098cd21-5bb6-4242-9e8b-31ce0b0d8529", "value": "vector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12833f9-03f5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1770448973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448973, "uuid": "42e88d8f-e43f-479c-8271-7b7a58b4456d", "comment": "Malware payload (Mirai)", "value": "0e52e8182216f58c4fd7129d167db005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448973, "uuid": "476172d7-d087-423a-a49d-bf0cd1f1c36c", "comment": "Malware payload (Mirai)", "value": "ffc68a370d1ab39ae179dbdf280018431b2c06eb13a39a7f189cba05499709c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448973, "uuid": "8595e736-1759-4033-af1a-cb785c907e60", "comment": "Malware payload (Mirai)", "value": "f673aa0505e34e3acf59cac0f263cc28ee200b56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1770448973, "uuid": "d5214e6b-62c5-4087-8556-17eb7ca452ce", "comment": "Malware payload (Mirai)", "value": "c61529f7d40839f41f350a7a89241ebfb6d262671385c4c9cbe91a90e9d2b9473ef080f55b68159caff2c39c3ef9ec46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448973, "uuid": "b8464e1f-b259-4568-8669-2911f1507d8b", "value": "T111133A31AA761F1BC0D0A8FA62F74728B2F1465E25A8CA4E7D730E4EFF6184455132B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448973, "uuid": "8bab5279-db2a-4c9d-9707-e4d45a38ddca", "value": "768:X3oPvWIdAovK4pt3fYoDsPTYW9QgnO++mUKhrl:X3QWYARy3fYogPT99Qg7+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1770448973, "uuid": "9535a66b-1e2c-4682-bc52-f0c1a6a91f11", "value": 44116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1770448973, "uuid": "56b93b7a-5510-45ce-b4cb-32881e2f31a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1770448973, "uuid": "a394770d-99fc-483f-9c5e-b58a4f5e71d8", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }