{ "Event": { "published": true, "date": "2026-01-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-03", "timestamp": 1767484981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "39017587-5703-4171-9ce9-3c8d4b83f318", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ecfe12-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468737, "uuid": "eb589de4-e9ed-4585-9b99-9d344ca86ed8", "comment": "Malware payload (Mirai)", "value": "1c637bf37c155856a696778b0e6975cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468737, "uuid": "0a9ad6c0-2107-4efc-bd7f-7ea197620d17", "comment": "Malware payload (Mirai)", "value": "0030dff13d42b603188849cf5f8ab34fc2f9d23adb0f73831d26ef323a1b4c01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468737, "uuid": "13f4bc53-6c95-4c3c-b779-be5d06e26a2c", "comment": "Malware payload (Mirai)", "value": "d7d51e5bfba6837987325872457e61245192e5d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468737, "uuid": "0e78ebe5-29ce-4a45-8860-8ac70d040076", "comment": "Malware payload (Mirai)", "value": "c391cdd917096dcf6683df7dac8df118de1b35d44bc5c24e74118690452322a67a9fd2976807649806a7a605cf5a6e77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468737, "uuid": "21a3a7cf-d793-49e0-981d-4b9f8f6268fc", "value": "T13A33944D6E328FEDF6A8863447B34E21A75C73C922E1D685E2ACD1041F7064D646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468737, "uuid": "536568c3-2322-446b-95d8-1d7d00d7cde5", "value": "768:mb7MY/Bo9L0aOmecCPrOnRvl1voVPyXcLveMExdvIWX:k/sccWrYCPefx5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468737, "uuid": "26a7049e-be14-4432-848e-6830716b621b", "value": 52248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468737, "uuid": "867917d1-4273-4fb8-b782-d6e7f3fb4938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468737, "uuid": "2bf7a584-65f0-4e90-842a-51e31d919cea", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4463a5-e8cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463691, "uuid": "55e912fe-3b15-4499-acb1-e4b7abb5cff1", "comment": "Malware payload", "value": "307e8128c8843c1f2870bcfafb1bdb7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463691, "uuid": "c6b0c062-d426-451d-b1dd-404c15b0df40", "comment": "Malware payload", "value": "007da2fdf5cfdd224365517c1f9a1a73d0765624bd7a56df7585d0a614895f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463691, "uuid": "771c52b6-333f-4ea5-8058-8ee993f1832d", "comment": "Malware payload", "value": "9bf14772f59997dbf33c9af1809382b2124a1328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463691, "uuid": "7b61d0bf-af36-4c54-a273-1135b4d427fe", "comment": "Malware payload", "value": "faf135c58f1a7b977928db6a1cea11cfd2cf6cfcdced17a0be9efd1177883cae4737ad9140bf987351a691c5e208df45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.F!ml", "colour": "#30D268", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463691, "uuid": "a0ef86e7-9dca-48fa-880c-7a907bd2448f", "value": "T192C57DC2DE4260F6EB81517525A777379E36828A231587CBE3F8DDB52E22110F63938D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463691, "uuid": "5d2488eb-2d4e-4b6f-bc78-0811ddcbcb58", "value": "360a9b3c33c7d0291ccfb91a532ce1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463691, "uuid": "c076e351-472e-4c2a-94ad-6837f2a10cd8", "value": "12288:gIgZHoPlG4Z31YGoj3snA1CfetFZascegxv8b:gVZHoPlG4ZnRnICGZc3xv8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463691, "uuid": "ef7da958-a0c9-4dd6-923d-6efc211ff95d", "value": 2498584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463691, "uuid": "ada7c543-2cfa-44c8-ad37-b4b743b36605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463691, "uuid": "74a6a226-dc2f-43d4-b4c1-b099d34c016d", "value": "\u5174\u8da3\u7231\u597d\u65c5\u884c\uff1a.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bb10ea-e8c4-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1767458924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458924, "uuid": "826b97cd-83dd-46b7-a3f6-ee771131f74d", "comment": "Malware payload (SpyNote)", "value": "6ed9638d38b5cfdab7e95958102885af", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458924, "uuid": "8f80e0cf-7f1b-4e37-92d0-4f6700bdaf44", "comment": "Malware payload (SpyNote)", "value": "02944967154e515f87bb411641edd9931ea6b4a4088ab73efe87cbe7b9d5b592", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458924, "uuid": "1ac69ff9-faeb-47af-981a-2db327dcb2ec", "comment": "Malware payload (SpyNote)", "value": "b34118bfe555abe985a57ee92736c69b2cf99871", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458924, "uuid": "9ba1b049-fd18-42ab-be8c-746a93a8af7d", "comment": "Malware payload (SpyNote)", "value": "02ff5b1e9acffa7170e2cc24b71552e5a30574c2a5fa17277126afa21ccce798c2d1b67e7451de1cde6e9e1a00eab2d6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458924, "uuid": "13a435ee-2e7e-4654-950f-abf6d6b3a7e9", "value": "T17726F103FB49DA97DCAA83F66F230DA91A130F14C602BBD70465766D2D7B2D14DC6A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458924, "uuid": "48f9a708-f13e-4e9b-9371-6afb40163e44", "value": "98304:uwghohJ11DHtboHd7X2hvwTy+b+LdONmzBzByTv0tAi1Lg:d6uJrDHtboHd7qw++2OAzmgh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458924, "uuid": "e5049937-30b7-415e-8199-8d11bf1c039b", "value": 4660698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458924, "uuid": "baa02bfc-9e74-4677-8111-657f9e6251e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458924, "uuid": "7831fb27-0f35-4d59-958e-a43fae9535e0", "value": "Blockchain.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b80762-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432630, "uuid": "c414ec1e-2ade-42e3-b14c-ef8f941b2022", "comment": "Malware payload (Mirai)", "value": "8781d80b5977dd28b4254b316fe84763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432630, "uuid": "15e806cd-c3fe-48b7-b399-b47c66bb8d4b", "comment": "Malware payload (Mirai)", "value": "03b0b8d26f130c7ca07c41e96f35616f0e968c981c283215d59fe9f8d0aa3a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432630, "uuid": "16a7e82d-2979-4257-a3da-63ce6d059170", "comment": "Malware payload (Mirai)", "value": "5f897a2cfd0d4d96c9b78cb2b4217fd9c43ea009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432630, "uuid": "01dcaaf9-02f4-420e-8391-9b545935d42c", "comment": "Malware payload (Mirai)", "value": "9a3a02787e72ee99d88bd7a9fb7d63b3df1147a647cf5d22a14735d1a2a8ac805ec5abe33af4404eff0509c18eed2ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432630, "uuid": "38e29940-309d-458b-bc84-4f9413100de4", "value": "T14823E849BD91CA56CAC55577BB0E42DC372603A8E2EE73039E14AF653A5F83B0E6B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432630, "uuid": "78f6b176-76df-4358-97d0-b2d20fd84a27", "value": "768:l2nhtrlBg6LID3W24mNmeHJBt6Q1nj3GoV0+4hu+7R:Yht5G6LK3W2AeFzdaq0/u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432630, "uuid": "6e65b950-266f-497c-953c-e9e3f0beb4c7", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432630, "uuid": "9a07917b-73ff-4ea4-8707-b048fb06adbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432630, "uuid": "f19315c3-67a2-4769-a881-4284150b2dea", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4451ec35-e8c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458581, "uuid": "cb647923-8d33-4d43-858e-3c74b2c489af", "comment": "Malware payload", "value": "c59b02868a11e84efa5c1804a6039d00", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458581, "uuid": "5e8735b7-673f-4209-b4b0-9a1ae3f209da", "comment": "Malware payload", "value": "03d862f0540db1d253d53116f23b98a98b98f21071e277a6ffe5cb8b8d87b619", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458581, "uuid": "7fbbafce-f3ba-47a9-8f33-a9a3749096e8", "comment": "Malware payload", "value": "97c033ac6d222d43761a0ec3a04e6dda708ba1f8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458581, "uuid": "32553fdc-9158-41b1-9e6e-028ecaab4353", "comment": "Malware payload", "value": "2b7d2d4c4a773b4dd7758ebcbb2a8755aa2be1f8448f5251d0f697340eb4cdc76a5c13d598d5c46810f6ce026cbd9067", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458581, "uuid": "8341de94-c7b2-4b82-8a91-719f026f152f", "value": "T1A471634B31A1723487434379866F6488323E8667250E6C18BCFDC2447F29B255BEB7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458581, "uuid": "38044ad8-6722-41a1-ac72-6d8015fa03c4", "value": "96:kNZwgCoWGNmyzrIvfiO0NNqZ8aHRALsyhiE:xcN250NN1aHugyhiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458581, "uuid": "573b5c18-0008-4cac-bb0b-19017aed5135", "value": 3759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458581, "uuid": "31075f4d-a003-4a29-82c5-ddb8d09790ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458581, "uuid": "ac0c0fca-2b95-4fd4-a981-10daa9ae9317", "value": "sm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb05bb4-e8f0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767478135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767478135, "uuid": "03b524b2-3f68-4816-b8d6-0796072b386c", "comment": "Malware payload", "value": "e709114b3c9b593f245f9168c998752d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767478135, "uuid": "fb975351-721b-49fe-bf72-71ecaa536831", "comment": "Malware payload", "value": "04537e704df71330b1e7f1a3147796a5d0277fbe6922a2a304a9a526cdbfe059", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767478135, "uuid": "10ffe638-7421-4afb-96d8-87c8354a0b6a", "comment": "Malware payload", "value": "3d08793eaac7c0feeba676bb1bf24f10e0159667", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767478135, "uuid": "5dcd904b-ddab-4155-80bd-989647bdf89a", "comment": "Malware payload", "value": "2e73cf4e04339f4d6ac0c3f3991aca1becf19dba35e48612c55b80e1b2ea23363ec828131d32d2af5d41757c5d667413", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767478135, "uuid": "417de983-fdcd-4b46-aee1-4667ac50d4fc", "value": "T14D33C6A167F9151AF6F38F783CB465958C7BBE726D61E08E8280204E0875B95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767478135, "uuid": "fdcbd101-bf8d-410f-ad0d-1687e87e129a", "value": "1ccbea0de62e6a608b49a8cef7342394", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767478135, "uuid": "dcc7de4e-3315-45aa-8af8-03393f70d000", "value": "768:q0MP/0vaXDiTLlGCI0App33UKph6koM6qsq:tPEiTLXA3HBp4koZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767478135, "uuid": "7c6a3343-17f9-4823-a153-ad43cbc4d03f", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767478135, "uuid": "ad7f7139-94e2-46c6-9b5f-077d326788f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767478135, "uuid": "52e6ced6-e07f-4386-8e41-351cb28ede84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f86098d-e8af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767450117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450117, "uuid": "3f483938-8105-42c7-a18e-09bfb01c8b99", "comment": "Malware payload", "value": "ac2b7683e783244b7f70263ac9f71d94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450117, "uuid": "7e426170-3326-4ff6-a48a-5872dd5878cd", "comment": "Malware payload", "value": "04e301d8642567d6e6280fe527a43ecee04c6c450074b33af550fda31e81d2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450117, "uuid": "c55f7a9d-4270-47f9-bd62-8a1cc728b388", "comment": "Malware payload", "value": "25356a07f89d68a4797f92894ccd2eba601a6ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450117, "uuid": "03cf8328-5fd2-47d2-b979-a2f2db8d1f04", "comment": "Malware payload", "value": "7e428fc7bb1e5927590f9fad3ab3b670a0c21d413807040d155cad868352c010da9ee6d80d941db4bef90c115cc43bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450117, "uuid": "c4278a48-b867-4e8b-b2fe-a9eb8c105521", "value": "T18418339A4FCC4447D6806FFA0FA86DA9D67C10CD5CC9BDF20B5FC3906A0AA1D1F9A605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450117, "uuid": "7eec6c22-1a55-46ac-87a5-f8ef02d9f79e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450117, "uuid": "887a0445-fcdc-49e9-881b-14d1baac18e0", "value": "1572864:Rl5YqPsDQQOgBgd9C31TM+YMIiwjIw+dSSnILYOJrLjZ6Z8l8Yla8PTKSl:RldPsDQzUa9qhoMIilx2Pwte7Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767450117, "uuid": "b59bd1f2-7710-43b3-8d5d-a1cd5cc8489f", "value": 87931672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767450117, "uuid": "8aa831af-2aa6-46c6-8b9a-e8eee07a89c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450117, "uuid": "338950de-b586-4049-8964-3269a1f095b5", "value": "PurrsCraftLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df1095c-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427297, "uuid": "f4255866-3c23-4343-a1f6-6cf296784b47", "comment": "Malware payload (Mirai)", "value": "d18a61a4f7a574d0a5f3d5b0bc9d2b6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427297, "uuid": "ed3eb6be-8855-4252-8ec0-1f4043d5b439", "comment": "Malware payload (Mirai)", "value": "0674d809a0ae7c9640b68a0e06649c7779ec2ec76745c858348629109e405c0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427297, "uuid": "27f7f00d-5c6b-45c6-9a4d-ed58f1f9b4bc", "comment": "Malware payload (Mirai)", "value": "43bebcd577a29d39541001338676de1f0c76100c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427297, "uuid": "0d3ea5c9-72b0-4fbc-b17e-befbd50ef147", "comment": "Malware payload (Mirai)", "value": "e4d7d7370bea81a483fa6640452357dab7621b8dbaad358f0d39b0db8ebc8a00020e7f2eb20fdf21a652cb851162b43d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427297, "uuid": "5786681a-e620-4640-b353-a8f5e3a150db", "value": "T1C634C64E6F228F7DF7A8873447B79E24975923D726E1D985D1BCC2101E2028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427297, "uuid": "646eb3b1-f112-473f-9de9-d63556d58756", "value": "6144:7v0U3/BVBY9v4EEV/58v510/Tg+LbfGksiQdZdF:TR5V9pLbmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427297, "uuid": "26890240-ca3f-4020-a62b-bdca90ed6427", "value": 252456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427297, "uuid": "ce3a397f-1d60-4670-a303-cf5fb8c60c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427297, "uuid": "d214e1dc-92ee-4f7a-905d-2e0c5f1e159e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667888d8-e83e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401515, "uuid": "94319da7-6ab8-44fd-b263-101b6a991a14", "comment": "Malware payload (Mirai)", "value": "a80aa7fe6d2dcf6e0fc060f58fdb5f34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401515, "uuid": "de239769-786e-477f-800e-d306c7184372", "comment": "Malware payload (Mirai)", "value": "0711944e0904582000fc93936884ce8e104f35e06d498741f9e87798e7cf6d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401515, "uuid": "22bdf75c-b62c-4cb8-94c5-00824af9f2e9", "comment": "Malware payload (Mirai)", "value": "6969b994d56e6efb40cf7bee5110afaa44ee2aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401515, "uuid": "2111a890-8b53-44ff-9a6d-31e980cf60fe", "comment": "Malware payload (Mirai)", "value": "96cdbb2e357be10b750aea30d4b367e1fe7efeda1eb78a50760be1588e82efedade63aa74a49a419b8542eca9f5b24fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401515, "uuid": "96f1c7b6-b09d-4d2f-9e24-368d7281b181", "value": "T13583B60A2E219F6DF76C863587778F31D798339226E4C245E1ACE9005D6034EA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401515, "uuid": "d75c48db-ee3c-47f4-b081-7bda4cc3f719", "value": "1536:eK7FLNondaAlZwOwkXEmxa+qGqpgfoa32ij43jlJ3jjQoi1/tquGcu+7RyiT:ekNUdAaavGBHwi1/Gcu+oiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401515, "uuid": "88cdca0b-7d7c-453f-a1ed-f742354a1a13", "value": 85848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401515, "uuid": "97906452-f5eb-46f5-b2b4-41a9a0f07db4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401515, "uuid": "bd8abe3f-f8b5-4007-aebf-ec6c4faf137a", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fd2b40-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429435, "uuid": "1c88fd46-3515-4a86-afd3-7a7d6582e0ee", "comment": "Malware payload (Mirai)", "value": "895fbbfa996126c70747d4cba1d31b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429435, "uuid": "a5717f3c-fc2c-43fe-b291-3531a23131b1", "comment": "Malware payload (Mirai)", "value": "078eb4abb868d194878e382b054bb0f500e2b68d58094e3ad2c61081f0c01ba7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429435, "uuid": "d41fcc28-44bc-4692-ad93-fe97eb0ffb54", "comment": "Malware payload (Mirai)", "value": "e8f78ac9da2ff06f20b95dc9c576869221c8868b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429435, "uuid": "f194a2df-3c2f-4cee-a489-8ea574b7c05f", "comment": "Malware payload (Mirai)", "value": "52d1a0ef7c15c57f46260e0a3cc026a7c5f2d35ba6963f8718d3907d3d1bc3550a604c3e843029af22043d7ef4249a7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429435, "uuid": "fe3ee1c1-89bd-43f6-ae2e-12a21ea64ed3", "value": "T10E23E849BD91CA56CAC55577BB0E42DC372603A8E2EE73039E14AF653A5F83B0E6B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429435, "uuid": "c2185d51-21b9-4206-a8e2-1f6715f26e5e", "value": "768:l2nhtrlBggLID3W24mNmeHJBt6Q1nj3GoV0+4hu+7R:Yht5GgLK3W2AeFzdaq0/u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429435, "uuid": "c6290cce-1955-4a70-9662-bfb6beb46494", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429435, "uuid": "5fc3960a-0c36-4bc6-b3d9-614ecc6e62be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429435, "uuid": "76554a25-6b23-4bd5-9376-aeba9262adf5", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10d5166-e879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767426980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767426980, "uuid": "3f3304c0-caa1-422c-aae2-c31e265a7218", "comment": "Malware payload (Mirai)", "value": "b3379f4720c6d6b6e482ee0b53b3d692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767426980, "uuid": "9807c3c8-708b-4c5a-a055-a1ce20a48493", "comment": "Malware payload (Mirai)", "value": "080946f8836a6f6569a57dc18361a3622c1f12dc3d78e2bf7dd81f4869a89cdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767426980, "uuid": "3366a197-fc5c-471a-8ecb-61c6d1bc4934", "comment": "Malware payload (Mirai)", "value": "437c19c9d4455b39991ccc4c4213e543be80db65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767426980, "uuid": "28aebaee-f829-4ea4-8492-daab223860ae", "comment": "Malware payload (Mirai)", "value": "a3acd2a73de488e8dba0759216b3129f93178fbf4acc755c23b649be33d3ccbc4c754d865520709f6172af11b724b2f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767426980, "uuid": "904af9e3-0bc3-4f8b-9642-749fdb6689fc", "value": "T1C182CF3061AB74E5DBF10431EAADCEC2975B0BF8D0FC369217586F78CA4650621F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767426980, "uuid": "3ac069e8-2f99-4ba9-84b4-9321bcb59d32", "value": "384:Mn6zRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMapYhymdGUop5h5lv:2SV0P6+kom0tVAoNvm+to1pYs3Uoznlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767426980, "uuid": "1e147cba-3e30-465b-9c71-0af0781ef5f8", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767426980, "uuid": "1647391f-6021-4092-8d7a-ef9bd0b40470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767426980, "uuid": "67ef62fb-3c6b-4321-954b-a4a3efa88097", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2e7e54-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767443077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443077, "uuid": "8d37932b-cb42-4d93-94d4-5b162ed2ae4c", "comment": "Malware payload", "value": "115ec22df04eeebf2da8907c4c42250f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443077, "uuid": "773fe929-d292-4906-a7a4-b46c92da9244", "comment": "Malware payload", "value": "08c372bc51c0f9df748bf2450edd68313f2649deb935d2bf0b8225e924d34117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443077, "uuid": "fe30bcfe-2425-4891-b665-c270b16f3ebf", "comment": "Malware payload", "value": "f20d226d8c96cb84065485c12fba1295e8414e46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443077, "uuid": "b690078e-c427-44db-b147-1e375b835662", "comment": "Malware payload", "value": "11b33582033f772a1ee3ef6119abe4ff94ede4757da947d16d15843b04c949415f5c457e2899822dc133b3ed35460672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443077, "uuid": "289436cf-79e3-42ee-a9c8-4a03e833dcb6", "value": "T1180723C75EE953ACC1924F30688113A939C0719FC5FB892E36CE5C06F561DA9C5CAA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443077, "uuid": "b6fec19b-9beb-4476-91ef-488b5f75547e", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443077, "uuid": "461bbadb-81f1-4d08-a7d5-ccb80f1ceb51", "value": "393216:8m5NNanOvdiDLZecuzY9H4AqQlNbpyp8FBu:8SpViD1Njh4R2NbBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443077, "uuid": "f0c475ca-13eb-42e2-bc0c-bca6f0aa4b74", "value": 17499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443077, "uuid": "9a42510c-6cb9-4e3e-98ef-3f6f6c89e237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443077, "uuid": "3c6bf05b-93db-49ab-8094-dee27bf7a983", "value": "NexonicLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1890e55e-e87c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767428013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428013, "uuid": "bb1f00c8-76d2-4249-9002-0fec62ec9812", "comment": "Malware payload", "value": "08a7327a80ee24239a2e76575881953c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428013, "uuid": "dfc4f1d6-0fbd-48bf-99ac-75ae00d313e2", "comment": "Malware payload", "value": "0963af95ab3f88f7e09f6ca10d3bbf1f06fd5cdcbcaff46903df55676b068fb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428013, "uuid": "2536b4a2-7e56-460d-a596-d069c1823220", "comment": "Malware payload", "value": "d4b3181d686be7efab7e3a0d317305ab33d90edb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428013, "uuid": "9062db45-1189-4983-81dd-711ae58e2cf6", "comment": "Malware payload", "value": "c3be4ef4395672d2c8cd694c1e23bd6096d8915277d5830981e356705cbb1f92625f913e970e9ed63dbca3598ac9164e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428013, "uuid": "2b1b9b87-cdf9-4a61-963b-dffaa4aff043", "value": "T11AF46C05EF890FDBC47FCD70492E838715EDCAD746D19334A0BC898CBA9E66A4AD3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428013, "uuid": "7a3a0a83-04c0-4879-9ffe-4b83baaeca45", "value": "12288:TrV78eD1TAH/oWviSXhIzdzLzcz3fl4KnHbq88uA3QeHy+7GdLLC1yW+sqec2G0K:iG+kLBY8drlyZSLKDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428013, "uuid": "c9792c97-32eb-4021-addc-3e5cf7e37a0a", "value": 729940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428013, "uuid": "6858133a-ec2e-4b40-bed6-854b4b6e91f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428013, "uuid": "96b1995a-b482-4444-8b72-ac6177841a28", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4199009-e8e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767473398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767473398, "uuid": "fb046cd1-f64a-4f41-9319-4f8c8542f601", "comment": "Malware payload", "value": "68ce4422c9ed0dfda38c55f3b3e46cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767473398, "uuid": "59bf2711-62a1-404d-b7ff-6a9f87024b7e", "comment": "Malware payload", "value": "09c24a939df3bc99632532bfac7573fda9f60c3b4229256d56614b89051a865c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767473398, "uuid": "594c2411-d543-4b66-aefd-8d67794cf5dc", "comment": "Malware payload", "value": "1518ee013bf99bdbd6224e2c2578ea7442bdf0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767473398, "uuid": "f8c2f7f5-7f61-42d5-9f6d-8609703e37ed", "comment": "Malware payload", "value": "f9dacc976a7fbf110f022cde1799695ac9bfcc125401a6b7b440cd392670b08cd1d9078f829543f73f49d5d319498785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767473398, "uuid": "fd521c81-53af-496d-9a79-bebdd4f29aa4", "value": "T1E32833D6B2B7DB75CD5B1A3D7474284B83294B4E6A5388C34BD622FB4CF2B205F58821", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767473398, "uuid": "f2cdd1d2-f017-4d84-a9a9-2372161c2453", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767473398, "uuid": "ee4bc06c-f9cd-440c-a44a-3406eda28761", "value": "1572864:fHYxcnyo0h4a01+/9pWbFKT4fL0PHWDyPICnw81Wjo0V2Rg/8K:fAUyo0hZ0wrWRKkQP2D8/nw4ooo2e/8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767473398, "uuid": "2a5799a8-a4f6-416c-b4d1-1063bc42da2b", "value": 93562217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767473398, "uuid": "0cb3b6ca-46ab-4634-9793-2b2d89203e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767473398, "uuid": "a07a9914-3f02-482c-a3d6-fc7a7ceeed06", "value": "Velroyth Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceee114-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400828, "uuid": "e02be2eb-6ebe-414d-9ae7-5636bb06c655", "comment": "Malware payload (Mirai)", "value": "1673691f616235292e8e68af70c748ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400828, "uuid": "90e978d4-7f7c-4096-a454-cee3000fb21b", "comment": "Malware payload (Mirai)", "value": "09dc41e61addf7c02e167efe3b4c9b570c71feea318666fe0c7b8eb71468299f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400828, "uuid": "9c21906b-b9d3-49b6-a783-108ff8dd9ac7", "comment": "Malware payload (Mirai)", "value": "5c81f292c259de6513ec3fea71139ce8c80645ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400828, "uuid": "921788c2-da1a-4aa5-9bcc-0b8c12f7962b", "comment": "Malware payload (Mirai)", "value": "bd7f04a09b51810f677a10ed7dfafc371a204629609813cfbf4265b42aa3c089ec8c323d58c12db24aa2b174550c6598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400828, "uuid": "35cafc51-e532-4b2a-baff-9e7cecc313d0", "value": "T14DF34B81F98BC4F6D8078D30506BF73FCA31A4398077CA5DEF999F36CA635819616298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400828, "uuid": "2e225ff1-7cc2-4adb-8375-182198d2f5dd", "value": "3072:DxM4gM0X5BFzk9rmZGw6iJ/KA30FTV/LXBmZ5qHvFCI+xhBmX:DgLXjFzArmZX6iJ/KcIxkDnIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400828, "uuid": "cdb6a5a3-8457-49ae-9005-93a49ac310f5", "value": 159176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400828, "uuid": "0214e02f-c221-45b7-8eea-be542fb840fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400828, "uuid": "1d8b4147-c473-4aa2-91cc-682b92a4a3da", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5c61dd-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454007, "uuid": "078d282d-926a-42ea-9bf1-566819f5e305", "comment": "Malware payload", "value": "eb39ee02ed87c227e5cedcd75f6e4e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454007, "uuid": "2c113f14-f4e4-4735-be70-8a3e246c8605", "comment": "Malware payload", "value": "0b439debd24d965d005b155b7573788de5dfb9677c956a91db53649b4906749a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454007, "uuid": "0ccd8b38-9798-4e52-8124-e3105c58fa71", "comment": "Malware payload", "value": "b17aa221f189330e68e41c378e492e40b1c43ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454007, "uuid": "67a0ffeb-1b69-4595-80c5-650aff9d7a0e", "comment": "Malware payload", "value": "b19af23c22d80df4c5bb7e42e212bf3c9561570e24a9a82c1abcddea7c42a9b318beb068765835ef1072f65574fa7376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454007, "uuid": "0396ef9f-b9fe-41e3-b2ac-c4e418b6fd44", "value": "T1262833A74D1A4C13D8D2F979A3C097FA4B436A1BD8C359938AD39C10BF5681ADBD0DC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454007, "uuid": "941f3a9e-f759-4a54-a0f2-632a12f8894c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454007, "uuid": "64ac13de-844d-4ee1-bdfb-253c15277ec1", "value": "1572864:8ZTczLHc8vUAwU1C1YumGLKpe1R6Q7yK98CuZEHPDTLKGSplDiSyAwOu+Cxg89LZ:8ZwvvoKrumGL3WsyK9kEv/LKPXDGAz9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454007, "uuid": "feedb936-a81d-49c3-be09-6de557a3327e", "value": 97446133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454007, "uuid": "9469193c-14e8-4c14-9c1f-69b2aaca6ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454007, "uuid": "89e58e29-906d-4ebe-849a-023ded1c6b18", "value": "v2discordid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f4b8c9-e87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428304, "uuid": "32bf41ae-a207-4a50-b6d7-4fe5e3d261c5", "comment": "Malware payload (Mirai)", "value": "30a87e97c6fc356ffaf913bec4ff7146", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428304, "uuid": "51bef070-dc07-4786-a9f4-23eb9ae5ea42", "comment": "Malware payload (Mirai)", "value": "0b785b0251f1926970f60d9979d5d51242b2e0b5f9f624e3d4ad23d98a31ad8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428304, "uuid": "b2b3fb7b-5918-4468-8ab5-ba128a930fb2", "comment": "Malware payload (Mirai)", "value": "1cf9e5df958d61e6be328404b01f8e545b001bcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428304, "uuid": "bc972bc5-09de-4140-b4c7-2bc9c3e18ded", "comment": "Malware payload (Mirai)", "value": "975ec939efe579b22bc991fdf1291a202f95d00ab05847bc7bdb16cac84924f4107f4b06aff17667827ca2674239275d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428304, "uuid": "83a3dee3-e558-4882-b42c-c0199042b81c", "value": "T157234B21BEBA5C1BC4C5653A61E38235B5F6470A71B8CA2F7E320E9CFF50650234B979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428304, "uuid": "d114c772-72f8-4caf-9d84-b9f900f6cb56", "value": "768:SrxZeFsm+3MxaHzdIjtlwp75AKvrD/YOFO+FeUO/E1e+chMI:8xZemm+FzdIjLw5vrD/99O/Ke+chF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428304, "uuid": "75f26f1d-e7b8-4d55-aac1-39e4c59cdb39", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428304, "uuid": "a25d5cb1-eb0e-43ff-a2ba-78f4bb4e2b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428304, "uuid": "319dd009-f96a-431c-afed-a2fe387d9142", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1780959-e89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442523, "uuid": "d11c29f1-3540-4774-b977-827857352a9f", "comment": "Malware payload (Mirai)", "value": "27d743e5765996f7d7d92cceb43a9777", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442523, "uuid": "cf78bddd-ba16-4a33-b629-282d29fab49b", "comment": "Malware payload (Mirai)", "value": "0bd4d4f583a42bcdc6ac7c4f444460b831fd9f666784913dd9ce214f70101b85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442523, "uuid": "9cf98e5e-e7c5-4714-9963-4920a3615510", "comment": "Malware payload (Mirai)", "value": "ec1de0f360d81589927f87168bb3d6685a5417df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442523, "uuid": "45c44ba2-ecc1-47d5-827f-e9254151ae55", "comment": "Malware payload (Mirai)", "value": "ddb9d28acfdf396eda62b7996c015d796e9c1108e6332888b85fdf92766f4e79f9b5d508300df00f29b9a0ce3cdca96e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442523, "uuid": "a77c78e2-0c0f-4d82-8432-f77d53319579", "value": "T1BBC3294AEB418B03C0D22775BBDB82553323DB6497AB63065928BFF43F827DA4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442523, "uuid": "d06b3778-53c9-43d2-a559-f3d63a31d383", "value": "3072:DSD/6ZMLaFQQwgAUXyJrwo6ppjmf7UM/9Q/C:DSDFLaFQQw0XyJQHjmfAM/9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442523, "uuid": "c3d4a836-c75e-48c4-8b65-89ffe9f0fa76", "value": 121392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442523, "uuid": "a00aad40-5bb5-4e5c-a644-d7afaced3057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442523, "uuid": "74d8427e-5cb4-4c41-b7b0-d4f2a5d6f69b", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd8af61-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463561, "uuid": "16564b29-3ea7-4c23-aaa6-5b7f679bdac1", "comment": "Malware payload (Mirai)", "value": "77f1fb60cda9fa152a48db9b19e494f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463561, "uuid": "4ed581c4-6bcc-4010-936c-5d36f534edb5", "comment": "Malware payload (Mirai)", "value": "0bfe090a22b6fd164c21d19dc7ca87ea2db3e6537b158a8618b9ec525f1fd2d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463561, "uuid": "8b5d6299-e20a-47b1-bcdf-68cda318855b", "comment": "Malware payload (Mirai)", "value": "5d7232503418ae58c7f454e62b3998ad293095b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463561, "uuid": "e67a4d91-a749-4800-8c96-6b66b04423fc", "comment": "Malware payload (Mirai)", "value": "ff98ca6ade92e13967c8f4939b79121657ce55bb14c7e56c86f9a558347ba08719a215f1645493b349489165c8028fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463561, "uuid": "18350fbb-cd87-4c83-8eb0-9db3e8672937", "value": "T172656B05F9409A6BC53761B4918FD371C9306A3847238B8BBF8D6D347A2B3D1AF28756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463561, "uuid": "c12819b6-26ab-42f5-a1b9-fa0664e9336a", "value": "24576:uRjouDcSyao+8OoNTp/zmUWF/UX4zfftpDx3wadrqmQn652+Oa0JL:65cSyl+8OyTpDUcozntpDuad+t8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463561, "uuid": "d5a4f1cf-d5ba-4b56-9b37-e5fd469fa66e", "value": 1444352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463561, "uuid": "d12e14a2-07bc-4e43-a55f-65a88933a873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463561, "uuid": "367cc84d-a6a2-47e7-9e35-d21d894d7ce3", "value": "V74zKV4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128dc868-e8b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767452914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767452914, "uuid": "3ec57861-28a0-4015-8fae-9ae355e21236", "comment": "Malware payload", "value": "df920f10a94c4969e8b1b54fdd301d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767452914, "uuid": "e9b6ad99-b9b2-4e84-a3e8-d708bbf5e582", "comment": "Malware payload", "value": "0c780c135105186cb27e93bdf0672203c49bda4c88d9c3f4759383a3918eb883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767452914, "uuid": "f964fb7c-5119-48ad-b78b-ff38cf2d7b3f", "comment": "Malware payload", "value": "44740d1fbae242e1cd7f14e8bdef2290f9514d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767452914, "uuid": "ca3e4f2c-8284-45af-98fd-07d7c8e5cb4d", "comment": "Malware payload", "value": "b145ad11d6a91bc6378bc825c40cc1d17e965f69bee47f9451ca9d0fe655969fd73a8f9977b224126c59c90ed15a64a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767452914, "uuid": "798514d4-0346-47a1-976f-26d924d93bae", "value": "T163F5DF06F39282ACC166E5348E6EE327F632BC540B3193DB73D95D254E976E04E7AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767452914, "uuid": "879f77c5-c423-4c46-929f-8a731f7f0ae2", "value": "5512eb3f3c310bf19f2ce2cd8cf5b569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767452914, "uuid": "600ef852-636a-4712-9d35-e3732586767a", "value": "49152:ZpiZEsYY/s0Uy23G5g+i8MeWXusAE5FC+:ZpiD2Wc8MhXFFC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767452914, "uuid": "a9323edb-0a86-43e4-8369-b17975d00f34", "value": 3566592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767452914, "uuid": "dd453713-2818-44cb-81a1-364507ae5462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767452914, "uuid": "3d74dd57-3628-4782-aeb2-610b30520172", "value": "Yerba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3bfff6-e8a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767446732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446732, "uuid": "4c717564-5766-4277-afd6-267bee4bb1fa", "comment": "Malware payload", "value": "b1a031ea42ce7c7d3afc496f862cd155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446732, "uuid": "e19da786-2a96-44b8-95a0-4fb985f8876f", "comment": "Malware payload", "value": "0e8f0fa023b588637fb33b951933a20d94ccb8a98f0e684fca92e07f216d87c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446732, "uuid": "f458c2b3-315c-4973-899d-98bfc4385b7f", "comment": "Malware payload", "value": "92bd064212033d96c4453857e5dc78d5974850c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446732, "uuid": "15d5f924-f225-4c91-bd0d-3a496d1b59a2", "comment": "Malware payload", "value": "2c44ac404ee9a486b0998d7a7483980a8029cd62a8fa3b79c26009e87b0ab62241e5edaa9b2b4b2cec9e715f9ff4b7de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446732, "uuid": "7d0823db-b1e6-4727-8397-105269c7e119", "value": "T1C6523B0AF3DCAA62E5AE42341832031A73B1E16A9825D75E5CC840AD6F3738C17937F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446732, "uuid": "2931f701-3c32-4434-9c13-b6cf96794b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446732, "uuid": "8a060db6-e0e2-4aca-bab2-b00ca9880150", "value": "384:i/VKFY/GpC99FCHxRWmZa6m2a2CfOaM8xKVheWGh:i/VSY+4RCRC6mGC3xKvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446732, "uuid": "fe77704f-7795-45a8-a8b9-7bac2243dc85", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446732, "uuid": "351be161-f73b-4b98-99da-0b2c4baa03b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446732, "uuid": "f4966c47-433a-4002-b089-af9e5c916bd8", "value": "Exclusion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c3e952-e880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430107, "uuid": "ffb9cacb-75f6-4bba-b7ae-c35804a7af8e", "comment": "Malware payload (Mirai)", "value": "50c28a5d95f7aece01c92e3e8333f76d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430107, "uuid": "ccd34b09-955c-4088-9905-fb920dc7c1b3", "comment": "Malware payload (Mirai)", "value": "0e9327bd9fd8ccbdc99b0ceca12c5d2fb58c6d20c50292fefcff9e8d917c60c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430107, "uuid": "49bbd7c5-453c-4046-b3b6-d2e38f0cfeec", "comment": "Malware payload (Mirai)", "value": "7499780fd857a67a2de302ce35d1c027026f2af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430107, "uuid": "6dd6e503-edae-4801-9db9-2cd748882c43", "comment": "Malware payload (Mirai)", "value": "dc0c414fe762463cf240d400aa7232d801aac1c7626cda27786c79442c0221939d58ec8e5c863c289e71823d0e52ee90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430107, "uuid": "0ba491cb-62f3-4f37-8e97-c68079c9cb49", "value": "T16C635C22797D6D1BD4C4B47A11F74339B1F2270A26A8C61E7E720E8EFF207502257AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430107, "uuid": "8bce1d4a-ea6a-406b-b754-e035c907d57d", "value": "1536:1ajLSCNTCq1Pjs408VZeYuBBy+6X74Q3VFouhiHge+chNg:8juCLhjXReBXdyiAe+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430107, "uuid": "05c0d124-4874-4850-b5b9-903341be7e53", "value": 69792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430107, "uuid": "36465cbb-a1c6-4713-9021-177201d64a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430107, "uuid": "8cea4603-d011-4818-87c7-9e9464eb1d2f", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a947fc5-e8a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767447532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447532, "uuid": "86d3daf5-8018-4d72-a1c5-fe47206a9f56", "comment": "Malware payload", "value": "71f691c865aaa11eda09820014e84792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447532, "uuid": "c77d2be6-7829-423f-8581-c1daf160475b", "comment": "Malware payload", "value": "0eb9d0a834a035a07eb0186aea5ec51e38d0485e6e3033d9977f6b73c48ba549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447532, "uuid": "b1be68a5-db4c-4f2b-a2a9-1f9806b6f0b7", "comment": "Malware payload", "value": "07b029773ac03022238c9d1a7623714083cda2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447532, "uuid": "c65af440-94fa-487a-9831-987688b805f8", "comment": "Malware payload", "value": "67baef4420a263eca0f444454b75d7821bb5bebf7103defabdc644fe3d8da39c97ef549a5c7119a82ac522f44028db1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447532, "uuid": "89fbc61a-84d4-4d1f-99d7-3541374c7723", "value": "T1E5F46C63BB218FE4E365D67005F38A156AA512A206F754C193BDC6207B50B6E2C1FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447532, "uuid": "88790050-fa5b-404b-9c9b-cd591015d34b", "value": "12288:hL0P/0UYnxmXBKf2tXzSdsYpEhgpZlZxk64t:hdU2sXlXzSfGcfkbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767447532, "uuid": "7e79b5a7-b916-400d-bda5-1da3bfcdc02f", "value": 729940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767447532, "uuid": "f8151620-a924-4b88-9949-9fd36066b00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447532, "uuid": "89d0f7ae-62a8-476d-85af-d91ae8c375b3", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aedfb80-e87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428178, "uuid": "4fcc7bfb-6c78-489b-88a0-0edff2268903", "comment": "Malware payload (Mirai)", "value": "8e5fc99fad4304a886c5fa2ced34aa99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428178, "uuid": "b59ebbce-c3d5-4823-9b57-ae3a37402153", "comment": "Malware payload (Mirai)", "value": "0ee20b6d5929f3bf5d99f30ca9905ee0d41f15ca1d3ae4bac126933755e3b828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428178, "uuid": "c9c0555d-9e17-43cb-94e5-4194f452711b", "comment": "Malware payload (Mirai)", "value": "a496e8681ad339d6d6816810e62605e5a13f98f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428178, "uuid": "f3c9137f-92c4-40be-8bf4-d3f4a424d051", "comment": "Malware payload (Mirai)", "value": "0cba5d19bbdec67799b96f0fd6967ac4331f78d099b39d4c03f9b93de7f1e1b401fabb1c813211a54c7073dcbfbf567a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428178, "uuid": "598cebb3-451e-418a-9d99-1763e2d28e3b", "value": "T1ED430945B8918B25C5E412BEFE2E118D33276778E3DFB222DD101F14778A92B0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428178, "uuid": "20360def-4388-4877-8457-5e64117d9608", "value": "1536:ENnm0x+ihiO2bBlkUsPsd2d2sePnIcisrNCXatu:odh2OjPi2dUrNCXatu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428178, "uuid": "bec1a8a9-232b-4ed5-ae4b-483f7bbee155", "value": 59940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428178, "uuid": "42b70e4e-65b6-4124-a777-b939f7a14f98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428178, "uuid": "43242396-7b85-4532-997b-cb9efb0027b3", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e278f9-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468703, "uuid": "df8b3d9c-656f-4f67-b4ca-3804ab991a08", "comment": "Malware payload (Mirai)", "value": "e0e6b6ab57532eee48821940f40d9d43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468703, "uuid": "ed09e62f-d976-4d6e-a2f1-3be33c8cc5ef", "comment": "Malware payload (Mirai)", "value": "0f600ee4ea2c2fc3f60769456cc29d9fc63771456e17640e01d474bb33598d81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468703, "uuid": "1617d69d-b3ed-42ec-83de-a49eea63d9e8", "comment": "Malware payload (Mirai)", "value": "a4661e73f4ad35d23b233e11e43c7603a5d8b90d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468703, "uuid": "13e4cc6b-6093-48d9-b6a0-ba3be9306b12", "comment": "Malware payload (Mirai)", "value": "4f573b9c5fb6d58a0b50f8107306c0b7cf2ea2b685ab5d72cffe649a75e1c25ee45bc4307e5dbce36482e9b0dff2a700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468703, "uuid": "b49ba31d-f544-4326-9b91-58ea907318a7", "value": "T113B2C055060189CED9FAD0FC0BB02B645EF44A4B52C7EC897857EA874FC80BC29D2AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468703, "uuid": "2d36b536-9c7d-46e4-90e0-cd5906c507b4", "value": "384:LQz7MnI4Bzz2dV86ZIR7ZLVxTipS6quDg+Xkyt4zBZEh6OQkMdi6LJgGlzDpH7uL:LQ3MnI4BzzRY+jNu0+vt47Eh6SM7LJgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468703, "uuid": "dc0a313b-4efa-4b17-880a-5be202e9081e", "value": 23924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468703, "uuid": "78abd0ab-f99b-4103-937b-5e4c3abeff64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468703, "uuid": "539e2346-a1a5-4400-addf-74cb711fa4a7", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83348587-e8d5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767466417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466417, "uuid": "daee496c-2736-4049-99e5-a6ea68e31fa0", "comment": "Malware payload", "value": "c1a887c21ad097094bb6ab9d07cbd97a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466417, "uuid": "e9c154a8-f597-44af-8146-85c37abc78ef", "comment": "Malware payload", "value": "0f94814bacd230092d58c018b43bf6048db388623fbfccd4f8efcad131e2526d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466417, "uuid": "b1b01ce9-6d39-4770-a7e8-e953cfc5295b", "comment": "Malware payload", "value": "3046e99d33ed279a8be30d6c0d04ada74ed05032", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466417, "uuid": "ad23f1a2-76db-4c63-a3cd-bb0a8d907be5", "comment": "Malware payload", "value": "a74dde8324f9c8655cfbb3f95281057bfd3107d341e56dc14a16f7dade232d169ee3b86331ccf5baa37643863c51aa55", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466417, "uuid": "83460fc3-adac-4607-ae51-132a07768557", "value": "T1DB51AE4430D3C2250EF98C62891704AFE98EE08F4605E97DF603C1685F7A94745FA5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466417, "uuid": "0e1fef9c-4ddb-47d4-8e02-b3296ffb6c93", "value": "48:pjbbq4pnI8BnS3TQ2c18qg7TF2nuc2VKjt2w7T+XT:Fbq45I8hS08qgDwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767466417, "uuid": "9f42655d-c166-4cc5-9a27-fc7dce5714c1", "value": 2618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767466417, "uuid": "ef3381ea-02d7-4949-a0a0-04d5f7b1dd4a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466417, "uuid": "ff0b0898-7822-4bdb-956f-11aea7cc8c0f", "value": "spoof perm.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07932a2c-e891-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767437004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437004, "uuid": "2494fef0-9d91-4c30-9c13-f95873fd6579", "comment": "Malware payload", "value": "8841e060b748160676020d611430f68f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437004, "uuid": "a54d6009-62f8-42b0-abfe-df08d094c51a", "comment": "Malware payload", "value": "0fc730e22a7240482d1a9a1570b5fd51932ff7368e91a40952cea617fbd02d2b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437004, "uuid": "799771a7-bfc2-4263-bba3-a80d4da2219f", "comment": "Malware payload", "value": "fc91bde258a8a251c3d1f459e6f15e7c2cb7e319", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437004, "uuid": "dc9968da-8aa3-4c30-a452-8bf9d27e23aa", "comment": "Malware payload", "value": "517580e5bdc9c6154c76cbda827c6fa1d373063d5bb29bf722dcb347a92175e1a3befb530cc12700191aed810270fe81", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437004, "uuid": "b72fdb69-45f0-407d-9062-aa10ca35d270", "value": "T1D9C62366D5DAA2E8C0C34B4066CB52DA30D1B65E85FE5D2D3ACB2C037120D5F568ABF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437004, "uuid": "bb851751-319d-4047-8db8-4ef5b7801e82", "value": "b544070d00013e564a6e7901399d1921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437004, "uuid": "58d33815-4551-490b-b4e1-b5e6be834acf", "value": "196608:WGLsOeNTxufMRd+v/wb3t43WoI4C7I2N8jphR8v8/c7Xjrb5NyayFNq58PihRDs:WRFufhIY3TCk4Up8jPOU86R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767437004, "uuid": "64cf192e-9305-48f1-b244-748020487176", "value": 11556864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767437004, "uuid": "7b9d3b57-fcf6-4835-81b5-f973c71e6ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437004, "uuid": "4d9be1b1-5f33-4f36-9458-c74b4530b08a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa8cdce-e897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767439828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439828, "uuid": "9d00ed1b-ca35-470d-a592-a86abc52b8e7", "comment": "Malware payload (Mirai)", "value": "af962d24fe15be2143aff5c9efd8a63d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439828, "uuid": "c443ec27-e0ea-416f-be30-b2d529eed55a", "comment": "Malware payload (Mirai)", "value": "1043e9a7d8e3032582aa39800b3910a8bdff717f6f40729a464c3f9b971b4be3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439828, "uuid": "aba59d55-24b2-40f7-8b8b-3bfdbf11b4b1", "comment": "Malware payload (Mirai)", "value": "0096c536a59ea73ebc4a37953477e6f2642ef3ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439828, "uuid": "9d3a4de4-3ba2-4e12-8285-0fd1d9fa27c2", "comment": "Malware payload (Mirai)", "value": "f9d4fb8f12bdd54516c22e112e8c77b4fdb0df0d33df414f0be0b4218788c0bde9bca89d6f8164ec1de8aa7589f5ff35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439828, "uuid": "f2a13eb4-2e61-4f59-b248-c29f48c1b096", "value": "T1A263025C94E74C36C675C0B2EE6AD80363AEBDB025AF312105745E3F96D00972B3CA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439828, "uuid": "a68c56bd-bdc8-446d-822f-b23a5d377cbb", "value": "1536:qR1gicHpCVz5AN2YFWyJuAZwvYIaCYc57vP4zop9wLlRGzA:qR1gBQVzSDJrdC7vwzsQlRGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767439828, "uuid": "04951f45-2501-4a2a-949c-ebfb62a29f98", "value": 71628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767439828, "uuid": "caeb2229-f305-4cd5-ad64-c19e27a06556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439828, "uuid": "51cbdc20-6c42-498d-9811-ef35ef7eded4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1deffa0-e8b0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767450577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450577, "uuid": "e246690f-78bf-47ff-a659-c02c250a6aef", "comment": "Malware payload", "value": "96d25d647d6cd58dd50f302b6c9338a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450577, "uuid": "59023271-bae9-48ef-8025-f3d49c027125", "comment": "Malware payload", "value": "10831eaa36ee138523e0e45ca4078ca8481b8a51e89304efd626d142a6c7dd1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450577, "uuid": "a4eb990f-763b-4a7e-bb5c-bb4bb7a41c9a", "comment": "Malware payload", "value": "f1bc3b8cf7c5c0c0c7f9328340ba77d6eb2de9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450577, "uuid": "edf95e10-6f5a-4fa9-bc25-c50db86a4f5c", "comment": "Malware payload", "value": "cb1e7b25b684159997dcfb70764b67b57d53479a5795e67c47f0c4ec00b29e8e2792f70f35faefa94297f0f3da517957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450577, "uuid": "e98ed7e3-b537-4f78-b480-24e77df7abfc", "value": "T17C0833534FF1D1D1E9A0DEFE14968A96E14AAB402AF00D6FEF4C54D8B4E046E852CBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450577, "uuid": "545236a0-f01b-414a-88eb-55252552d52c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450577, "uuid": "f3ed2bbc-d0ef-4ec0-9b84-d563cf6b737b", "value": "1572864:Rt9IKPfYG0NzRWYaI7ob8WmPmvhxiXY0EywdQ+9bNKhFIy2MNiyT2Jc1Ou:RUKXaVRWt2oXeI0E/QkNKvy82a1Ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767450577, "uuid": "60582d79-faf2-4a4d-a07b-79fe30ff1f76", "value": 83001072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767450577, "uuid": "0829187f-9755-4c7c-b1ee-49457d22f36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450577, "uuid": "37160768-6a93-470b-9500-9b81a16d08ca", "value": "RPRplaySextapeleak2025exclusifs_sextapeMYMleaks2025.mp4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8544bc35-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767444087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444087, "uuid": "83c6607e-2305-4aae-ae3d-9a5c43976b78", "comment": "Malware payload (SalatStealer)", "value": "544c7aa1c9b334c6fe02ad2f2a092594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444087, "uuid": "6cc04ad3-11ab-4ca0-8c59-908d63e9bf9c", "comment": "Malware payload (SalatStealer)", "value": "11c744d25f64294e6640a97adb1d6ad54051b6af7dbc91b23292949bf46b289a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444087, "uuid": "d0c16577-b9e8-46ec-8f12-b2540778a841", "comment": "Malware payload (SalatStealer)", "value": "b775dacc3fe8037c56530a9a6fb6edecac79a630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444087, "uuid": "9c1cd951-11d0-43a6-9e3e-9cf589303e42", "comment": "Malware payload (SalatStealer)", "value": "e0a9a19fbb7291ac29f498c9e4a3af049429da227d5ac19001b2274dc20c829d2a33f34e835dc19fe4f844c9a5871ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444087, "uuid": "fbe4e09a-4822-4217-9e8f-27032acff037", "value": "T167C65A51FA8B54F6E9071831805BB23F63305E048B28DBDBFB547B6EFC77681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444087, "uuid": "6cab00aa-abfc-48b5-9408-fc3fe7e3f2d9", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444087, "uuid": "01252fa5-0ca8-4c57-869c-03cf6d3763e2", "value": "49152:tcOvUwQ6nkSFFIfgZr7vAsA9C9Ef5Bz68AkrYytoIfetcZLMmCFNnrSIGx6rGvBh:qiUCNXZ3x43FMmYPn06rhCl81j/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444087, "uuid": "87a8bcb8-f761-4572-968e-524ec0667b36", "value": 11657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444087, "uuid": "12ad5723-9183-4830-821f-74ea1e6e7daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444087, "uuid": "04a90d2e-824c-4c27-9b52-6eab8e9ce7d3", "value": "Matrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b782da-e8e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767472382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472382, "uuid": "a7327cbe-77db-45d5-a742-17b2637f631a", "comment": "Malware payload", "value": "4a303797be825d3dc371234cb91eda5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472382, "uuid": "5adf7832-1e54-43f6-a532-97f4c208f2aa", "comment": "Malware payload", "value": "12e9e813390d6f0f78ad1f45de733fe7c2b27349f4041d3a63e7e9def96bdc04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472382, "uuid": "6908d918-55c7-4afd-9a1a-45b94efe98f3", "comment": "Malware payload", "value": "50bc299042cd3f1513259cc8eb67048362598348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472382, "uuid": "d721367b-6e09-4f34-89d0-0835bad69f4f", "comment": "Malware payload", "value": "749c4b568f74fddc178540650e293b7b1dae9b15da74d8942f9e6110b69baf5ed22b7741dfba7d5c8d5893f566b67ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472382, "uuid": "73490e50-2ce4-496f-9da5-7003457030f7", "value": "T1FD086B4262EA04C4F9F7DA759AE66617C673BC122F30D5CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472382, "uuid": "003f7638-df94-4238-8a3a-e65d40497b7f", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472382, "uuid": "7c2714a5-7506-4180-a42e-c9c1546e5673", "value": "393216:pkmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNt:p5NmdsJY62A0y8Xy5rs3wbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767472382, "uuid": "15fc56c3-1a56-4a61-96f4-a540531c704c", "value": 81952681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767472382, "uuid": "ae7f2a85-d688-44d3-b133-987d1b2c0e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472382, "uuid": "4a7b89f6-7ade-46a3-af91-ee32b32f18e1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd51684e-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444288, "uuid": "89f4ae38-b44b-479b-ad15-1890ba78c3e4", "comment": "Malware payload (Mirai)", "value": "3a5b58292b306bc75686b826ac39aa61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444288, "uuid": "71985f7a-9c65-41c3-ba9a-da5fbbf0abac", "comment": "Malware payload (Mirai)", "value": "12fa3c0f920700d09bf7112c6aa99dbede847039a430da367414b100729d25bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444288, "uuid": "0f03b26d-e25c-4032-b0ab-092f8e6db281", "comment": "Malware payload (Mirai)", "value": "e6f64b21afcec75eda2df5a7f5dc65e7cf6beebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444288, "uuid": "a4abae50-0379-4698-a95a-ac1fd1b1354b", "comment": "Malware payload (Mirai)", "value": "7da50bb15e2607cfa02ebecf10ffc9da6b56ba289c7cdc12e5ae9e482f24d891311b2af3782e3fce1117cf6e39833042", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444288, "uuid": "e4807c11-5a14-4720-a728-0ba68af16725", "value": "T1DB531945BC91D626CAD462BBFA1E42CC332653E8E1DE7207CD11AF157B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444288, "uuid": "29eac74c-02ca-439d-a5a2-28f61a83a62b", "value": "768:ihVXTCbJsk+BL0Xs5tDVI/KPHsLBHzAUxwRA/dh07zK9mNdxkBBiEo69iogu+7R:0XTqJetDG/KaBH0mOyhG2wxNcIu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444288, "uuid": "d0eca64b-d074-4f14-b555-05c7008f02f8", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444288, "uuid": "8422a191-a1b5-4026-a285-2af2be450538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444288, "uuid": "f512ad0f-006c-4e5b-bb71-daf67ce1ede3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1664981-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767465260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465260, "uuid": "66594b86-52c2-4d2c-a1ab-f3e5c22637dd", "comment": "Malware payload", "value": "a780276638a8882ab1168c1c9ad080d2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465260, "uuid": "538ceb85-79ca-4599-a10b-f2bdc2c100e0", "comment": "Malware payload", "value": "1398ab0ea8638cabe463d70a0f9c9ac2497bef20e1418ddeb638aa8589cadb4b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465260, "uuid": "584d5d10-5f6a-45d9-8297-888a6e307ba5", "comment": "Malware payload", "value": "62bccb364e1af498e72d522d7ab569a405992f9b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465260, "uuid": "64ac652c-6a56-4213-b406-2254e67b0411", "comment": "Malware payload", "value": "c1a96073b18c813793810a7c5b09ff70b77b29bff6c38bb64a0925aa00cb10ad0a421ed05a37b02761304d04ce8ce1e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465260, "uuid": "19d336e0-5868-4e16-82ba-f365c2e9e0dd", "value": "T19065124267F8C962F9F61F7058FA9EC31A3ABCA11C20935F9A61515EA872740ED30377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465260, "uuid": "210dc910-8098-41da-9060-159750a00d8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465260, "uuid": "0a6c604f-d4b6-4a2a-96bc-9809b791769c", "value": "24576:8iZfkvmrIKx1rUHZXJ9FePZhlPSk6yqCLbpaQj1LcGKUrfcewt/:+olAHrWRUmagJKSfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465260, "uuid": "fd4fa552-f34f-46cc-a28e-7173ddaf5e62", "value": 1502760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465260, "uuid": "91772f78-bfa4-49b1-9729-da6486f1b572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465260, "uuid": "5af92152-cd84-4e97-9f29-8b5e10d2d313", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13b4106-e8df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767470870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470870, "uuid": "96db43ef-ae9c-46a2-9e38-ab8364304bcd", "comment": "Malware payload", "value": "6b4a2b9951951a47522a1feda779b46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470870, "uuid": "5e62f275-495b-4221-9c35-1ae024303bb3", "comment": "Malware payload", "value": "13c85dc6b229fb36efac0f933cd05f6286394aa6f7126677572bcd68fb4e1733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470870, "uuid": "c78aa3e0-0742-4178-a869-6faf98281000", "comment": "Malware payload", "value": "cbaf74614047cbea119b87eb0c38e4f4b50192c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470870, "uuid": "25012873-b8ad-4274-a3f2-48016c1fb640", "comment": "Malware payload", "value": "40546890dddf34e7099c89eb43d99530059a765d3696b71d17e88eaad653b2e51e2be1034fc2e17efc60ee88fafd0324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470870, "uuid": "082e1b0f-67db-4573-8fb8-b7fc6791b8fa", "value": "T1318639C2FE418658C25BE275EDB561557230B448033912E76BA70BB44DEBEC41B3FB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470870, "uuid": "e769b5f1-5fa0-472b-a353-db59d0861404", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470870, "uuid": "7c452260-4f43-4e5f-8c50-e5a406e9a1d2", "value": "49152:571VmHNQrb/TpvO90dL3BmAFd4A64nsfJAzdFZquiuxIxTPgLeR0So2xJVUyK1VT:57LhZrRvSPT2ABHs1EBYdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767470870, "uuid": "26bb6258-9b3a-41a0-8fdf-7b29c23f1027", "value": 8284800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767470870, "uuid": "961fb786-1408-42ef-8621-6f4215c40fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470870, "uuid": "f742d25b-c56f-457f-989f-4a907680e006", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a471bdb-e887-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432928, "uuid": "424fc19c-44b4-42f1-a3c3-f384fa2287dd", "comment": "Malware payload (Mirai)", "value": "fc0ae93d02d88f87ac47f51ce981d418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432928, "uuid": "e71c774b-29dc-42dd-982c-8c4a7289fdb0", "comment": "Malware payload (Mirai)", "value": "14e0a8e62da1e7cae3ee4809766ce6860e8f56d9ff2f065d3c1002749b9e3e22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432928, "uuid": "1acc70fb-0dac-49ab-b47a-45967a7c9d26", "comment": "Malware payload (Mirai)", "value": "64a9612e93f50665fd8b9c9cbe569b3689de9718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432928, "uuid": "f0f3530a-98c5-4c45-923b-786ff4c548d2", "comment": "Malware payload (Mirai)", "value": "82a816227bc8bb030b5d1655d9a21d64616b6fe904463caaf145176f392eccb1afb1fc3da3c820f0b5b36b651f478859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432928, "uuid": "846075d6-511a-458e-8d14-a46780d76977", "value": "T1D103E0A947068CB5D577E47B49F50F642B810F3AF7E2DB897EC1BCA18D0A9603D42781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432928, "uuid": "13fe78f5-954f-47f7-9fc9-db73a497347f", "value": "768:xnXC6S+PF/+5pLJSNRWISTkkXPEiyl1doguVJgGlzDpbuR1JR:5s+PFaDiRWTpfyl7oguPVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432928, "uuid": "1d2712d1-7dd5-42df-a561-1f74caf50262", "value": 38452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432928, "uuid": "478eac0c-334a-424d-9348-7ed078e3238f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432928, "uuid": "2405e2f7-158a-4a23-abda-87e79e3c2944", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32998f6-e89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442526, "uuid": "0f55325b-e98a-4b5e-97b0-75f447d75cac", "comment": "Malware payload (Mirai)", "value": "64f1db5309678740bf28b863a0c83557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442526, "uuid": "1756547b-ed4e-4ae5-8d49-feec708186b2", "comment": "Malware payload (Mirai)", "value": "15c92249ee2c7822b34b4f94cd4ba5c1a72d79be6e2924f6344ec0626f15e493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442526, "uuid": "d1aa4124-dd15-4106-afa4-6585980bb3c1", "comment": "Malware payload (Mirai)", "value": "cc752f0123029315ad1c9e5b1dc420a490ab915a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442526, "uuid": "ed232228-f23e-41e9-a8ba-29a60a335000", "comment": "Malware payload (Mirai)", "value": "6a0bc4c361879f303f6d7cd8396fcf6cec90314e69fd2f50eb8c0af80feaa3cc0d18d39611142bebd40c06149a0e031a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442526, "uuid": "2c6a7bd7-93d9-4652-a0fc-ac2d9c1b4c02", "value": "T1EA142A01771C0D07D1662EF4263F27E0A3EFD9A124F4F644694FAA8A8271E37158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442526, "uuid": "e0a82793-3eb7-4e9a-a16e-38d03e321b05", "value": "3072:UpmbmV1z9n15ZYzNZxZZ9sc8FUdWXfalTmwbZn9KH:Hbe9L2ZxZZ9sc8adWATmwR9KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442526, "uuid": "a931a3a4-c074-4aeb-a960-c4d9c878628f", "value": 191612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442526, "uuid": "3b64ebb8-5bb5-4477-9532-10664abb7de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442526, "uuid": "dca0115b-a3c7-4473-b720-3e53deacc06b", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d745fd-e890-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767436699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436699, "uuid": "b1f2c251-0fce-482a-8806-9582560b09c1", "comment": "Malware payload (SalatStealer)", "value": "b4bf1230e84d7c18a0dc6a320442b825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436699, "uuid": "6d85cdf0-cb08-46d6-a2c0-5f98deb58816", "comment": "Malware payload (SalatStealer)", "value": "16285250ad3bbb986fb2fa17a45c837b43864d18ec83cbe37e1bc07fe5bcd524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436699, "uuid": "da5dbfe1-9a1f-4809-a3d7-87f77c1df75c", "comment": "Malware payload (SalatStealer)", "value": "ca8b1c5035087a287afb924a9a04a0330e515404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436699, "uuid": "2cb1b254-720e-403f-bf6f-a151e9558194", "comment": "Malware payload (SalatStealer)", "value": "1b241c2fe2a14502f02770fd038b2e1514e9d456df115093bf61fe607a7318d344a424617f96e83b2061c1011abf0ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436699, "uuid": "6f33db96-74d1-481c-bb14-c7c22311df41", "value": "T18CC66B51FA8B54FAE9031835409BB23F63355E048B28CBDBFB543B6EFC776911926209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436699, "uuid": "a753b7f4-c459-4fcb-8bfa-53bb2f3f454c", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436699, "uuid": "ab21ef46-f78b-4734-9683-f63c7c31b8ad", "value": "49152:pUWu+9Z3Botyp4yQjjAht88kmfKwIR7E7YB65qLaJNJgm4uKB8PHP6+bFmpIhmz0:uU9ZBay8QVAZSzs6hmzzSa/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767436699, "uuid": "aad3a885-f327-4fda-912a-d0ac7a4e77b8", "value": 11659264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767436699, "uuid": "e8ac0916-483c-479d-9db5-316c18be7830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436699, "uuid": "6e692342-5223-4bed-bab2-407459004daf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fee1ca-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767444648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444648, "uuid": "f242071d-61e7-482a-907b-a87b8f0449b9", "comment": "Malware payload", "value": "96c48ea30a415261d559b4607ede1de3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444648, "uuid": "ac7125f8-6f42-420f-9d36-b8f73eceadd9", "comment": "Malware payload", "value": "16321ef5d9812c086a8bcf0109153fdbc0ddd373e5719fc468659565a9228fb4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444648, "uuid": "191950e6-e373-4d7c-bfd9-878dafb5fade", "comment": "Malware payload", "value": "8fd103ebc91e091d108b4dbbb36faf2933e13426", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444648, "uuid": "d667ef02-bde1-4b04-898e-0daa6fa1c759", "comment": "Malware payload", "value": "1b02b31d34d54b8c19082fb6913194d4c20fde9f592feb807272600675a95cf0be9172c44990e13c042f4ec6ed05bd0f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444648, "uuid": "b81f3e88-3c6c-490d-a6ab-e48a6cca3c03", "value": "T153D0A5ED14D571630345D815B404168FE7CF155B5D439535D41D80BC21B9F501F957FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444648, "uuid": "c11d546c-1ee9-406f-aaa5-097f397d70b3", "value": "6:+DORnszL6cFVOlAkF7f/bBadzjhBFaoOogEHvkqQTK3HvV:UORngL6cFG7f/bBavzaoaEHvJQkHvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444648, "uuid": "9f980a52-bf8b-45ce-94cf-9c7ec5b51de8", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444648, "uuid": "443934d1-2649-448d-8463-d0b5ce2788e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444648, "uuid": "fb9afe43-2ff4-4cad-b9a4-319a8f89f706", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e48d18-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454156, "uuid": "be0f2fae-787d-42ef-89f1-0e129ed87c2a", "comment": "Malware payload", "value": "42a47769a47d9753d5d062dc865dc48f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454156, "uuid": "9af6a866-5753-4c8b-9299-81ee6b6f4017", "comment": "Malware payload", "value": "166181b2ea9dfc55a81eb0e9bcacce097edea7acbb7058c7a0b7d94e894fc290", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454156, "uuid": "ff712860-b441-482b-88cb-357122a256ba", "comment": "Malware payload", "value": "82036d74170887357e6aaf0a1beac93b3cc333a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454156, "uuid": "0ba736e7-3564-4bb9-a72a-ac0ad0706efe", "comment": "Malware payload", "value": "8d783b526e23457fbbb6dcd9bf970cf0ca8a4cf426e02a248a41ec8a266f855d4bc1f0cceab74f2911218b537ec5c51f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454156, "uuid": "e5658256-3bfc-4f7c-8bde-89eeb2a7f41b", "value": "T1DB04E1ED7E8BAD98D5B761E41FB97F08665C75508B37802AB1238034EE6CF4006EEC65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454156, "uuid": "b696bd72-458f-462e-b96b-2a6fc3883d4a", "value": "3072:hXdSfBn0BBJoaRBKqzrPDkwVuVnpt0gShDk98QnshkWE1fEedJ5H:hXdSfmmMBKArbk/pt0gShgKcLWsF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454156, "uuid": "b9d60b5b-a476-4a24-84eb-c59769f97b8c", "value": 189043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454156, "uuid": "5a893cbf-c6d2-41e2-8181-a75fbb0d6f07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454156, "uuid": "efe66b5a-9303-4c87-ab70-6876d16b4d8a", "value": "Qg51oWG9eWvyzb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492f76ae-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442697, "uuid": "c1fcb958-e25f-4235-b255-84f5c2118346", "comment": "Malware payload (Mirai)", "value": "05979e2acefdd81617c6d520ac1ac044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442697, "uuid": "e25b0e82-f3b5-4d90-bf3f-d4a425fa365c", "comment": "Malware payload (Mirai)", "value": "18763735c9002fc6aa0ce0236032cfef33ee975fc12fb4ae5091eda14dc8b16a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442697, "uuid": "8d20413e-46cf-4668-9687-3c0e0a752d67", "comment": "Malware payload (Mirai)", "value": "2cdb02a5b7b0d9bf057157f963652b2fdbd88088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442697, "uuid": "70f544b9-e561-4760-81b3-201497801086", "comment": "Malware payload (Mirai)", "value": "2ce8877cd87a139d6dd0c188005faace4bd32d18b1b8f5a78aaf2f07a9e7fd370e796085216632248036d7f092b1af5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442697, "uuid": "16a43645-b4c3-432d-bd4c-ae32f98b4579", "value": "T155E37CC5E743D4F5EC1646711177EB36BAB2E03A123EDA82C7BA9932EC41581C51B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442697, "uuid": "bb8b8a5c-4f97-406a-a62a-7c5a0892ab61", "value": "3072:jGcKraAe9vrHaeRSADfn/VuvKgbBPupv0H3qoUsabx3WwbZnsBn:jGcKrc9D6wSUVuCIP73qdvl3WwRsBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442697, "uuid": "9d60f472-7ff5-4bd5-97e9-463febadcc73", "value": 155176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442697, "uuid": "de0cc477-9470-468e-a078-2aef7845ec7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442697, "uuid": "e253f74e-72d0-452f-863e-6ed62594c2f9", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eeec50-e8e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767472411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472411, "uuid": "007941f9-3b66-47ff-a568-3a7c0b826e35", "comment": "Malware payload", "value": "f10281271e172d4a984df7790cfe371f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472411, "uuid": "0b5aa870-6370-4104-a736-2604e0e492aa", "comment": "Malware payload", "value": "192ec289aef24bf1cdb74a5c4cd25b84d458e078c732b3aef9d1eda336f6e338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472411, "uuid": "99fc88d6-85a6-4b7d-bf7b-96c3770774db", "comment": "Malware payload", "value": "5aabc3b1b5ab3a1a8bbdd2d7105bbc62d51bc013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472411, "uuid": "1176ceba-0944-4fb1-a102-723fbf1cc290", "comment": "Malware payload", "value": "a4f472986e8cc65b476f9db7cd71c528f92d71d18eb7c2591f5a602d1e039ad8088136f4de845db993d601a8ae279a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472411, "uuid": "214d05d6-6ba5-48ca-b6b3-a0b80d80af0f", "value": "T155E37B4B73A440FAD4978279C9A38B06E7B2B452573897CF1364836A1F237D16E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472411, "uuid": "809a5f21-5767-4d79-9b8e-3dc7458a86fe", "value": "1dd9860f6ece61eeb61852f8421ccce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472411, "uuid": "4b2e270a-fac7-4b89-a82e-47be5fad34a7", "value": "3072:ZgeaPmKcYQaVlrejcIT+E8EKhCfSLc1Ch4HDnIPUYk8DGK:ZFaPyYLHSjlTfKhCKo1Ck65l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767472411, "uuid": "9f0dd85f-a24a-4b70-99c3-c4084ac2b144", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767472411, "uuid": "98ecfec6-ee03-422a-80b7-023d762851c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472411, "uuid": "ed903fd7-f63d-4e7d-add7-197c951024cd", "value": "myexetra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0958b2b6-e86f-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767422404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767422404, "uuid": "45aaf930-168b-45c9-a56c-4d8be51007d0", "comment": "Malware payload (AsyncRAT)", "value": "4b283f074c3d4ea6e0c90769f751f1fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767422404, "uuid": "801fc3f0-6951-474a-b95c-50d76aa56c97", "comment": "Malware payload (AsyncRAT)", "value": "19678f14fa38f8f60cb942880be3bdd07f9a47494d641495363e80b4100c29bb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767422404, "uuid": "ff17ce8b-59f2-41fc-a1ce-2e852fcccfb6", "comment": "Malware payload (AsyncRAT)", "value": "27f96ed234ac19f15658091b9a1b371ba3500273", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767422404, "uuid": "df46c048-aa3e-4f4c-a708-f2c0b1c9ad86", "comment": "Malware payload (AsyncRAT)", "value": "9ad9e76275ddf075b867043e31f165b8c01ebc0b9ba6e5d7b9e3f255d5d99b3e5bc2bd20a564898b917268008f7cd9b1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767422404, "uuid": "57f29f6c-6ba9-4142-86af-2c74295abc79", "value": "T12CC21A0473F58262D1EC0BBE4833A200D375E68B5D13DB9F6EC495AD2A237CD8624BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767422404, "uuid": "5b2c1a82-3e4f-4417-9df2-53d4c873c1f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767422404, "uuid": "2028728d-e8ce-4dd9-8e1d-520e5ba6ea36", "value": "384:O44b7e8fplTzgeNGQkrgMymrJhx0HqqbuUsJQxnCJf+BWfXWmF/wu+:T4PzfrTEtQk8MyCJhx6FbHBFB5u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767422404, "uuid": "d29f30b4-27eb-444a-887f-7bd9b1f85094", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767422404, "uuid": "5a5af27f-112a-4fff-a666-35389d652942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767422404, "uuid": "3e1fe431-9cf6-461e-b335-bb8bd04682dc", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfd1523-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462486, "uuid": "933f8287-fd91-4bff-a42b-d97088a2b4af", "comment": "Malware payload (Mirai)", "value": "068f7a130b8c5713304422cbd9befbd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462486, "uuid": "53a9cb42-9bce-42ca-bede-14e271de3a82", "comment": "Malware payload (Mirai)", "value": "1a295e58ffb1ee7ef27d49ded8daa1ad63225fdfeb171b1331b46d08908b2675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462486, "uuid": "d3f7dfe1-0565-427a-b443-58f7db371f46", "comment": "Malware payload (Mirai)", "value": "069715f23c6cb7aa298b5592478111954fabe16b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462486, "uuid": "db7e764e-8b09-45fd-8715-c12c4bacbf2e", "comment": "Malware payload (Mirai)", "value": "e41d19d9cf42d62dec0226642eff5cbab322cc6a9a5090d1bb056488aaf60c3acc712651855ba9bbb27832a3fb4bda0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462486, "uuid": "fc74a907-2bf6-40a5-9304-8fb7ead4e30e", "value": "T178332B8968121E2CD6D358FD50729F4E9E552321A0A3070FA7ABFDC33D33269EF55988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462486, "uuid": "7517c9fb-1af1-4037-8891-628348499088", "value": "768:mYuzcClmYrJfIGh6HHaihHHeIXXdauZj0CGeWcytvptM7edUo+f1praz+QePbL:mYqcCRrdIC6HHaiFu/eR7edJg1pmzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462486, "uuid": "839036b1-5522-4057-a9f6-e26cf341b660", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462486, "uuid": "de72e2d2-640c-4d28-9adf-7c0f0ac7c11f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462486, "uuid": "e2533ff1-4fc9-4612-88fd-41711964ad5f", "value": "loligang.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa10e6bc-e880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430109, "uuid": "c8f5c263-dd32-4295-8166-4b2ec49def20", "comment": "Malware payload (Mirai)", "value": "1f794f14ffe272794e0c191ece594e05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430109, "uuid": "619b5394-c26b-4dfa-aca9-9547820bc13f", "comment": "Malware payload (Mirai)", "value": "1bbd70f763e7d34b1cb6d2a57ec6f8fed9c3e4ea94103d16dcd39587726db0b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430109, "uuid": "a3f9c8e9-6fab-47a5-9a82-7f236455f358", "comment": "Malware payload (Mirai)", "value": "9c55630f215ee46e89013b13fec86e90f52d6570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430109, "uuid": "72439261-b426-41c6-a434-9c8a270b472c", "comment": "Malware payload (Mirai)", "value": "6819fa999740742909c6d8b55e70d817a24bc1e56092f290b53a0ee4681e9fd929b02db3067ac4f09c5c788812f34188", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430109, "uuid": "48addd46-eba2-4191-be23-86c9aa469ebc", "value": "T1C343D64AB991DB15C5D551BAFE0E528D332317B8E3EF73139E14AF246B8B42B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430109, "uuid": "78d4e58e-52ef-428f-8f17-220e0eaf2900", "value": "1536:ahnzwA9qwgTYs7UHwepxgzz4vfjntL36M7i8gwyJDoiu+7R:4wAswcYkUHwepxgzz45gwyJDoiu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430109, "uuid": "1c47dfca-aacc-45ab-9692-cfac14bdefee", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430109, "uuid": "d0da38ac-43df-40ba-8add-4e949399e5aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430109, "uuid": "594f48a0-c215-470e-9b1f-c61fa9bbde71", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34db457-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444647, "uuid": "a388454c-ccdc-43cf-8e88-5aea48e29735", "comment": "Malware payload (Mirai)", "value": "a79ba1c18a63265dd90c57b786b0a51e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444647, "uuid": "b8ccd400-9ddb-45a8-afa6-a3be77445399", "comment": "Malware payload (Mirai)", "value": "1c3e6df9446b59c6d4c02bee2ed00714897de782ce06818ce7f9d7f41b296055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444647, "uuid": "f679c8b9-dc84-4d11-a745-b7ae2fffbbc8", "comment": "Malware payload (Mirai)", "value": "dc0b92b5b15055cb063393f0df8ba402209b7582", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444647, "uuid": "f9ed3eb9-75a0-4c93-81fa-297d6b679200", "comment": "Malware payload (Mirai)", "value": "3ac9f7acdc3d4e5250309bf0968597561095742ed6db5f3cdfbcd422fa3a74c6ae3fc5c42eefad6e79604432e5eb6298", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444647, "uuid": "1934dc4e-8539-42f7-862b-b39b6b7b2b54", "value": "T19A530298C6DCD2F8E8AF59B0CC7B76436460900D1A825ADF7CD62561481E6A9330DFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444647, "uuid": "fcf4a240-dc93-46d0-9889-275a6cbfeee7", "value": "1536:9wcJhDfOGRGHrRxyLAnv3gM+4UvVdy3zvnouy8Hyk:LDfO4LAvwMQt8D/outj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444647, "uuid": "bd77cf88-e030-4395-965a-f5bb682daa53", "value": 61508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444647, "uuid": "e957ad51-06cb-41b8-a2d5-f2af48b245d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444647, "uuid": "29c6d142-d573-4df0-bf08-3c2d850ebbe7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60807091-e8b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767453474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453474, "uuid": "2dd9079e-db6e-4ca5-9820-f91bdf0a53c4", "comment": "Malware payload (Mirai)", "value": "f18a2ab4eea710720bddeecc95cdea5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453474, "uuid": "20c88458-7ab5-49fb-aea5-c0741eea9cef", "comment": "Malware payload (Mirai)", "value": "1e550ac754dd65b84ca8f9f41a8a1dd4c8de8e60080b50c882180913b6e5401b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453474, "uuid": "74672fb7-7771-49a4-a7a7-eb63096239dd", "comment": "Malware payload (Mirai)", "value": "629a161120ff0cd22e498ed8de1a32618a981ae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453474, "uuid": "47811627-a652-447e-9715-ab10053d43e7", "comment": "Malware payload (Mirai)", "value": "a6a953a8161735a19e701b674fb7a0cab77f19381ab079e9e1d3e1cd2fdc77e77231f6b68879cb3c8aad76d45b01a543", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453474, "uuid": "81d70e0b-9021-46df-9139-04e798dedf57", "value": "T118E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453474, "uuid": "1fee44f5-ec49-4d30-ae7c-f548b6f64538", "value": "3072:CJLce3pC5mx7naLHbz4N9GUJURIJ1FmEXkkTM/9oIMY:CJLce1naLHbz4NMUJdHmEXkYM/9LMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767453474, "uuid": "ec84118e-d2ef-4fb8-b960-33a3f048d38b", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767453474, "uuid": "4972fea0-1c7e-4d05-ba50-fc03e0fca786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453474, "uuid": "445dbd97-42c5-4b8e-960f-d3b7a5763da3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c52ebd-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767442930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442930, "uuid": "c596475e-0fa4-4538-8f6f-fed14bb2c921", "comment": "Malware payload", "value": "bab7f01696ac38edf9ffb224ab266c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442930, "uuid": "6cd51aac-b86e-4a5a-8141-f345da844136", "comment": "Malware payload", "value": "1f761f95c11d68c8ea0e4066439bdfd7af213a64b823ede394b4b710f2716e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442930, "uuid": "d05264cd-65f6-47bd-95d8-b3eb6e1b1eaf", "comment": "Malware payload", "value": "7160c366a0e43d5cf9719142f137cbcbb7ab3b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442930, "uuid": "987de67b-b05c-4be5-ae0f-0e9b6b0853c8", "comment": "Malware payload", "value": "fb249fe54399ac42444e3c771f68df78a592ba8450ce31d489dbac8ba4a7ec73cc2674f8954788960dfdab4b581080a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442930, "uuid": "8bed3c56-adf2-4610-8e6a-e66e26d448b9", "value": "T160F623C27EC9D298C0834A7019C763DD71EA729D41FB8E9E39CBAC022951D1ACD4E977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442930, "uuid": "9086380c-30cf-4221-8d87-bc6c0d3e41a0", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442930, "uuid": "55ce1e55-f2d1-44d9-9d39-83386cf7d741", "value": "393216:4UENcBVRa8WdZ6EDXOwm3bJNNi5Yxh8PxKjy9e:4EBDaDDm3tO5PNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442930, "uuid": "71e945ec-cac2-4dcc-986c-a71f1c83e5d2", "value": 16406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442930, "uuid": "6f20a568-3719-44ec-b9e4-19d08869b680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442930, "uuid": "b6047616-74aa-4e34-9a46-94108ca85858", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e68425d-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400615, "uuid": "1f8cb8ce-3dcf-4b8c-81ec-6a177f3d1cb4", "comment": "Malware payload (Mirai)", "value": "01fe1c04e4cd704d188e70f56d32cc13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400615, "uuid": "be58ed09-1468-4c87-97f5-ba28cc6cd25f", "comment": "Malware payload (Mirai)", "value": "208f2dcc4e90648c2a470c044abfbccb30d491c6882bec2b94f96a7f72a9ca07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400615, "uuid": "8c82e965-a9d3-43a4-95b6-2e489936182e", "comment": "Malware payload (Mirai)", "value": "4f2d293272f6a752d8e1db8e0bb4c056afe19bb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400615, "uuid": "4c3e3118-f5cd-446e-b191-78c4e1a69cd0", "comment": "Malware payload (Mirai)", "value": "1dbe37aff80c321b385904ed759857de6f8a97ada6ec1f5b6e1a2e73210d0b849e894ee8967049497fc09e1712dc13f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400615, "uuid": "967b0087-e1cd-4b47-8766-4d39cab9f405", "value": "T1AC63E74AFD819F15D5D525BAFF0E528D331357A8E3EA72029E146B2467CB82B0F7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400615, "uuid": "36e3ba4c-45c4-44b8-ad23-be34a825ef01", "value": "1536:Jxn4Ek3q3U8eusqXlaeHweKCOTB/ZGjqJEAXb4naqSllKYi8e2zTxsu+7R:wEk63QuRseHweKtTB/ZGeJ5Xb4nZp2zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400615, "uuid": "996bf6eb-1324-4879-88dc-f43ab546c50e", "value": 67844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400615, "uuid": "9d7b193a-335a-4053-a937-c382150bac43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400615, "uuid": "82754ffb-fefe-47bb-9067-bb9e6e7a01b6", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0c3054-e8b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767451752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451752, "uuid": "9f4e89f2-8f6b-4a6c-af3b-f488ac8b9437", "comment": "Malware payload", "value": "ecf24e6fc36c46172d15a54ab571bc4a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451752, "uuid": "b2659abc-0a70-42f9-ae6f-d8fffddc6df2", "comment": "Malware payload", "value": "2097499d22868c93e09ab6d3cbd0eb7fdb81efa869e80f77432e2ed423f5af63", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451752, "uuid": "712cf75c-b976-433c-80db-054c65e21d4e", "comment": "Malware payload", "value": "548dca4e3ab02ec6d3470cd04b058483f910e2a0", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451752, "uuid": "30ec6f22-7f3f-412d-b4d1-44f20bc389de", "comment": "Malware payload", "value": "cc9739360866adb1849359008472bbe61bac155046b7aa324fb29aa4e42801a3aa0886597ccfcbed4640c788f5434219", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451752, "uuid": "8bda6d72-8704-4e28-b8b6-3d60c9403393", "value": "T12E572316FB0C692FECB3B0784CB61352B1662C599B41AB53A601B22D7FB36C49F197C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451752, "uuid": "e4311ac3-e9a4-4b25-a781-57df2f36abb5", "value": "393216:wc6/PsgqIM73ptKuGx/+3eC+DHmxZQF0HERxAq42vrvGPBYwxdLx:wc6XVM758eeC+bOZGXa2bGPVxdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767451752, "uuid": "385495d2-1e91-488f-882a-fa94dc139dda", "value": 27727100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767451752, "uuid": "dcdeeef8-4925-4f02-b161-2d16af00d3be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451752, "uuid": "08835ca4-9ccf-49b0-abc8-a6d920638a74", "value": "Junk+Pure+Cleaner_3.1.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bf2c01-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445557, "uuid": "9c5bee0f-0f0e-44a9-8335-2014f311e0ad", "comment": "Malware payload (Mirai)", "value": "5ba351c91427a9022a25d6bee84fce6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445557, "uuid": "3f575fc7-a720-4db1-ac65-04f2aeb10636", "comment": "Malware payload (Mirai)", "value": "20f7a0d0e48d0c5ec744b84ddf4ec83a3b2960269525ee4e6593c4ca448c778e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445557, "uuid": "c882de31-f7cc-4169-9538-5a7f9eaa03dc", "comment": "Malware payload (Mirai)", "value": "4d29d211bb4ad5179051ebedad9b3093d335d960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445557, "uuid": "68f11cfd-0629-4118-bf50-837bb712f5e3", "comment": "Malware payload (Mirai)", "value": "aa7c0e2827c93e557016a567c599fdfe9ae6651d0a24bc57363b80c91564a33fb1bc1cf908709e3b2275afb4373e0ffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445557, "uuid": "03fe37ee-00f7-4c89-809d-511230e6bb47", "value": "T11B83B605BF614FB7EC5FCD3709B95B0529CC950A21A93B3A7930E818F25B24F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445557, "uuid": "d4009059-d1ec-412c-bec7-185666132046", "value": "1536:/BncA4T+byjYYfvpNrx5NIlWtqOkb0OSldWUv4MHpu+7Ro5:/BcA40yjTfv/bNIl3OlDpu+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445557, "uuid": "8f22376f-8fac-4b9f-a054-888e73363e2d", "value": 86492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445557, "uuid": "9ca54107-9ae8-408a-9297-c78819968cce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445557, "uuid": "815194ba-12f8-4ae2-a06b-b6b0fd3b5819", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa981271-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767445572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445572, "uuid": "d79ac771-0281-4865-bb92-3404946005bc", "comment": "Malware payload", "value": "e8d201b3fd98eb68fe03bc76f9600d3e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445572, "uuid": "065005f9-536e-4cca-b42e-023b3202283e", "comment": "Malware payload", "value": "21b7e82e5509b2564c3bbc25b1cd3aaefa175618ce4f267f3656eedd4226538d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445572, "uuid": "3521c773-e3de-44cd-9c94-00c2eee0645d", "comment": "Malware payload", "value": "c7d74a907c8b8f78048f196f9a3116dc4eef48c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445572, "uuid": "c548b8ad-809c-4ca4-ac95-09f36c5db07d", "comment": "Malware payload", "value": "e8f80566b73b93375f2de442f4cc63cb5342e8d98268399f816f2a3bf319efb451a06c5e2d249b556b81fbbeb119d21f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445572, "uuid": "c25a55f0-51e7-4632-b7d2-028e61f7cb84", "value": "T1DE15184656B030D8E37EB57B4B72B0120B21BA6156768A8B1740E10E5F11E7FAE38FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445572, "uuid": "5b05eb9b-6a29-45d3-b980-2d00d04e5676", "value": "24576:WQ4ZGXiGqbIo/P12OB1qscTkAARiM6S1PqqL:WQ4ZGXp+/P1/1q7cvp3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445572, "uuid": "9ac04e57-4d35-4150-8376-3d7a29a814c3", "value": 886288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445572, "uuid": "455d07dd-28e9-4dea-a3b4-351f059893c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445572, "uuid": "c12733b5-b1cf-4d1d-9d07-d24c213e5788", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2451fc1-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454148, "uuid": "5b37eaf2-a471-40d3-bc34-079e17331f58", "comment": "Malware payload", "value": "67c67091feb0a7df4f6961dea8a1aa8c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454148, "uuid": "6a822dde-7b95-4971-b1fd-c14d48f8bd1d", "comment": "Malware payload", "value": "2223ad4dd430fa6969ed61460000d8849521974361b8067aa37d51878f42c30f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454148, "uuid": "cc286e69-10c1-469a-8cfd-a0176d2f3020", "comment": "Malware payload", "value": "f8fb4d399635d59709c8c6765b9d8ce89115baae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454148, "uuid": "92cc9b5a-050a-4ec5-8bd4-5165ceaa55d9", "comment": "Malware payload", "value": "9cfe8432519b2f601e05aa212591c26134aa45086e3ea4b18b207b5743b4e7e67a0772b90f77258363c8134495fcd728", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454148, "uuid": "f21f350f-c0df-40ed-8450-24b4a3b72044", "value": "T11314F1CB54E3EE9283F2754C13D68F1F94DE5E910B4F718DA805ACA0AFBD068A4E5C61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454148, "uuid": "b1470036-1abb-4f42-be37-52bd7084e7bf", "value": "6144:X8ScoxrwlV9Vo0FDBbA7YrtdV8UBBEwvxqB9PDQMobLf:MScoxAO0VBUsdSUdvxQ9PDWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454148, "uuid": "bf32e98a-97b9-441e-82f0-f2571002b21d", "value": 204620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454148, "uuid": "54eabf7c-c4e6-4f27-8114-423e27717cd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454148, "uuid": "56f5342d-4e0d-484c-a6dc-f8444430591a", "value": "jeST0WdaVa7dfT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac7fc95-e8d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767467611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467611, "uuid": "4806205f-c086-44c0-b1bd-12ffa441ab57", "comment": "Malware payload (Mirai)", "value": "16af498d82a63eb60fe3aa623720469a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467611, "uuid": "52c7b893-0465-46fc-b1da-809ae013431d", "comment": "Malware payload (Mirai)", "value": "228eb22253c585425eeafc3e9ccd28bff675fd178bb47a2e5ad67c216216e7bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467611, "uuid": "cb0f7c8d-45e5-41d1-9b03-ce93003f047b", "comment": "Malware payload (Mirai)", "value": "98b96d93fe0aff895df5e60fb7a0931d41676a02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467611, "uuid": "e19490ba-c1d6-46dc-8f41-c2ac5237eccc", "comment": "Malware payload (Mirai)", "value": "74db1452d15d7b558105a2e8b7513f4f538a806f857150fcf769cb38e696afa4db87048a4b5142c8d3cb0a4fcdd38f04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467611, "uuid": "8a4acdff-232a-4c9e-b85a-b4a6b8965d4f", "value": "T14B630A46FC818E11C5C91375BA2E258E33132769F2DEB3239E116F207BC696B0E7E456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467611, "uuid": "17b31ba8-d787-4b25-8ca6-d657ed8b49f5", "value": "1536:/tn+aVRkcmXLsq6zCOYRm+xolgz9UIsiKXWbmO8:wao7XLD6NEaXWbmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767467611, "uuid": "5f51619c-8f69-4c74-8206-ed6c808e9d00", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767467611, "uuid": "ecacc1fb-82d3-4c8d-b545-419905f676ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467611, "uuid": "7d901ed6-0394-46ef-b480-003ac4e37ecd", "value": "Mddos.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a63f36-e83d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400980, "uuid": "6934af78-7b2b-4fa5-9c8c-59fb13010a13", "comment": "Malware payload (Mirai)", "value": "e9f623ef9f68ec9eb38ad2fa6e8f4e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400980, "uuid": "b444040a-149f-45b5-aab8-5c0eb923bbec", "comment": "Malware payload (Mirai)", "value": "22bb0d1a7beecc8fc33bea5c16b3d22da883dddc76d090695b875ff12fae43ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400980, "uuid": "d4091cb2-fa95-4eaa-80ea-2a95d42529db", "comment": "Malware payload (Mirai)", "value": "e891f4f221ba87f27dceb1f88cbc92e66e88dc68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400980, "uuid": "8911b3a2-13f3-4254-abae-894b4c259a16", "comment": "Malware payload (Mirai)", "value": "1744c477594c20df3db161224481e3b3ce8a06f9cbd69f08c1bd83fbac8edb81389658f027b7bf09ded25550d305ecf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400980, "uuid": "67d7c107-94b7-4889-9b2d-83db0acf82f5", "value": "T1B6237D017308C553E2561EF12D3F2BF0E7BE9AA02194E386B54EB68D42B1D73544BDAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400980, "uuid": "c650ae1f-f5be-4386-a7fc-5c509483f850", "value": "768:UVZoTUeaQSNyD0yDu7/QOD8JYVu/qcX7k5qqbkEu+7RGb:wNqu7jMScIAqbkEu+7Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400980, "uuid": "52a392c8-26a3-4b98-9c9f-4f002b0d32e0", "value": 46032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400980, "uuid": "ab80b9c1-c58b-4625-b0d6-8ed1aae34fc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400980, "uuid": "7b7eb757-cfab-4e9f-9ea6-d9538a87f266", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77065ae-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400792, "uuid": "4c05bcd7-fe91-40c5-80e6-eaf6a92b5796", "comment": "Malware payload (Mirai)", "value": "3374a58acdb66af0f6350aad2c5f4b1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400792, "uuid": "a01ec2ef-fcd7-453a-beb0-83ea72d025c4", "comment": "Malware payload (Mirai)", "value": "22fcf1ad6c84355e8638f7dc97f9e88ffd99d729f76358e7af69bbb658ade125", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400792, "uuid": "d6b24f4f-09b3-4f99-9a55-2856c657eb13", "comment": "Malware payload (Mirai)", "value": "8757c3f6f230ffd15085c7329fbe5381aeae618e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400792, "uuid": "f8d05387-4f53-4e55-9bac-f3c8164a49c4", "comment": "Malware payload (Mirai)", "value": "7291ecea197a94e84a1cf5629bf35b66120019725f884949ea93f9acc426d2063361263f3308d98288a26de7e7af8635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400792, "uuid": "f40a1373-0623-4a52-87c4-73553c2cda64", "value": "T12D63E846B9818A66C5D512BEFA2E11CD33272778E3DF73139D106F147B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400792, "uuid": "60f7ce57-038f-4f09-a30d-16364c371226", "value": "1536:aRnsi+FGaUaxLH5l/xbsAkeHweOwD4R6dxBGP1I3ilYKNXpTuM7R:bga5ZFxbLkeHweOk4R6d2YKNXpTuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400792, "uuid": "83143d95-6c39-4fbf-b537-9a3bef6f6d6e", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400792, "uuid": "7ba4c317-a21d-4393-b7fe-f854b52bdaa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400792, "uuid": "49a44840-cd71-45b6-bed5-bd762b5ac17b", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0496dd6-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400431, "uuid": "117153fd-8067-42cb-bc30-3d71cdf6cdbd", "comment": "Malware payload (Mirai)", "value": "0604fee9e3d2bfc8e551529e84b71e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400431, "uuid": "42c7cf19-9c7f-4b67-8740-72b37d2079ee", "comment": "Malware payload (Mirai)", "value": "23d81d08acd38c31b0ff4865f3534e3446255c8634e963e3b3e9404d8049a153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400431, "uuid": "23aafe80-edc1-4b8a-a947-7682c8c5b278", "comment": "Malware payload (Mirai)", "value": "ba0c1975536b0805a37b0987b3275486eb5819f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400431, "uuid": "78f9bc79-e9a6-4a07-a12f-0c293e6d1887", "comment": "Malware payload (Mirai)", "value": "5fe662018146290f3a192a32008f08af06f779eb88edecc745416abef191c8c28cf6e6e72e34cddfa3e184f924f52292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400431, "uuid": "b4795810-14e2-4c9a-908d-db5d695f278e", "value": "T13293F74AFD819B25D5E822BEFA1E018D33535BA8E3EE7202DD105F15778A82B0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400431, "uuid": "a88ca7f8-4d8d-4870-9b87-109a3962e486", "value": "1536:RRnb2tRVZ6eoNJQzcqB8ct1sx4peHwecIZojCrHGVGQSbpPDQG3dNl+CiJ0qfFh7:OzZOJQzVB8212JHweczjCrHmGQSbpPDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400431, "uuid": "749bb258-18da-4ec8-bc97-d74f7f4d55bf", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400431, "uuid": "5db21806-8d22-40f6-aae0-6781bffd87f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400431, "uuid": "732bf56e-454c-4640-b940-52dcc11ea04f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa00be4-e8a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445599, "uuid": "c74119e3-1fc1-4be0-ae8f-26e2766d8cd6", "comment": "Malware payload (Mirai)", "value": "d893ec90bc9cc6ef8a8afdbabf76a2b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445599, "uuid": "c7f5bbfd-81d8-4faa-9afb-9719d3b2620b", "comment": "Malware payload (Mirai)", "value": "25a55a28720f96aef614fc87ef9ae921026b449590b7b262a401c11768c57f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445599, "uuid": "4bb1636e-dc6e-4d7c-b695-8ab9f133d741", "comment": "Malware payload (Mirai)", "value": "587bf8206989256f2ab9d9c1c04e5b9a9aa53c88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445599, "uuid": "308c0988-53f4-4f9d-a25c-f0feb7dde526", "comment": "Malware payload (Mirai)", "value": "b898e24e7b46bae5faad80327475140ac7b9029e7c649e1e1145d76bc36599653a21a0601edbe5415ee86100cc33a3c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445599, "uuid": "ac66a1d5-142b-4325-805d-415758c9aa82", "value": "T12344D70AAF610EFBE8ABDE3706E91B0524CD641722A93F357934D918F50A64F1AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445599, "uuid": "e12a0942-5853-4d97-8dca-373e144fb74d", "value": "6144:P+IDdWlmH05trl+FCk8HQ8wDBaMEFwRl:P+IZIthzkKQHBaMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445599, "uuid": "27f2df34-a3b5-4257-ae6d-20a1839823e1", "value": 257288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445599, "uuid": "d7bfba85-8689-4cfb-9348-63359e4febfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445599, "uuid": "bf199001-a5a3-4472-8dcc-e8578e2cc0a1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb500fd0-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444285, "uuid": "a1d07c2b-b0e0-4b16-ac6b-6596c831ff09", "comment": "Malware payload (Mirai)", "value": "d239a81a33b6c3774ea06f77410731da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444285, "uuid": "e6bee87b-6302-4284-9a0c-fcbacb875be2", "comment": "Malware payload (Mirai)", "value": "261931e0b7907946f8d6d8d8b5c67b0ab2785fc38d582f97a7a96aef5743ab75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444285, "uuid": "d9a2155f-f4ee-43e8-891b-b99b0928a74e", "comment": "Malware payload (Mirai)", "value": "15f02fe2248124dc2807f4a4f7e4229aa586b2a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444285, "uuid": "283c74ed-d6fa-4245-b806-f8b5b3c2f51c", "comment": "Malware payload (Mirai)", "value": "31405a63681d643254989574d543e770737a28dff6dd4096877eb16dc695b3581ba00effa254c04f6eac7f3566e6e939", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444285, "uuid": "3f476395-baa9-41dc-99e8-f20d4b43dffd", "value": "T14173D62A6F25CF6DF76C873547B78E219698239227E0C641E16CFD005EA034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444285, "uuid": "7eee9ef2-5711-441b-982a-25ff937f319e", "value": "1536:ikanL7JAccGcrWcW9HHzWZFIFqnLc7L+B7LLGvokj853huM7Ru:mnL7JNcGcrWt9zN1okj8ZhuME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444285, "uuid": "86c95432-5364-461f-932a-c9e748ad38fb", "value": 76040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444285, "uuid": "76ff371f-3128-47f6-944d-f72093d3a113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444285, "uuid": "5fbf439b-2dc3-4246-81b8-3e032973e9c2", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eed7dfd-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446277, "uuid": "1cf71345-2744-41a0-b91f-e83c22cc557a", "comment": "Malware payload (Mirai)", "value": "f467e8bb846554177897dfc0d2b9af9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446277, "uuid": "f5702a32-0fd9-4d07-b355-6e279eae6310", "comment": "Malware payload (Mirai)", "value": "26c9dc1b7a6b0d676cb9c205b90e811fbee7a9ab19a421008dc29ad6d0d5fabd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446277, "uuid": "3ecbd3d3-d39c-4a84-9ffd-93d62c2d788d", "comment": "Malware payload (Mirai)", "value": "1a1a9bca081ad98eeb37638c37c47101b763f996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446277, "uuid": "e7fc9ae9-5f70-47de-881f-9784bc49adbb", "comment": "Malware payload (Mirai)", "value": "6392bbea8fc478cfc09537eb6e1f2a300887c57eb3a140c319e86e066e367588341a98d37f4259fed2bf07a101790faa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446277, "uuid": "44a2fc17-ce5d-47e0-b865-4d6cc7727237", "value": "T14AF2E11C2782BDB3FD72083D9D290EC1A7535CB9D3FC320859561568B98388927F9D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446277, "uuid": "2d57c623-f80f-4ee5-bef0-6b7a189201ad", "value": "768:7Lt1MVN4ao59/l714h5wcNl2teRjkA1CaVs3UozU:74ng9/l7mhuk3kA1UzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446277, "uuid": "ff7d0ceb-3ed7-4afa-8850-3a5df3214e49", "value": 37052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446277, "uuid": "c37702db-c0b2-49dc-ac0f-e8a5276627c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446277, "uuid": "4916a861-ff8d-4022-9829-60d8caf26c0b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc283c1-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400614, "uuid": "e90ed11e-fb2b-471b-87f4-c847ae5d5da4", "comment": "Malware payload (Mirai)", "value": "297baa8f4b6786b6ebbc054cf1e20846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400614, "uuid": "39063d36-4090-455d-99f5-e928d8ac5bb8", "comment": "Malware payload (Mirai)", "value": "26ed524c5efd445778fdc28a2e3c94be846654370f4705ef9e50248ca68737ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400614, "uuid": "3dd97a44-c482-4df5-8258-149274ace855", "comment": "Malware payload (Mirai)", "value": "4904ffc7b4235bc7b6bd1ec651cb7546f0213ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400614, "uuid": "073b3c44-b5ab-4a21-a079-a098cc7414f2", "comment": "Malware payload (Mirai)", "value": "4ab43499136a847133d317d6ed5362b1a39445e35831db79c4339683d97d6de0b767f70b5be18c2f9851be4933aedc0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400614, "uuid": "31a37ca1-f6b1-40d3-a85f-897f8e931fc0", "value": "T1FB63F1230451D5B8EEB218737F1E87967DA703EDE1FC466A414866A83D4291F2A7E0C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400614, "uuid": "70503438-782e-48e4-ada6-8b5fbf3dfb01", "value": "1536:JFTuA+VsI4FsTyXekdOoK4R+6Zg9/S42ZAOb3yeefBLn:J5uWV/2khx1ieepLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400614, "uuid": "60247053-2091-4819-a5e1-573dee0aae9a", "value": 69400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400614, "uuid": "5fbea351-4acb-4e2b-ab8f-0b4a26379a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400614, "uuid": "efd32962-9daa-42db-9f63-f28ec6a39de1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84fafd0-e844-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767404256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404256, "uuid": "ff7a7e8d-290d-480c-973f-3f80189328ce", "comment": "Malware payload (LummaStealer)", "value": "fdd60549a8a1535afe04e1c754421601", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404256, "uuid": "969278e7-037f-4480-9626-f3a460f1a503", "comment": "Malware payload (LummaStealer)", "value": "26f682647661a8ddee6e2a3556cd0e2044eb9d555ee7fe0b3698591c2a43fc26", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404256, "uuid": "3c2af764-b534-4d37-8e0c-c7a812aa25f6", "comment": "Malware payload (LummaStealer)", "value": "271c475c5f4a20b7671f8ed9e143f4a353906b64", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404256, "uuid": "91546e7f-b033-44ca-9833-a672f1accbc7", "comment": "Malware payload (LummaStealer)", "value": "b650a70328699596460aadbcfdca9120cd831b5727e1db05188eba742c3104111f74cc9f72ab71dc3b3d4c6ca2355339", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404256, "uuid": "21c001e9-3efd-4310-a160-c9a19592f78e", "value": "T1B777BF16B7EC8065D0BB9234C97B9756E675BC11073086CF2254BA6E2F33BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404256, "uuid": "bff2d2f2-26fa-4aa9-83f0-e4272991d18e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404256, "uuid": "51c35853-015a-422f-bbff-b4246ab23deb", "value": "393216:mLS/MxwEblOOnV29xOz7jCJ5lhZJXuK6Yxu+vB:mLS/Mxwvq29ONYzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404256, "uuid": "121f0438-53ef-4c17-b37a-ca4cccf30adb", "value": 33234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404256, "uuid": "c81eccf2-511c-4431-aa6a-cbd234da6fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404256, "uuid": "766fe1b1-98ed-4654-b6ca-3ed2d2bef947", "value": "cx-programmer 9.1 free download full_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25323ab-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443384, "uuid": "2c00f998-e26b-487f-b63e-4769c85114d1", "comment": "Malware payload (Mirai)", "value": "ff8d9cac7f7ca553ade68e2dd1b2d608", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443384, "uuid": "c7f788d2-9b74-40f3-989e-b29270865a8e", "comment": "Malware payload (Mirai)", "value": "27df5e171db77046ec88dcef5ecff5ded40d1ff0ae4a2cadaea417c9b2a39a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443384, "uuid": "d258f6fe-0fab-4694-8f39-2519b6a02e77", "comment": "Malware payload (Mirai)", "value": "92e8549937ff454ccb389d037a86e2378cc80075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443384, "uuid": "7dde6ee5-9f3c-429b-a4e5-043ec6f21027", "comment": "Malware payload (Mirai)", "value": "bdcfd47df2420d7967c2d6b6f0cca6c2bee1fe6fd2020bebf151c451fbfcca44e353cdff7e3b334d39493af269f8749f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443384, "uuid": "dc376f28-c80f-4b16-8919-206e538f3a4a", "value": "T19A634C217A7D6D1BD4C4A47F21F34235B1B1574E36A8CA2EBD720E8DFF20650214BAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443384, "uuid": "29fc1703-4b90-4067-9d35-45ba746374c1", "value": "1536:nE97YrXmu/S2OlokQ9CqcrbZeugCYtPn8r5mMfRehe+ch/B:E97YrXmuacD925wcGe+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443384, "uuid": "54c32674-14d4-40d9-be5a-ae8ca44b6483", "value": 68536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443384, "uuid": "5b39a545-7791-481f-911d-340f1b9abd37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443384, "uuid": "4b36e34d-6486-4756-932d-db93c422a464", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcea0672-e838-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399190, "uuid": "832a7ab8-25ad-4d60-aec7-6e832f722b44", "comment": "Malware payload (Mirai)", "value": "0fe11095b426b105a891849e7ac9131a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399190, "uuid": "eeb5c219-215b-4a09-9452-610a5a43cc58", "comment": "Malware payload (Mirai)", "value": "27eb64f5c421988340f90e3ce824b41d10f168942954ea5a0c26c6c15db6957c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399190, "uuid": "fdb6ca7e-60bf-44fd-acca-b771c28941c0", "comment": "Malware payload (Mirai)", "value": "7085f3b28c1e3cf469c16cbdf374371931ed7b56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399190, "uuid": "c9e60058-2dcf-4b0d-a28b-b61a302c6323", "comment": "Malware payload (Mirai)", "value": "916a31b9aca7a3bf41056a91b0d60d3e6b5c66bab31b1918c4c1979d1155b7f0563c5acb5d44cb5fad2d11a1ea3cb239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399190, "uuid": "ce435c32-a8b4-4fb8-b652-cc88e1f00e08", "value": "T140630234500C6EC3E8E458F8674A05ABEA56CB37D6BB62374559A2304E8A00F51FFB5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399190, "uuid": "ba42052a-f147-4cbe-81c0-5e375e5a4e3b", "value": "1536:XjmSLcFzCPYzFd5opviZHjecP5XsLH5Qb0/rGzW:X3Lc1dFd6VADecxXyH5QbCrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399190, "uuid": "ad81c746-5469-479c-a497-9e27ba22256a", "value": 71244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399190, "uuid": "f43321ef-4693-4388-a0dc-c68133011dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399190, "uuid": "a91d285f-8734-48e2-8ac6-4dfa614adb24", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8e8026-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442834, "uuid": "c2b7a036-4d0e-4097-8b05-be4006ed2b02", "comment": "Malware payload (Mirai)", "value": "802c6fd9cba93cea8394d4caef163d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442834, "uuid": "c6b245ba-8747-496a-90a3-ff38e8003158", "comment": "Malware payload (Mirai)", "value": "28a497c5811ef1f645ff065c7e9cc8eb5d0a24573600b91bbe13ad50a02c1d95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442834, "uuid": "9321503a-b997-4d33-8349-89d925f27365", "comment": "Malware payload (Mirai)", "value": "5952ffe65d1883381c04f3d59e3f1ea80e3bf889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442834, "uuid": "6a029dda-5aab-42f2-bb26-ee99eab8dd6e", "comment": "Malware payload (Mirai)", "value": "f69ff3e1fd029e8249a6c45227481002683859c308af43ba763bf06d4214ba2511e5d790ed31b13603f0b1287f2fef6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442834, "uuid": "7fa20e45-3dfa-42e3-acd1-7b553ef6db4a", "value": "T193531A45B881D617C9D462BBFA5E42CC332653A8E2EF7307CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442834, "uuid": "738bb51d-f711-45bf-bd77-007a80c1c158", "value": "768:yIfDANwMqyEdxGKeNrLEoT1ywnRidZTl+PAj7dYh1uCPNyN+dvPz6suM7R:97eXqqLEU1PReb+PIShUONXhuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442834, "uuid": "bb428224-184c-4ac8-9d3f-18c8483d53e1", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442834, "uuid": "e37cfcec-274e-46e0-b96c-d8fadad90302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442834, "uuid": "fadf6057-1f5b-45ac-99fd-6891f43a836a", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be89de2-e8c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767459855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459855, "uuid": "e7330eb3-b447-4d86-bacc-12983a31bf90", "comment": "Malware payload", "value": "cb391dda3b27be734114e0acffc0d90f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459855, "uuid": "25728654-296c-475f-96a5-d8d7b12003c5", "comment": "Malware payload", "value": "299960fef14881150186bcefc291b8d49202305b0c90abb2e55fe8cad0ff3243", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459855, "uuid": "755db2e7-c749-4251-978b-f4b788fef958", "comment": "Malware payload", "value": "247f0df5a910c897e35e4ecf0f6a5c149e4d0a8e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459855, "uuid": "4d508b64-f5f3-4e03-bccb-2358d0b9b3d1", "comment": "Malware payload", "value": "8c7a77b3f11b7167d07737a2e758ec80f22be64806a0f05a0acea9828d8af0925f6132dac6475036ef85bc40263ef1a4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459855, "uuid": "11e466ac-1b85-4535-ac73-da8fca68b599", "value": "T1FAE5337E500267EBF5B10FB3D46DB658130CA65917B68302CA6D1EB543C87AFEC13A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459855, "uuid": "a2a97067-5d88-4fd6-89a8-0461ae470e79", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459855, "uuid": "226e3183-7f91-4d29-b56a-ab8b0c17ff60", "value": "98304:vatHee6aUV6/7r0htfC2GTmNAYRrY8ZQ9Bvs:it1wo0ibCAYRrQXvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459855, "uuid": "6cb533b0-b91e-4f29-a3a7-1d1b41d5494c", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459855, "uuid": "8b7aa773-9aff-4dda-84c7-217e3d4b4abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459855, "uuid": "07faab1b-e52e-4680-98b0-bc32e322b38d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a1edd6-e8e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767471421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471421, "uuid": "fd11e60c-3f73-4862-951a-0ba87cf643b3", "comment": "Malware payload (Mirai)", "value": "bc66762b670c6095bda8635108af2712", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471421, "uuid": "1e7f8f87-3327-417f-bade-ed8ecbf1bddb", "comment": "Malware payload (Mirai)", "value": "29ed805642950a7709d058067ec1882d877beb02e67b56b673b5e2d2b17272d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471421, "uuid": "3ba1be6d-c44b-4c13-8a05-6b0956f899ab", "comment": "Malware payload (Mirai)", "value": "48b76fdcea81835a7d92dc4313076dc997c724e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471421, "uuid": "759b3e74-b1bd-4eb2-acd4-45889a83b4c7", "comment": "Malware payload (Mirai)", "value": "e8129a0d9257b212ed33822a28e76d170a5c76f80eb2297b3a7e587f0049df7ab6f9388169bc900196667d2f557c13e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471421, "uuid": "03162eeb-0752-4f4c-a957-e23eb6de7f1e", "value": "T1E9D31A2AEC829A51D9D316BBFA1E458D331313F8E3EF32179D284F25179A42B0E7B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471421, "uuid": "c3fcedab-4210-470a-9a92-b4bf50ec426e", "value": "3072:WFarthLVLdrLGIGLsHJypam5ABl0EpkSU+Aj:gar/LVLduIpuat4EpdU3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767471421, "uuid": "8d4fb00c-60b0-4454-ab1d-8b8d1207e9f6", "value": 130368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767471421, "uuid": "25de602b-cc6b-4710-b4cc-d4d51efe8b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471421, "uuid": "227eb2be-03c1-4cdd-b860-30432c80fce2", "value": "rondo.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870b851d-e894-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767438506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438506, "uuid": "4f6ef5ae-881a-43d8-a004-76f7e702b533", "comment": "Malware payload", "value": "c572c5317cf590755ca75a57bd9d1674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438506, "uuid": "0ee43899-5ce0-4305-a023-d8ff7c99c81c", "comment": "Malware payload", "value": "29f0a0cfe73203c985c373255e485eca6b9dcde2a434bf4989bdd7d6b022a976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438506, "uuid": "c7dbc9f2-55cc-4f19-8314-6e5193bb765d", "comment": "Malware payload", "value": "4bae009545dbb5d01435db7fa93efe08d279f108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438506, "uuid": "9f62178a-5d25-4191-99ec-a76a0482644a", "comment": "Malware payload", "value": "b13204d65a4a5c5cc0be04b90d6e3a58c04a7229f5037d9a34e0e41e31cf61594110cbbd561412259da1cecd7dc5b2ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438506, "uuid": "1aa9eef0-deb7-43eb-9974-00049a9c3c64", "value": "T1AEB62993EE544265C58BE239ED7662467230B084133213D37F671BA49DCBBC45B3BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438506, "uuid": "e94e8cf7-31e9-4b94-86f5-8d9274a3200e", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438506, "uuid": "305c78b4-9154-4817-973a-bf1384181831", "value": "49152:owXptvrb/TKvO90dL3BmAFd4A64nsfJ7WUbkcEvgIRyn3C8YZIIw7VeWvFvQElXQ:ow9k54fFfOhDWKek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767438506, "uuid": "bbd35a2b-0e6a-4920-8918-540a6fcfb602", "value": 11082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767438506, "uuid": "f2030b3e-efc7-4ccb-a220-a1df1c8fb710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438506, "uuid": "1f03de84-f513-43df-ba9f-aef819af9aa6", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc28e1a4-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427885, "uuid": "b2794f2f-2a9b-45ce-8573-a7663e554134", "comment": "Malware payload (Mirai)", "value": "e57b4782b2198f0b152cb53766ad074a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427885, "uuid": "df62de0e-c7cb-4055-85c5-fae86640921c", "comment": "Malware payload (Mirai)", "value": "29f5d40c7554bc1447f9181806d30484910ad73dfa85055f5ea1e06160876472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427885, "uuid": "80ad3163-6e24-41e2-9230-29b3d517313c", "comment": "Malware payload (Mirai)", "value": "3f6c7f693b3f3e826afc7226770117d94304635b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427885, "uuid": "c5217667-7662-439b-be58-2ba7a1e8185e", "comment": "Malware payload (Mirai)", "value": "8eee61ded7ed7d406e90ffc60db9a67da330a4bdfcd6a00470aa67dfd9d34ed897a723ce4efab7840eb8508853a7acf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427885, "uuid": "83bc7214-3370-463b-858a-b2c1e512496a", "value": "T1CC232AD3F100EC7EF84AE33AC5030915B5307A5585A1666373B2F8E39D723A9583DE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427885, "uuid": "cd9ddf31-2042-45a5-98b1-91fc3f8ffe1c", "value": "768:kdo/3kWqGvwUl5GqC71YBy2bFwaNJdHjFnMy33K88sTPADPlTi:vzqGv5l5GqCR9CFwaNHjFMyHK88sbADI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427885, "uuid": "daf1a970-33bf-4332-bee8-0821268c8a6e", "value": 46920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427885, "uuid": "98bc1d5d-f115-42bb-afec-e66b4fbaae0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427885, "uuid": "f133716e-b755-4d73-83ba-10cbd3195ffa", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a70b41-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444649, "uuid": "425ef0b6-bbe8-4d9a-a7d2-f0faa241ade2", "comment": "Malware payload (Mirai)", "value": "63af5f0447a8634ea4051e210eabea1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444649, "uuid": "4dc2b7e5-c1c2-47ae-9a36-9197014df140", "comment": "Malware payload (Mirai)", "value": "2a2a5873324f5144ecc762d6df5e72c6a3e24cc4defc44a2b5d55f62edd03d1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444649, "uuid": "b1ac544e-c818-4681-a743-73c55a7cf045", "comment": "Malware payload (Mirai)", "value": "168c04e3c36e0dd8d1186def62db23c39b4e6ade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444649, "uuid": "64a14bb7-4a4a-4ec7-9e0a-94def47f51ff", "comment": "Malware payload (Mirai)", "value": "a58df76c3ee5c3b9eb21b25d9d2f587b4a6294257af2959b997de4f47d8c70425cf1e8d1729da16a72f23b98fe1907c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444649, "uuid": "926b281c-6d15-4bfb-8ebe-e78548392db4", "value": "T12E530200E9A3DF68D35F6A3585EDCB15C9C0850B44E054CB2EEF590F09F19F63B69A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444649, "uuid": "2b6a61c5-46bb-4d0c-be0e-1e4e399d5d3a", "value": "1536:w7EQj47Dy4LVJaTuSGJWbGpvJ7nwJ/1gF0cZaLnouy8Hykp:wIQjy7J6uRSIvZn+9gFdcout9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444649, "uuid": "e75c5c1b-b68c-4c15-8f40-57d456b36568", "value": 64060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444649, "uuid": "8c6a0ed6-94c4-4e60-b6cc-22e6f68c49c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444649, "uuid": "f5b19488-c370-4e57-ab73-60adf3f4d952", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3cc087-e8a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445008, "uuid": "389773fc-d924-4563-821f-57bca2fed8b4", "comment": "Malware payload (Mirai)", "value": "e6d0cf37d58264559c22a718dfa6b39b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445008, "uuid": "f5e50fca-ee35-4a8b-b1e1-2f0ce1ff07b9", "comment": "Malware payload (Mirai)", "value": "2b10068ec10bd030ba07eb457598194c825f5b37786c7e263afb7e4539755a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445008, "uuid": "27bd3d45-8816-4214-aa69-86f11fe5860b", "comment": "Malware payload (Mirai)", "value": "c6ca03223c187e96764ec366ca34b1744ffb23e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445008, "uuid": "bf0a7c8b-e9d7-4b09-a6be-400637a4e8d0", "comment": "Malware payload (Mirai)", "value": "ce221bf2f7b2f1f9af50807b5c628a569e0892e7b5832104b9a8719e30c15d8ef17f41ed3ad2bb42e068ca0a44fadb37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445008, "uuid": "6776d359-58df-4ab8-a6df-54f55c29c27c", "value": "T1CE7302C7F012F490C2E40AB1CDB4BBC95DA690BC74BD30DB5D2D682839CB9421FE9A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445008, "uuid": "15b8059c-236e-4fd4-b46c-d2d6fa1daa09", "value": "1536:WqHqIoWR1DVnRVcscTQkPXmspfuXA+uiaSYntJrO9V3OVXaCcoy0I0yaByLK:JKI/DJcJT9msVGwi7EJrO9V+VbcoN7zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445008, "uuid": "5c8b0c25-e4f9-4025-9dfd-f6f31c93a8f1", "value": 76444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445008, "uuid": "443b2232-ffe8-4f79-be76-7bd0b31541a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445008, "uuid": "a8947b3e-46f1-4068-9091-df200b8b9827", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def0db07-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443378, "uuid": "998356d6-b8cc-4fbe-b5e1-a36e43fda171", "comment": "Malware payload (Mirai)", "value": "65144757b5f1704cec0f659f5eeacb66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443378, "uuid": "46b0a349-e186-4cee-b845-8e8a47218c54", "comment": "Malware payload (Mirai)", "value": "2b3f3e68227cd9dc10888a4c74e3a8eac90e21326bc82ccccbbdb0fe30d0ce45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443378, "uuid": "fef4afa9-ffab-4ee9-be63-a1972f77fa89", "comment": "Malware payload (Mirai)", "value": "72da0320e3d34442cc9a1943fd93491ebc8c73ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443378, "uuid": "4bb68019-b0ad-4f68-93ee-f4359459379d", "comment": "Malware payload (Mirai)", "value": "9766300e6b3d531bf52c63c758c42f0a87f94425bbed4d21272fcf2ffaa4dba98754fa415dd7ae78daa9ed30e2418070", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443378, "uuid": "88e05880-8fef-41e3-afa8-98a4be665822", "value": "T16D43A409BB618EABD86FCD3745AD4B4524CC820732A83B767974E418F35A14F5ED3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443378, "uuid": "2d292f62-44e0-472e-900d-36ee1333e8da", "value": "1536:XAj7dM5kTSBdrPpZ006Em6oDXOyu+7R7:XEykTca6Nyu+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443378, "uuid": "249ec5ff-bb60-4172-a4ec-1135513a2dd1", "value": 58188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443378, "uuid": "d24ea741-f004-48c4-8719-8cc52259ec3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443378, "uuid": "4ffbfe21-5a65-4893-8c58-5bfc7430a8da", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b6b057-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443249, "uuid": "a4eac99c-b6ce-444d-925c-cd41bca54e3a", "comment": "Malware payload (Mirai)", "value": "e021586776e5b33abb9aa827b52da572", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443249, "uuid": "cbab41a6-cc5a-4f15-bf4b-b1b0246ac852", "comment": "Malware payload (Mirai)", "value": "2ba8142bc602f043fa8c195018aff71a908678777863931d6a489279038be711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443249, "uuid": "6f872482-216e-416f-8de5-21b5130876fa", "comment": "Malware payload (Mirai)", "value": "1579ecc3f368874a67f116dadb5885b649b2bb81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443249, "uuid": "8af8c0fb-8c20-442f-bb8d-1b37e00b7148", "comment": "Malware payload (Mirai)", "value": "610a3ce5571a0b81d9f1603df3ee8e99a6d27a744b2151060f7f727bf8a4adc03843d14849bf0fdbec825d7f979bb92d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443249, "uuid": "fe1f40de-79de-439e-ab27-a7267cdb49f6", "value": "T13C033C42B70C0947D1736EB03A3B2BD1E3EEEED121E4E684251EA68DE172D314196EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443249, "uuid": "3fe5713d-7e9f-463f-be0c-d4e8e4d44837", "value": "768:jDtzBFSV6HWy9PKdf0TZ7+rYZ3ORF5jtUCJlaIVi:v1S0HWsPEe7+8stj+xMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443249, "uuid": "c523b0c1-d612-4ed4-9ac0-2d27dea5c234", "value": 39588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443249, "uuid": "313f680d-36fe-4126-b68c-2e162e100813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443249, "uuid": "1b9d183b-1329-40d2-9e41-c66c0a91c491", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69341908-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468521, "uuid": "5bb44c0c-18e4-46c2-bea1-68c06eec56b8", "comment": "Malware payload (Mirai)", "value": "4968ddf5c1e3a59e4c1e62e4d70e7568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468521, "uuid": "7a42340b-bbda-4a3d-aecb-0b9647847341", "comment": "Malware payload (Mirai)", "value": "2d6cb6589fe95fecd52455fad883d0fcae68bfe9aa36de035a6422d1267f9355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468521, "uuid": "8914ae12-c26c-440d-afce-482e77d886f1", "comment": "Malware payload (Mirai)", "value": "7bdab0cb94446e4253b2aca6e91e6de2d3df38b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468521, "uuid": "718ba4b7-1847-4ba3-a1d3-63fecb5dd3db", "comment": "Malware payload (Mirai)", "value": "36ed410044acb52b524969fc847ada1c344092d2ff1fa06fbaf8006290a3f3c9a7921a0c347093c3c6f3b63c6c5b0456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468521, "uuid": "a58d92c3-5f77-401c-988f-b0a40f366edd", "value": "T1ACD3E709EF610FFBE8AFCD3706AD074525CC560622B92BB67574D928F54E18B0AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468521, "uuid": "5c872ebe-8412-4d76-bd01-9052ba03203c", "value": "1536:tCSKQ0RnBld690EKVGgwl9iX9CQM3twvGbOV8Zp3KzQbHQonjRZwE7GP/dIhi2Q:bKxnZ69jK8gpNCQrs7bTRbGdIhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468521, "uuid": "17a6a946-aa8f-4f4c-bd46-049207dbdfc8", "value": 132952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468521, "uuid": "2d9dcb08-f088-4266-86af-3e884b6bb731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468521, "uuid": "b7c0d048-2d3f-404a-bf68-b1250c411218", "value": "mipsel.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234e139e-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443922, "uuid": "08d14e29-443c-4c3f-83c8-31e5ee5cbd21", "comment": "Malware payload (Mirai)", "value": "4dcbb9173f372b6d6eccafc5c3eac34c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443922, "uuid": "9fad26ad-3778-4a47-9499-cb048dc3b889", "comment": "Malware payload (Mirai)", "value": "2e166f9deec8642b670d8c76caca00d7fafee2882fbb2a81ea3fc018ae9af229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443922, "uuid": "e85b4382-eb23-46c8-974a-d9f86441f996", "comment": "Malware payload (Mirai)", "value": "8b1663d4927838904da77cbe6d363ae284a923ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443922, "uuid": "054b7886-8e0a-4205-9d0a-8187fbf33a03", "comment": "Malware payload (Mirai)", "value": "558f868b25cf2d0a5550c2dd1e8f8becd9d9eae9b5a2db94149ee5f937df39176c7e70fef1743384f3839a822e581467", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443922, "uuid": "c97698a3-02b6-4b45-b043-2376858acd7a", "value": "T1C46302B0D4A9AC728F213A39D91CCE5C5AC78FB894FA58E2BF141DF956CC121736610B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443922, "uuid": "263764f9-2e54-4871-850a-8b0be2a3900a", "value": "1536:d7+PLWuvo8+ZUTmXywjrJN7O0EalrZbQYcSHEm/GzNkYF57OLF:1nuUK6N7O0EarQLiLyqcqLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443922, "uuid": "b6fec23d-e13c-4553-af10-96530565679d", "value": 69720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443922, "uuid": "87678b24-e855-444c-94a6-232c1b4b0e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443922, "uuid": "0d20dddf-6564-45ac-8566-40f51ad59200", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576f6808-e8a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445728, "uuid": "e1651f10-1bbd-48d3-93ff-3ff63c4573be", "comment": "Malware payload (Mirai)", "value": "4d7455e214501bde5c1a91c4069628be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445728, "uuid": "2bcd9b2c-b0df-4785-b80e-90a5567f2340", "comment": "Malware payload (Mirai)", "value": "2f2c8522823ec34602a02f1c1784b306c87fc72fe1e42495ea840b0a0a6d0fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445728, "uuid": "ee69e760-da76-459b-bf8b-c30d11b30afe", "comment": "Malware payload (Mirai)", "value": "2f66d9d789b9988fb742e19be0f761b4e1398324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445728, "uuid": "8127049c-b04c-40fe-ba74-3444dea1642e", "comment": "Malware payload (Mirai)", "value": "b2a7eed784f48bd424c1a1abeac817c27dc43c274f4442f8db15a865ac324cd7ad9ce0377f0cfa0827a730e347d9f6ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445728, "uuid": "4c1585d9-7c72-4496-9de4-5fd9cf9b4a84", "value": "T18C73D846BC918A56C6D512BEFA2E118D331357B8E3DF73139D106F247B8A82B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445728, "uuid": "d642e82d-11af-4278-a6f0-a7096a76440a", "value": "1536:6RnOKAfNTCcUCRbr7tqKiAhos1KHwen7WUv9DrVz73XMsiKBZwW3Du+7RT:4QNTDbr7cKiCoOKHwenaUv9xBZwW3Due", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445728, "uuid": "33688998-c111-4909-83a2-eadd4b64cd56", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445728, "uuid": "ced5b340-7b2b-4edb-a8e3-90c62f835400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445728, "uuid": "d21481c2-36af-46d8-b378-746bc854d378", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc8d781-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431112, "uuid": "b9516534-0b04-43ce-bed1-93616317c6ff", "comment": "Malware payload (Mirai)", "value": "56edc457d4a8d905fab752aa9c7a86e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431112, "uuid": "153ba8df-b3d0-4397-9b37-dfe12d4ce9e8", "comment": "Malware payload (Mirai)", "value": "2f38c0fb4d977957542cc4c0d12c178d06fca1ea77472f04913d643b6818f88c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431112, "uuid": "4defe29e-3d85-41db-ac75-fbc295abe450", "comment": "Malware payload (Mirai)", "value": "d0003c88749754c7c192461a85f28fe993587189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431112, "uuid": "be09a6dd-ca81-40b2-9cde-034950d20f41", "comment": "Malware payload (Mirai)", "value": "a87b4cdc686b0ccee2013174885e0e6bcdc94f71b3066d991090cd3f15ba1141612d9b82dac571a9380bae36bb5eb4fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431112, "uuid": "f50633fd-b6ca-4635-9621-9f18ed89dc90", "value": "T115630120C6C6E5C743EB7972C4D8D984B7E00DD9BEEA94D892D89B31C52BE5E0045E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431112, "uuid": "6395b060-ff87-4939-91da-5f6c263599ae", "value": "1536:gGS9RdKfdXz07kY4Br9VTst2PHWdUUCaVjoAJszml12c4u+qgw09W:n6zKfdXzOkY4BhOQP2drCknJszmH4u+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431112, "uuid": "dd7fd127-e04a-4de0-8390-b2b089620e1a", "value": 70764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431112, "uuid": "15857e79-2c48-4ebb-8038-2fd6a6e27e2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431112, "uuid": "8be01fe3-f1e0-4f92-a6a9-f8c547cb428b", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124e8949-e89a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767440887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440887, "uuid": "04761f78-c2a0-4a58-a987-d568b31ab4e0", "comment": "Malware payload", "value": "97229edce9b5edd8946a1912292e5bcb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440887, "uuid": "c6d1e8ae-5ba4-4631-a1e4-c105e9ed7595", "comment": "Malware payload", "value": "2f841a33a6bb7c409d48edaf89d1c26ec512c74367acb3744a38db757acdfbde", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440887, "uuid": "3088550c-13c7-41dc-99a9-53bd2f45d5a0", "comment": "Malware payload", "value": "c369994a5654f21764ffdbb266efaae6483f05a0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440887, "uuid": "c55a2baa-7e9a-4bbe-b6bc-e788134331a7", "comment": "Malware payload", "value": "2ce633782b96bb184456337886ab860223c20266f52c2be2b90f67b0430895897125e12516094d1b3d22a86b50198ff4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440887, "uuid": "ff7eaa1c-12bb-4c35-9867-91c6f1e1aea8", "value": "T107773356E9B6A7DBC87B50F2C20E9E5806135E4980A732A7789CB1C1B1F3FA076F7444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440887, "uuid": "97337803-6021-4d87-b0a1-b6fb090c2694", "value": "786432:W7sQqIX61hP8lYMesUiahkmhsmDkWWE8/iH5nFlRi:ttGlYMesOhkmh98/iB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767440887, "uuid": "e48630d1-22fe-430e-941c-2b368e41c91d", "value": 35672064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767440887, "uuid": "62982a77-df9d-4f34-bee6-28b7137bd9a7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440887, "uuid": "6c2d0cba-9447-4d3e-9533-3913b1eea28a", "value": "Launcher.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bb8cb0-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463438, "uuid": "4422c04e-20d2-4052-81eb-1a25e80e0ff8", "comment": "Malware payload (Mirai)", "value": "d0fcf8ca26448b74b5b85d7d51c26a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463438, "uuid": "02899404-c161-46c6-ac1d-2dd097201e2a", "comment": "Malware payload (Mirai)", "value": "30f02c7c92341122f187d9884d7e2d42aa7f2bfa2ffb7da1b7019a1bf06a234b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463438, "uuid": "1388bde8-fc93-4720-92d0-0e72cf57e0dd", "comment": "Malware payload (Mirai)", "value": "4fc82a350fd0101d8f4e54b0a94e1a37b983fd28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463438, "uuid": "bc052eb3-9727-43ae-b874-faede6725dba", "comment": "Malware payload (Mirai)", "value": "29bc1ca34b03d375338aee0a469f17ec84e13ced6e7fa71ee0d53a5dffe60861265b840f257f7d692f68b03990f56899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463438, "uuid": "df0b93a0-c9a7-4351-a431-b8049ea66215", "value": "T19D436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463438, "uuid": "cacde47d-51a7-417e-ba01-e3005e8dba0c", "value": "1536:JeESt/basV2rcZhG6ySN7na6blSR9zWOIaEjrqMJs:JeESt/basVTgS7na6bQRVtXESK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463438, "uuid": "454d1a0d-09dc-4d2b-bbdd-9eeee35eef86", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463438, "uuid": "cc7a57a5-e2a6-4f27-8c2f-58df0744f309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463438, "uuid": "080630eb-2087-407e-b9fe-bbf4a3b7f9a5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18b6130-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443382, "uuid": "63a2c272-b9c9-420e-9261-6b87bedc7b44", "comment": "Malware payload (Mirai)", "value": "b765a78f606415fac9620da73690ba8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443382, "uuid": "9355ead8-c2c2-4c67-b330-3dc4d7b00ea2", "comment": "Malware payload (Mirai)", "value": "313a3e490234d94d7c4df758afc8e2791e9028bc7b1fa4976bae97d05f03f0c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443382, "uuid": "a89f238e-7bf6-445d-a0ff-cb2cfde01360", "comment": "Malware payload (Mirai)", "value": "6556277ce97c7af5895fef76278e6cf64c0a87a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443382, "uuid": "830bd131-c3b8-4ca3-9b27-3c97d1a93a19", "comment": "Malware payload (Mirai)", "value": "d8d0c8aebef0c7f01b1a926acd1fdc650c258376de147930d4601cc6548392524db413fce89c4db121b4edfac503a9e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443382, "uuid": "aa16657d-e865-4150-a7fd-04edaaa42438", "value": "T111530845BC91DA16CAD462BBFA1E42CC332653E8E1DE7203DD11AF15778A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443382, "uuid": "3dc2cfcb-d651-4efe-a2fd-304a940bb307", "value": "768:Msgv1xy/gBgCUfa3rRBObPBELcWwYxsEvQeH9BJ6mN7VMBBwjQcupoceu+7R:MvnyxErRUFScfKs/edjzVXjoku+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443382, "uuid": "fa1eae4f-1fe1-4603-9030-9834c29f8764", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443382, "uuid": "29c71259-9294-48e3-81fd-872521754682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443382, "uuid": "2b640cbb-c8fd-47f3-8334-85c99a4388c5", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95446256-e899-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767440678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440678, "uuid": "0030daf4-71e6-4d57-9311-6b76b23e51cc", "comment": "Malware payload", "value": "88e500d56824dd34a76670450e89ff0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440678, "uuid": "151b54b5-9146-4193-9c56-5b63b576387f", "comment": "Malware payload", "value": "3163fae1a556982a7a530e68ae4ceee889d364eefdbc05f18084b3240d8d4e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440678, "uuid": "087125e9-74cb-4b35-ad64-05f1eab44a02", "comment": "Malware payload", "value": "04baf3d0d17d9728065335afad979282bebe3702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440678, "uuid": "4736304f-14fa-4bc7-a5a9-9205f4cbeef2", "comment": "Malware payload", "value": "a0c0824a6fa15aa904a3e9b92050b0ac6df0e2aa4b4851d61a5c852c9daf16193f91c2f012e6f0ef8d52c3b80c16455b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440678, "uuid": "8f3a48d3-e2a0-448b-a6ce-489bd6bc4c68", "value": "T1BF086B4262EA04C4F9F7DA759AF65617C673BC122F3095CF221C172A1F336E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440678, "uuid": "c68759d5-0850-4ca0-8f51-4155f7518ebd", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440678, "uuid": "545409ae-2265-494c-8cdd-266c90350393", "value": "393216:Ys/nU/1IN3Uuw8ygaACggdwVCRdsQ+hrxAAsIyNOnS0B4AycWMCYulLX5zlc+S+9:YEYGD7sJYgNukUB4S5rs3wbpLLNNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767440678, "uuid": "f89c762f-0dac-4a4a-9f69-86fa6f4fe00a", "value": 82116848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767440678, "uuid": "cde37dc6-50a2-4a56-94e4-a0772302f7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440678, "uuid": "82650fe1-bbaf-4a3b-a20e-c9c3d7134b1d", "value": "Extreme Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d656ded-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459589, "uuid": "c8a07d6a-f79a-4604-9c39-fd51c578581f", "comment": "Malware payload (Mirai)", "value": "f30e36a55dc395b84ab350195751206a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459589, "uuid": "a312d725-b24b-464d-ab1f-d1ccc51bfbd5", "comment": "Malware payload (Mirai)", "value": "326104f4e7b290ca4061fd1dd455d61fc460e02c78f703367a947c1a4f66c9ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459589, "uuid": "37465475-1fb9-4434-bb06-417a607d250e", "comment": "Malware payload (Mirai)", "value": "8daba3b6a6595d2c59ff9543cfb7f96580345d1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459589, "uuid": "b36428a5-b5ea-4997-b6f7-9d1dc8de6c68", "comment": "Malware payload (Mirai)", "value": "61e84ad5c0eae26c5a65e7d3286f8e690c4ab5a668b3fbc85448741791445782dfc88b7d9e74e800a547470fbcf5699a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459589, "uuid": "54d7df1a-a906-4c94-b4df-ef4dd8cd7c3f", "value": "T18DB33966F8819A11C5C356BBFA1E418D73130BB8D3EB72169E146F35238B96B0F7B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459589, "uuid": "26111ebb-2a55-44b8-83f3-0400023ef102", "value": "1536:8Nngd2UfqhsI1DEwZfC23FLt1fXtbe5EB4auTsFqBvJdGiPKKSq17HIYaPn8:f2Ak5fC2nVdeWB4aulKKSq1DI/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459589, "uuid": "2c91b980-cb76-4838-b7ab-4e004b172fef", "value": 111824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459589, "uuid": "17f06bb7-1535-4280-bfc1-d3607c34f979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459589, "uuid": "69b91c29-5ac3-4850-9168-3b050fa32a25", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b7132c-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399534, "uuid": "02674087-a9e8-4e2a-a455-7f107987fba3", "comment": "Malware payload (Mirai)", "value": "8cd8ca1bed1abc44e72339aea94db14a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399534, "uuid": "bf1440f7-88c7-41b5-acda-e2077a54414e", "comment": "Malware payload (Mirai)", "value": "3346dbf1fe0333486faf8d9a39bf590b26ff920765aaae462c41777824efb3e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399534, "uuid": "68680e59-ddd6-4f88-8abb-cf30ba12ee50", "comment": "Malware payload (Mirai)", "value": "41de51b93aaa9d62122099489e7019150c25d074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399534, "uuid": "1d968342-c16a-4f99-8481-574a87d9a12b", "comment": "Malware payload (Mirai)", "value": "af8e336e7837b8b09307a55c3004b8fa5af1c0444ae920ea03163a57c31bc4e00e80cb76a16ef942bf8d29778c15e366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399534, "uuid": "4bde5453-35b5-4b6a-b790-a4bc3183fd47", "value": "T16C635C22797D6D1BD4C4B47A11F74339B1F2270A26A8C61E7E720E8EFF207502257AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399534, "uuid": "782dc1b3-ae56-4bbb-85ba-ae740c2f7a9f", "value": "1536:1ajLSCNTCq1Pjs408VZeYuBBy+6X74QvieZoDhiHge+chNg:8juCLhjXReBXE2diAe+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399534, "uuid": "a32d095d-0d1f-4a3e-a44b-2f8d2a4e9d92", "value": 69792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399534, "uuid": "6e34ca7d-5280-4a81-9e5c-c0c1ecac55c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399534, "uuid": "f9dbb867-4f5c-4a13-927e-36290e957a4f", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccfa04b-e8e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767474969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474969, "uuid": "3718a06c-8bdc-4a9a-b10a-bd833d901967", "comment": "Malware payload", "value": "867ba4ad8b8355510f6e47367c5db6d3", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474969, "uuid": "5addbf5d-56b0-46e3-a73d-02d60e865666", "comment": "Malware payload", "value": "3349cb5bc3770684377153330929e52dae288933ff966f524c769563c377d8a5", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474969, "uuid": "e82f861d-2bdf-4aa8-8fba-7f568b3f3523", "comment": "Malware payload", "value": "82d4e98cc087d9e227a36f003907437c27e7a9bd", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474969, "uuid": "18316f8d-e6d7-4216-bd6c-d3974b03fa83", "comment": "Malware payload", "value": "01328c3243b7ba6e0b709a337a8303e961fa34ae352db334a2739280aba9cf1e50e0598081f9dc27ea1351cdba8675d6", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474969, "uuid": "5f02aad5-2949-45e1-8b40-cfb9b224a4fb", "value": "T1FC374D9EE1B027E9A76FA49DDF48EC8BC640596C49B252CFB13F4E8227A07CD4419731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474969, "uuid": "7f1dcfc5-2865-42f1-950e-162b7cb431ad", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474969, "uuid": "2991b0ae-99e0-44ac-a1df-dfe08cbdf0c8", "value": "98304:+sbi1GxqAfPMLciyQwvuQuV9Fg4UkIc02:+sZfayQuaN6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767474969, "uuid": "5b90c906-c9f3-42a4-b58c-5ac42721553a", "value": 22537728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767474969, "uuid": "5c592a0c-872c-4c44-a293-feb12961edf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474969, "uuid": "4726a0a9-b6e5-4aaa-a342-936294c8dcee", "value": "KIDDIONS MOD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca2c285-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462487, "uuid": "484ea681-aeb1-4b7d-b908-9d3db4093d7a", "comment": "Malware payload (Mirai)", "value": "17983f5b6aa7c3f45fdeba0c11aceda8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462487, "uuid": "54614b71-cb01-4abf-9d53-a97317af0ca3", "comment": "Malware payload (Mirai)", "value": "341249a50a02ca22d4ff64e821007db82bdf936ca75b171473e36346ad4c4398", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462487, "uuid": "4f8175c3-3999-4e07-8b4e-0d8f36d5622a", "comment": "Malware payload (Mirai)", "value": "012047828c6c66b147c46549dd67246ef1302b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462487, "uuid": "ef579453-2854-4c3c-9210-308754daab26", "comment": "Malware payload (Mirai)", "value": "469809e708a72449a3f16d09f102179c29e2907290e3561d08b93aaddff15af67ebf50ddc37a9e4ba77e29a8134a7057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462487, "uuid": "f93128a7-3221-4ffa-be43-f6c73071e17c", "value": "T15C93734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462487, "uuid": "6668cb42-9ac5-496b-987d-79588871cfc8", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9W0vfwW9ufY1C+KBtyRirfXDOiOs3J:CHsnD8/gb/zyDv9W0HD9FC+KBtyR6/DR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462487, "uuid": "c0ed5ac6-c2f7-488c-80ea-c1b078874bf0", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462487, "uuid": "d2a12ec9-f4c8-41b0-aa35-69d0a40de675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462487, "uuid": "d2f26cc0-e993-4cc7-8cc3-54acc9db44b1", "value": "loligang.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9f6542-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445389, "uuid": "faf4af8b-03be-4487-b35d-102579f72090", "comment": "Malware payload (Mirai)", "value": "59fdda635322ba5e2c2b7378a219cf20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445389, "uuid": "0b40d2e6-c2d2-4454-b08e-a006b5c9f2fe", "comment": "Malware payload (Mirai)", "value": "344e577ee1c51cd8a2915489422ed5a3d3f33d280c389305ef529fe3ae5e1111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445389, "uuid": "d4fbc84b-91cd-44f7-8904-51df6e80721a", "comment": "Malware payload (Mirai)", "value": "cec01a0b135be98e9a5f330016196862f40e11c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445389, "uuid": "429b9802-4e8c-4581-b58c-0dccbf1a47c4", "comment": "Malware payload (Mirai)", "value": "2e0f21a33897f908dab986ef2d7879d81a659f6bffc56ea9fbe82700cc81633d7d2d3b47bb7372028cf8285c53344f17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445389, "uuid": "089890cd-7aaf-46f6-8a9c-e8d497b1899f", "value": "T10E730275421043E1D97862BC4E90836419A80DBF9C09DD06F3DEEAA7DC47B75388A6FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445389, "uuid": "133c3d0a-63f2-45be-abeb-a3bf83a455ae", "value": "1536:jTHoKfqIK7w76HLEFs6VFhf9jhkknPddMPX6iPfjae5dmTSOLYw/BunLVJuW:PHvyI6t/6VFpJn1XgbaaQ3YjLVQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445389, "uuid": "70f8acd7-9428-48c5-bcd3-672de033cacc", "value": 76856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445389, "uuid": "fb41d5ab-c343-4720-b889-ec6ed739678c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445389, "uuid": "94dff63e-0fc6-4425-a8d8-2e89206e5081", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb480cf7-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454136, "uuid": "e1dd52a2-2194-4a64-91ec-fa8d5f59c49e", "comment": "Malware payload", "value": "9594de159f3e2fa24227f41bf81790a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454136, "uuid": "4cb84340-0a61-4fef-b060-f622bc1e1a60", "comment": "Malware payload", "value": "34a800f7ebe6b8d14e2f36a3f7f3c2aa07130891b43e6b81229521e77284d367", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454136, "uuid": "a8d67e3e-f97c-40c9-b6da-e6ed6b56c556", "comment": "Malware payload", "value": "8a429134350c1ad695d440113c6c44d704373b58", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454136, "uuid": "63d8714f-7797-4566-873d-4da9588308b2", "comment": "Malware payload", "value": "ef962327f31bb180c6e2cbac42752b105fd192b0f39f40d136df8a9bee8bd5cd60ab1f6e01fde04c40e83dc44c355846", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454136, "uuid": "afdc47db-1417-4ad9-8746-0c39d6d0d052", "value": "T11314D0D8293B95AFC24923362B5318995ED6DCE6133846F49B05723B3B8DDF0B8BB051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454136, "uuid": "dcf825f2-8580-481b-bff5-b056b3d08ab5", "value": "3072:ZNWF2jQ0Ria66vZdtEJly8a4AEgfLjxoG9Al2/df57icTOUQ6J2xidjYyVJ3w:7o21Riaxvv88EoqGRPjDT/V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454136, "uuid": "523bbd3a-0542-49f2-ba59-b68a3e973ff4", "value": 202643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454136, "uuid": "09d6f9d7-6adb-4a75-8a0d-6d093aa7e3a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454136, "uuid": "770e502a-7278-4f49-97a5-4a1f8d7ddaeb", "value": "I5yJ7zC440QhLU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a3289e-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443205, "uuid": "26cd90a0-3baf-43a4-9a7f-acceec00f550", "comment": "Malware payload (Mirai)", "value": "b31533c546de41c04db942136b403020", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443205, "uuid": "4172ce97-6750-4fab-8f81-a11f233cd34f", "comment": "Malware payload (Mirai)", "value": "34f26a27851b45174339853cff95b2f4aaa810397b1461dc5bccaefb79c3fc4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443205, "uuid": "be7f6dbf-5047-428e-8456-a569f4f1cabc", "comment": "Malware payload (Mirai)", "value": "8c9875b6c3ae3f97e50169a50fb3ca14e10ab46b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443205, "uuid": "16e4bddf-567b-4b28-a371-d4504e2a9588", "comment": "Malware payload (Mirai)", "value": "1bfd6356fa2011e7c21445b2b2bd72ef6ac91cbe393d48f8a07b998971e3aba5a1b0ae98d90de22c141ce5e238d258c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443205, "uuid": "ae3e50e6-9cfd-4145-980d-7013543467a6", "value": "T102A2CFE6CC483D95E9F8E4711D48E3D123452E6E27B289EB2585EF169163A22A3010EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443205, "uuid": "2274056e-1abe-4e7f-8271-18834134f358", "value": "384:SdFXiCzZqHk7PyVZUV5FSOCQUDeg9G50Mq+6EbEMH9nyXe0M4uVcqgw05VxJa:SdFXiVk7PvVXTXUj2Z9n4uVcqgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443205, "uuid": "10c559e1-4e71-4bac-8c0e-a6e5d7f59c46", "value": 22080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443205, "uuid": "2ed7837f-346a-4d50-a5ea-9738d123ef82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443205, "uuid": "0175a19f-a340-467c-ad8d-98cdd3dcb971", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f08f237-e83d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401153, "uuid": "52e1303d-1851-458a-9037-aa6ea63a003c", "comment": "Malware payload (Mirai)", "value": "1cba7055dd8580b230c7d8b130dccd8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401153, "uuid": "aa6fac48-727a-413b-a5ed-c448b7a4a2ea", "comment": "Malware payload (Mirai)", "value": "357d8f27a5741306cb74a145b020ff4fcf1e3152988979435d46ee191c138f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401153, "uuid": "24a5f2cb-827e-46c7-96c1-258dcb1cfa48", "comment": "Malware payload (Mirai)", "value": "8f414697282474ef9385cb4f9877a6c1769a1ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401153, "uuid": "39050a25-96db-4fa1-bb08-df7781ecce69", "comment": "Malware payload (Mirai)", "value": "7d2078217aba77ecf764dd14aba6e89aae2a137ef12dc34dc59cb9f43d88b5288bbbac9e1fc202051a5c546826ee9ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401153, "uuid": "1c8a9f84-8d45-4a13-ac72-530e731c7ad0", "value": "T1D4531845BC81DA17CAD462BBFA1E42CC332653E8E1DE72079D116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401153, "uuid": "51ddfc2c-4c3f-4dc8-925a-ca1dee17c965", "value": "768:gMLtf0Bd2xQMGWoIUXYphdE2eR9nwNx/WFWhBhVS8HemNsUh6BLx4ueMbZu+7R:L5fSd2CXYze9Tnwn+wh/HHYUWxDu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401153, "uuid": "f1837a84-529f-408a-b243-2ef878f32efd", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401153, "uuid": "cc8a97c2-f4f4-49a1-a2ea-2d881a96e70e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401153, "uuid": "afdd6911-123f-40f3-97db-7999247c4cd7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba5760d-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442836, "uuid": "78199059-d199-462f-87db-5de70ee7a2ea", "comment": "Malware payload (Mirai)", "value": "d595ec3ec3f171f3ed6b75f5af8e3dde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442836, "uuid": "5fa9b077-a9a0-4cf6-9ad2-32f3fcabd162", "comment": "Malware payload (Mirai)", "value": "361532a67f659e1789d6aefc8a6738fc79fe40438cf4408d848ecc53aad7025a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442836, "uuid": "073d8938-9c1b-4fb4-a77c-46fb081b5cbc", "comment": "Malware payload (Mirai)", "value": "efa76c88d4ff29af183f4bcdb745e1054b273028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442836, "uuid": "563c24f1-c480-42a6-b559-6102273f5bf8", "comment": "Malware payload (Mirai)", "value": "7ee963de89a2322b69305facbe157aecb87f61d54759499da0a6fcc6abdb9e3378bcc3bded5678d8b75b2a71c6da917a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442836, "uuid": "de952fd6-c142-45f1-b75a-54ce1599d230", "value": "T193530945BC81D617C9D462BBFA5E42CC332653A8E2EF7207CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442836, "uuid": "76fe12ad-1178-4ebf-83b5-e146e2c69ecb", "value": "768:k5BzSXi2bMgSf+7AVF2MlLOZLYNz0th4RyRiYh3UM2J6yN+ThTm0iuM7R:6NSy2UF2eLOLwwtKRAhk7J6JeuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442836, "uuid": "bb5cf5a8-9b10-4e92-9040-5fb66ca9fc75", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442836, "uuid": "aa71d32b-a801-46d1-b101-a5bcd4ae12f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442836, "uuid": "d86221ab-55aa-41a1-8e28-8939e117ea2d", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21c5f51-e881-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430391, "uuid": "d29a15af-0f0d-487c-8463-a9787bcf5c65", "comment": "Malware payload (Mirai)", "value": "a62bdfb140182d09df52edf8db065a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430391, "uuid": "1b7f5732-c2ee-4f53-ad18-65346e55f8ff", "comment": "Malware payload (Mirai)", "value": "366c37db69fc3cb38621602c56cc62759c01fd422b1c55f217f0769a52dff9f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430391, "uuid": "8cfe69f3-76c6-4edf-92cc-04373492c174", "comment": "Malware payload (Mirai)", "value": "b854d1f8f39d63e59e645ef6b0efba42a80c9293", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430391, "uuid": "58e95822-562e-4a6d-9dbc-d3937133890a", "comment": "Malware payload (Mirai)", "value": "b55a083e4217e9ec45b385dc3c402f315b0a84eb5b5cb03e50fe74bc62500ada9aa3c7d89a4afece6a6fddab7a05837f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430391, "uuid": "2f36dab3-2c44-40d9-a933-cd56deb79203", "value": "T115538D37C87EED94C18885B4B9B1CABD1B93B201D6532EBB1985C5694043EBCF60D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430391, "uuid": "519189fc-d6c7-44df-9eb3-0c4efcab8715", "value": "1536:IaLwtKDtzbe2rQnukodaaUTUXU/g5a9M9C+c0u+7R:IQLt2OkMZUT3/Ga9M9s0u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430391, "uuid": "a0b1a4ff-3996-4229-9ec5-4771f4cb55d9", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430391, "uuid": "b38dc33d-1056-4c01-9551-31e39aecf842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430391, "uuid": "f427abf5-d245-48c0-884a-1174206df924", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302b8d36-e877-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767425905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425905, "uuid": "f9375971-d833-4997-b68c-51a6675dfce5", "comment": "Malware payload (LummaStealer)", "value": "b8cbc7013280c98202d4a3ab877eaacf", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425905, "uuid": "35046d88-3c30-4462-b55e-3f62053fe558", "comment": "Malware payload (LummaStealer)", "value": "36affcd6beabe42014933cdcafc6956b843de7f6b02e58ab3650fcb05f3d5a67", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425905, "uuid": "bbfc30e8-d077-4b3d-860a-8d9727c77ced", "comment": "Malware payload (LummaStealer)", "value": "b3beda02b5af51ddf02eaed29a38aea087e74a72", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425905, "uuid": "11b7dca5-7075-42d2-9819-f8db9c02c7bb", "comment": "Malware payload (LummaStealer)", "value": "578210fb47beaa947767b12abc8ee74aaf7ac828e5c10b8ddbbbe2df66706575fa648926eebc4638a0400a6312a84e78", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425905, "uuid": "ad6cf058-d9d7-461c-9b58-96f0e7317682", "value": "T17765124073E9C422E8F24FB9E9B66AF31931BC61D924825F9F517E4D7832B809D31366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425905, "uuid": "0d1c70bd-8ae8-49a6-a8c2-6279e71d7b38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425905, "uuid": "0c4f7a17-9286-406d-8f4c-5ee3f821bab4", "value": "24576:k27IAiueYnzzVTIXwEVY4P+aNg8i4uouJ+CtHyzjuYkBWU:tIAec/VkXwwi4iJMjuzBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767425905, "uuid": "ded83458-cde4-44d3-a0a0-85766a069186", "value": 1411584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767425905, "uuid": "e726d169-d60d-407e-a223-18538d3636e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425905, "uuid": "bdb9ee7a-e174-4147-a5bf-7fc0f0eeede9", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c325b2-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465161, "uuid": "4d115a31-4d0a-43cc-a8e8-1dd633d0f5d3", "comment": "Malware payload (Mirai)", "value": "9bcbbd3b90b0638bad8cbede78ce7c1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465161, "uuid": "77ec72c0-c515-460d-8c58-c6b288ceeee3", "comment": "Malware payload (Mirai)", "value": "3756c366524f4fcb4e67ab276eb497f0eb53c73e315c57ed25962f4198d857dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465161, "uuid": "3133ce1e-99df-4d19-9675-e81fac78829a", "comment": "Malware payload (Mirai)", "value": "5a5ecff1d42475cca4256d9e2b077c44b3e0f0fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465161, "uuid": "85501058-d5a3-4b43-b1cc-61524497ef9f", "comment": "Malware payload (Mirai)", "value": "6df36c9938b16412632dd2033c31a2ade96c44fc143dc46bf566d4a076ba7936dfb8aa744613c9ddcf75e71cbf37db26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465161, "uuid": "d3782733-7503-4804-a97f-291f14595236", "value": "T1E4A34D92FD81DA12C6C562B7FB1E528D371753A8D2EB32038E265F21678B42B0E7B544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465161, "uuid": "6830e88e-ac64-41c6-ae23-d9011265c354", "value": "1536:C1sD7smJGE54eK6Aq+SKylpYto9NwaP5bbszj/OkQUvuzQTGEGBuEK:C1sDgWP4nq+SKaZ9N7RbbkVToc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465161, "uuid": "d4b3b4b0-1ec2-44dc-9c14-24782e33b4d6", "value": 100428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465161, "uuid": "ffb77df3-9a27-4948-bb19-ea6c8d8b5ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465161, "uuid": "9751aae1-ebea-47f8-b866-b63ea7bc1980", "value": "arm5.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee19077c-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427942, "uuid": "6a176bc9-2b7e-47cd-9948-82b0831711d5", "comment": "Malware payload (Mirai)", "value": "f95318eeaff588877a2cf0be701279f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427942, "uuid": "f6321b85-eec7-4646-8c58-563a71604b7f", "comment": "Malware payload (Mirai)", "value": "382521c8aa4702fde32a4e8d1678515192a87b8ae838c47ae72eac67484993ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427942, "uuid": "9f4271eb-0ca4-4c3c-a7f9-44c7df59100d", "comment": "Malware payload (Mirai)", "value": "8720f678bd6335269a9d979a80f5a13ef7a064d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427942, "uuid": "46580f82-c1a6-410a-8559-1abf6b2f4665", "comment": "Malware payload (Mirai)", "value": "994e99563caa8872841523c7d50c94d86503b3d850103707227ae80dc3c1d67038183a333ee29b00999f0bd8e35bed5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427942, "uuid": "38167125-bc2d-48c0-ac1a-ac4fafc9039f", "value": "T133E35CC5F643D0F5E95205716076EB368A76E03A202BEE83D3F99A36EC52A41C5173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427942, "uuid": "69729d60-8ce6-4ea8-be4a-60d7226edf19", "value": "3072:0dtJ43LKTmHprtLCX7CZzXOjULM+u92emtgcX43xalyuDHTN0k/j1:0jJgLKTmHpoX7wLMl3xbQTWK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427942, "uuid": "b4116059-8064-4ed5-bbde-447fe1fe2ccc", "value": 147592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427942, "uuid": "0875b8c5-3f0f-41a2-b2e9-0832e5e2da51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427942, "uuid": "63b11837-d1c1-4625-81de-074dd6961afd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451703d7-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427229, "uuid": "97bfac01-d6c6-40cf-a552-243500af66fc", "comment": "Malware payload (Mirai)", "value": "722f5182a4dc82c550d5605c42c5470d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427229, "uuid": "5f582947-049b-41c8-a883-cea19d80ee6f", "comment": "Malware payload (Mirai)", "value": "38b3192b7e792073bde272b917f53336ad35d17482d5140b362f697861bd2c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427229, "uuid": "95971f60-5aff-4018-a5dc-a77c4ec5416b", "comment": "Malware payload (Mirai)", "value": "27e5448c0c9c40add828ab443f244635df9ff1a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427229, "uuid": "d350ad4d-7fee-41bd-b2ff-d42655bc1b31", "comment": "Malware payload (Mirai)", "value": "2fe6950006b6fb48a90560ab8a43a535a32ccfc66aa6888486b12722aea47ce5da7d261d7a71181f6a72397a7c9e0e65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427229, "uuid": "edd1e11d-3de8-4465-9c37-8358ed2b2d33", "value": "T16EB36B03A342D5B4F96A81B124774F3A4331CA3A0015CE62CBBA5F73ED65942EB9B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427229, "uuid": "eb46f824-56f5-4807-bf87-6da911fd2123", "value": "3072:ykes+th3pZkmMJfWfF4xLvmaawQw773RXFtrv4j:ykyK91vmaT35zrwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427229, "uuid": "0954b571-ac9b-4de5-bda7-8b7861164a55", "value": 114340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427229, "uuid": "7191fc72-11c9-4626-af4d-9d8c901030d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427229, "uuid": "a52f922c-8e0a-4b54-8891-1bc363eb76f6", "value": "rondo.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e8b743-e8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767448700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448700, "uuid": "b141f668-d2da-47d3-b951-b23330b35dae", "comment": "Malware payload (SalatStealer)", "value": "a9ef0415fd42336ec4f3da0df514f24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448700, "uuid": "75dbc706-3984-4d66-af4c-441a826c9a61", "comment": "Malware payload (SalatStealer)", "value": "3b4ddddd6f9789154c4fbcb5dbf1d322a9ec55754684cab38eb5fa2a504816f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448700, "uuid": "0c0b0c2d-45ca-400c-a828-f174f7bd681f", "comment": "Malware payload (SalatStealer)", "value": "372b50282565ded73d1ba361a438ec5619384bf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448700, "uuid": "1750a525-32ab-46ff-ba5a-11140152cefa", "comment": "Malware payload (SalatStealer)", "value": "fa614a6d1ddce2f6853830e782d5cebdafcfd7ab99b1e8f17c928a1361a29c5d10deea52c982e5d0988f954372118581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448700, "uuid": "e6c80b69-b3a7-4d16-93dd-7b9e996a7098", "value": "T1BBC65A51FA8B54F6E9071831405BB23F23305E048B28DBDBFB547B6EFC7769118AA249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448700, "uuid": "8d6fed4e-88d4-429b-8f8d-aa157c893067", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448700, "uuid": "56a41630-b90b-475d-88c4-f1bb864cc54f", "value": "49152:LZLfJ8g6n7h3pVVR2UArFlw7LErFQrhxBq6ffaxQxiQPNxqPcITACzgOnN51AVXI:lbJ6FX2jMkWMqoNyWbGbTPnVrcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448700, "uuid": "a472bb9b-0ea9-4bfb-bad8-9b5733ecb238", "value": 11658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448700, "uuid": "16835b1d-8540-4c92-beb9-8292f46e2dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448700, "uuid": "8605a7ea-e19d-4b88-a922-a0f12d972fb8", "value": "SharkHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7534dbcf-e83e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401540, "uuid": "8fa8fb9d-9464-409a-aa27-9dccf0bafa9e", "comment": "Malware payload (Mirai)", "value": "0b4e74ef680e6b3999c50ceedb2186d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401540, "uuid": "ddabdcda-205d-4bfe-b6ec-ad6f13670d69", "comment": "Malware payload (Mirai)", "value": "3b77c047ed6dde4c9b6da088d07935f6aabbbba2139af90b72c696fb1b82be0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401540, "uuid": "725a464c-543d-49cb-a9e3-0b78fbc9cfcd", "comment": "Malware payload (Mirai)", "value": "e4b9a411989b82cd151e600c9b2db9fa796ec2a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401540, "uuid": "cce7fd47-146f-4704-b74f-b4f86b4821b6", "comment": "Malware payload (Mirai)", "value": "aad5c11f0ae6144580a18b582109bf984ebac7deff5d8b9b03bb25d6af52b85c151c4c1c0780235442589700ef9194fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401540, "uuid": "01a25e8b-6984-4e4e-a465-9a17d5273eb7", "value": "T1D5141B46F9828F12C1C122B9FA5E418D33136B78E2EE7212DD246F6077869EF0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401540, "uuid": "913651f0-f87e-42db-9094-da991a945f34", "value": "6144:y3qiKQZwSoLmwpkXbzOOaugciNMdgc6xP:y3omwvLmEkXeOa39NMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401540, "uuid": "0e6ab8c6-4f95-4b4c-b7a8-1102be6b5128", "value": 209020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401540, "uuid": "c09dac9b-efd2-499e-be57-6f2912fbae83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401540, "uuid": "972f41e5-8cbf-4c19-a276-e779126d854e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534cdde5-e8e9-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1767474927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474927, "uuid": "0aa3ea10-2ecf-47fb-aa22-4d30e507b747", "comment": "Malware payload (ConnectWise)", "value": "92e4c21f44446ded3f86ab27bb49b0bd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474927, "uuid": "632aabcd-2ddd-4296-8a95-4e903359336b", "comment": "Malware payload (ConnectWise)", "value": "3bf6776013c278af397417b221a2e356da3727f4270fddab32f4ee66b7103893", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474927, "uuid": "03fc0ec6-5d5e-4b21-b36d-88485ebbeac5", "comment": "Malware payload (ConnectWise)", "value": "ca2d1537dffc1f7cedf4b73795637adc564b69dd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474927, "uuid": "3b82eea7-3b4a-4917-8b4e-e1dd76da0fbe", "comment": "Malware payload (ConnectWise)", "value": "aa2e7d3339c7b1550340d06a9810f80f32a1b8dc7500b141512368727a9f8164b08dcedc3b4ef8b5e7dd2796475ae222", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474927, "uuid": "0725f2a0-1c30-4038-a4c6-72e5b1003c6e", "value": "T193A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474927, "uuid": "9c2b3cad-8af0-4c31-8212-80215ce28c2f", "value": "196608:VKaLNkbgzi4QHKaLNkbgRKaLNkbg1KaLNkbg:JWgziHfWg1WgpWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767474927, "uuid": "87f2b559-9b70-46eb-bdf9-2b1e06eec819", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767474927, "uuid": "c3d0e9c4-d94d-40a9-982d-264cda009b2b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474927, "uuid": "84e41415-ab0b-44b5-b84f-bcf03023c227", "value": "EFT_ScannerCopy.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768eb9fe-e885-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767432036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432036, "uuid": "ecb9d184-e5af-4f0b-a178-0c60719a1d8e", "comment": "Malware payload (CoinMiner)", "value": "ec994c2b34e3ce497b334a9a3ce8c570", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432036, "uuid": "1a47e453-e6ad-433f-9d55-a4df0714239a", "comment": "Malware payload (CoinMiner)", "value": "3d33f70bccd0e45e0ecf02f544f58930492a3aa67b76483319567a3c1fc31bc3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432036, "uuid": "d686595f-c338-4cb7-a7d8-7f37df0a3084", "comment": "Malware payload (CoinMiner)", "value": "4e8f1577f260381b4b676a39ffc42d23ff84efec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432036, "uuid": "884650af-bd47-42ee-86ec-d3be8284f0db", "comment": "Malware payload (CoinMiner)", "value": "b34c9bdd04d0913a3c9aae9a256012a1a3b0f74831d7184f93a829c75d79b432d2d4435fff8f46d2732a3eb2953c18c3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432036, "uuid": "9f8b734a-e64e-4438-bfcb-cafddb57edca", "value": "T1F196F000FC9B45F6E406563199AB62AF2738AC050F32DA97FA447A7EED772C50837249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432036, "uuid": "3ec3c788-f118-4856-b83e-6f1065182a4c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432036, "uuid": "80aff2bc-eb09-4888-a8c9-621c33c8d26d", "value": "196608:iYoznn0RokOwJvqISYM3pNVi979P574iOT4GF9Y:uznco6JvqISY+UPB4iOTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432036, "uuid": "e7c042fb-e1d8-487a-ac9f-11fd02fa9035", "value": 8678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432036, "uuid": "1ce8f8ba-334e-442c-99a5-f17c3b2b616e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432036, "uuid": "4aa61214-7855-4cd3-b3a7-efa6ed21ccb2", "value": "SecuriteInfo.com.Trojan.PWS.Steam.38868.29914.23425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba85a29-e899-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767440527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440527, "uuid": "088514f1-ce8c-43cd-8bb3-92be95aaecd4", "comment": "Malware payload", "value": "71ecb79adf7378f62264f1e5852f331c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440527, "uuid": "e5dfe931-2af4-457f-a775-b80fc13636d1", "comment": "Malware payload", "value": "3efe6c4d742b56a5e45d236628b66872221620311d2d7b8e5aa1bd728f1f28b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440527, "uuid": "76919641-f91d-463a-a641-40587c3313a8", "comment": "Malware payload", "value": "4336a7ff3d010659a5d76fb89162ffe10c3423ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440527, "uuid": "696b5769-5ef7-4d1c-a410-c72baab85156", "comment": "Malware payload", "value": "bbc89505c9ba72b3a2261c08fce81f4c1c54c7b429c59882d34d12c9c0eeac528bda3f2422f0d1378d755b27d9a700b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440527, "uuid": "ca67cd3b-b8f9-4aac-a6b3-7bf10eb0143e", "value": "T1E006BFBC76047DE6666F577BDA96ADDC03B626239ACBA4CC4064B7C305A3375FE02804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440527, "uuid": "62df7c0d-b9e5-4956-83c6-0ad1b49b7c40", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440527, "uuid": "6e40ad47-37d0-4bed-89e1-0d3706bf596b", "value": "24576:VJ6vjKYvvZGfl3VosPxHxxcXDXIs7GX00Tztn05/9gtQwN9Txiztdo3f7Hmpt0zv:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767440527, "uuid": "05075008-88fd-4177-a5ce-5d6057097d6c", "value": 3963392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767440527, "uuid": "21e40ca6-79a2-4c08-81dc-eeb369d3fe62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440527, "uuid": "6ec953b9-c0a4-4830-8e3b-67696be31b24", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9201f719-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465153, "uuid": "a8b4213b-d2ff-4a31-a788-a6061c3b2e79", "comment": "Malware payload (Mirai)", "value": "b9a79d413314c45d891a8afd80b48829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465153, "uuid": "fd84853e-1583-4ffc-80c6-83958173822e", "comment": "Malware payload (Mirai)", "value": "3f2575b719ce6289ea9853283ea798dfa3fda8dd79481a3ea9e234a37028cf99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465153, "uuid": "a1a9d32b-c8ce-435f-b60b-6cda03d90164", "comment": "Malware payload (Mirai)", "value": "db4d5bd34b911cb62bab58eb2afc0ad8b3f23129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465153, "uuid": "5e329e51-d45e-4608-a085-4719ecb08cf5", "comment": "Malware payload (Mirai)", "value": "ef4a039192a20fb4438fb06a894f2ca722dd97f763c826ec2bc2bb8b599ca2308014398882dc4410a73761b0f068cdef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465153, "uuid": "12310c89-0821-4a1d-8674-a6d185e21ba2", "value": "T1EFD3C55E6E314F6DF7A8C33447B38F319758278636E1C685E2ACD5052E6038D186FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465153, "uuid": "83282aad-b66d-42af-a9b4-156bef640703", "value": "1536:e5hVGpM8mKTnhvLwRvG1qAgCBJJJjfxBRxBQuibDisaZFK9jqcDeTkGFebiKS:eDJ8PjhvLwRvG1qAgCBl7zZFK92cqenS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465153, "uuid": "f4fcee18-381b-4209-8557-2a98b2bf05a1", "value": 131320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465153, "uuid": "38cda280-39f3-4d4f-9bb8-0948edc83a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465153, "uuid": "a7b596f7-6e79-4a25-864e-09e946b294d6", "value": "mips.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3413340-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767443412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443412, "uuid": "51d51a1d-264b-41dd-8955-a0a60be96867", "comment": "Malware payload", "value": "b72b41eb3d379ca33c17173413306a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443412, "uuid": "46c370c3-85b9-4010-8a85-1a793c886dae", "comment": "Malware payload", "value": "3f5f46f0aeda2c8898f3673c0f2d2e3a1965e4189b8874ce0a9c63e80241c1a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443412, "uuid": "65afad4e-ca8d-49a5-8394-b63fc8df049a", "comment": "Malware payload", "value": "33cb74d318aa7eb2f7d0391ff1a5ff9d27ff5114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443412, "uuid": "2d653afc-ba4b-49c3-82c3-f5540e319f2b", "comment": "Malware payload", "value": "9fc2f2a431bf7970ad14e40b8fdcf397456509134722a77800a9555324d8591e80f4bbf8b3531246d241dba8c45bb02e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443412, "uuid": "aaa05a0c-fd15-4ef7-99b0-0046cae64673", "value": "T1038733D0A1988ED2ECB34B3C56A50911E32678B60F79C15762E2D6C32DA37C46B7B74C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443412, "uuid": "0e722a9e-5910-4e7b-b272-f251642e06ea", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443412, "uuid": "ed607891-d291-4bfc-9783-ce1eb882f502", "value": "786432:T2NgL8XMPBMc7D6J5ZGxFDmWKU09fjz6nhclOZNkr1W+e5Re9MXaxH:mHkGcowFyWC9rz4hdZNkBW+eHBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443412, "uuid": "96f86415-9616-4c85-a968-3bfe6a504b48", "value": 39221790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443412, "uuid": "1a6d9dc2-1416-411f-88b0-f6d7e3cd28ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443412, "uuid": "19c60dc6-b569-459e-aa44-0019238541b8", "value": "Legacy Launcher Stable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e4d74-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430653, "uuid": "ff8b2847-73ef-45fa-a233-92683ca44529", "comment": "Malware payload (Mirai)", "value": "9f4d297f4ed8b9dc156ad29b18887f78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430653, "uuid": "8ef462ab-244e-4123-babf-3beef079065a", "comment": "Malware payload (Mirai)", "value": "3f9df011bf84047e5d0b750b6fe8425471093a20e5c1fc4d4001fe7f6f8d6e97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430653, "uuid": "4ea4f0b1-bde6-44e7-897a-0aeccb748a63", "comment": "Malware payload (Mirai)", "value": "8bb503a3ca0232f48653047279a78f805bb5a8e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430653, "uuid": "f3ec393f-6890-412d-a7ef-6801a3a15533", "comment": "Malware payload (Mirai)", "value": "ed7288d2225be5dd8e91c384c1a471ffe0bf95073031b4bec7ad8546430732e5ff9218973687701b264b1f0d82072427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430653, "uuid": "dc27dbaf-445a-4fa3-9160-b45bb755f465", "value": "T18B63E74AFD819F15D5D525BAFF0E528D331357A8E3EA72029E146B2467CB82B0F7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430653, "uuid": "a0fe802a-962a-42d0-a49c-047702ff99ee", "value": "1536:Jxn4Ek3q3U8eusqXlaeHwekCOTB/ZGjqJEAXb4naqSllKYi8e2zTxsu+7R:wEk63QuRseHwektTB/ZGeJ5Xb4nZp2zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430653, "uuid": "8298dadd-8e9c-44c6-a443-318af4cba025", "value": 67844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430653, "uuid": "72c44123-b331-49d5-bd4b-acc96ba66544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430653, "uuid": "bc70d6e4-1cc2-42ca-8936-9d1426d7165b", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a02b11-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767444247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444247, "uuid": "661aad83-db17-400e-8b18-e3f62db0966a", "comment": "Malware payload (AsyncRAT)", "value": "cc302179ae915a300afd9f35fd8c446e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444247, "uuid": "7b739326-e101-44ce-a7cc-01562051d028", "comment": "Malware payload (AsyncRAT)", "value": "3fb74f626ee600cd36be84546dbea162456581fae1f9a512209e9bbdb0ec29c8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444247, "uuid": "cd25a0a8-604f-4f4f-8366-9ddd3dce6045", "comment": "Malware payload (AsyncRAT)", "value": "7af60ca4d472cb85a2580dd9c733119dcba8ed08", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444247, "uuid": "4a87e954-8386-418b-9149-05bbaf218a0e", "comment": "Malware payload (AsyncRAT)", "value": "308afd8908e9b9369059a84719854abbbd122bfcf3f3cf3536e068ead52f1fd8fa15ba02d58a7995bf366b0e13dca731", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444247, "uuid": "f2354e17-aa12-49e2-903b-31cb71ff4ebb", "value": "T16F232B003BE9812BF2BE4F789DF22145467AF6673603D54E1CC4418B5623FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444247, "uuid": "03cd0691-7c13-4826-a41d-5fbcf0b50b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444247, "uuid": "fd8925fb-b35f-4ee4-a849-b1b7bc242a7e", "value": "768:5uCGNTdxtrhWU5nGLmo2qr6caV91WMNOPI5zjb6gXJiSzsxKnOyoxK2BDZ6i:5uCGNTdri2FRVrT353btX4SoxKOuYd6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444247, "uuid": "b4245941-be49-4f3d-a3ba-f3b2b4863f55", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444247, "uuid": "17f5a28d-3f18-4f14-a165-387eeb2a3f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444247, "uuid": "45c4d454-d933-4174-96c6-8d72ed513da3", "value": "pinnacle-risk-optimizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df92b0a4-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443379, "uuid": "b6ee473c-f634-4676-80bc-091f05d875ff", "comment": "Malware payload (Mirai)", "value": "6e560563f689477ef615397a5565abc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443379, "uuid": "c01c9fb3-623d-446d-9e38-0af5d8d221cb", "comment": "Malware payload (Mirai)", "value": "40f5e462d45bd7b8ab0ecbcfcb61f8411df28d1e8151c32d672e94595cc43ffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443379, "uuid": "66a63bde-c9f5-4c72-8700-ecaca5fe698a", "comment": "Malware payload (Mirai)", "value": "6da92c10d5a311445bdc4b57b47165c21d710994", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443379, "uuid": "25d11e4f-9beb-4126-8f61-e95f68c3f4ad", "comment": "Malware payload (Mirai)", "value": "f70732573b11ce1003fdd6113f09465f8e21f135441064a2f5b8f95290860307c3e52fbfcb5c80e53868db53991cb78a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443379, "uuid": "0ddd207d-4428-49de-ab67-33abc417bff3", "value": "T18E132A31FA620D2BC4D495B671E70725B6F6834E24BC871A3DA10E8CBF64A807257BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443379, "uuid": "83b06650-b34b-4ab2-a403-96d3e206ad59", "value": "768:U+oWkEnm1ZdMlt4DJ8O+65VgN+qM51tAQIq:U+zk3VMltUI65DtLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443379, "uuid": "c56c8fc0-f76b-44a9-b3fc-796c1b13f28d", "value": 44820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443379, "uuid": "53d57372-6ffa-4ad8-8c64-c5f3ccb44836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443379, "uuid": "9a384ab2-243e-49ec-81a1-6637f74ad109", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01339a3-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459594, "uuid": "bf3cc69f-5ad5-4867-bcd3-e84e097b7c94", "comment": "Malware payload (Mirai)", "value": "6cf2750039bc1df27083f900999af847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459594, "uuid": "d354ae6f-4cc4-486a-96b7-4ab3c2d1ecde", "comment": "Malware payload (Mirai)", "value": "4231ebb949d9007d140786baae45768bd7c075574a478c18b3733aa055591663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459594, "uuid": "3f898f60-55c7-42f6-bfa3-149b737ece50", "comment": "Malware payload (Mirai)", "value": "d026fb6c0848af09893aa0e1505b8517d75c6c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459594, "uuid": "85d0509d-3692-43df-9e6e-290483c5b411", "comment": "Malware payload (Mirai)", "value": "2fba7a14af18927fe5ae724278ded7389ef000fc61e5418cbba5de9a060219d3efe8e5d837944cfa7bbcb3c7ab8760d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459594, "uuid": "ed70b905-efbb-4ec1-b065-0a3bb805cc7a", "value": "T189D3C55E6E314F6DF7A8C33447B38F359758278636E1C681E2ACD5052E6038D186FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459594, "uuid": "3b1de0f4-f7bb-48d2-a35d-4ce4faf35baf", "value": "1536:e5hVGpM8mKTnhvLwRvGteAgaBBJVjbxBRxBQuinDisaZFK9jqczeTkGFe0iKC:eDJ8PjhvLwRvGteAgaBh/XZFK92c6eCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459594, "uuid": "8e173e5e-0d30-4c31-9ce1-c052001b7658", "value": 131320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459594, "uuid": "382fa771-07b0-4b90-8b11-aada5718e392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459594, "uuid": "d9e6d5e4-68be-4b01-a66a-859571467930", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca52009-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427295, "uuid": "4190c0f9-648a-4c90-95f8-0c3bd8eba00c", "comment": "Malware payload (Mirai)", "value": "d586ed77dad69411506240f03777d6ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427295, "uuid": "5f381414-1ec6-4abe-b130-ed52724dfe81", "comment": "Malware payload (Mirai)", "value": "4264bc8146208f5444ad5dc015f6085dfa1ff6a596aac38c195ec3881431ea94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427295, "uuid": "e4099631-9267-45e6-87c4-80b147ae19dc", "comment": "Malware payload (Mirai)", "value": "8de750857e589d4fd53129c91c99b0cd64a10100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427295, "uuid": "138723d2-0aa9-482e-88ab-7fade900adf3", "comment": "Malware payload (Mirai)", "value": "038e859092d4c3c5b83985deaff9d6f9dd27f26f6a91d5188d774b97a6311cb7d29877cf3d30491f6789948ed5edff45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427295, "uuid": "2ccb778e-c3e3-42e2-b22e-2f4f9c3045ea", "value": "T1F5E37DC5E343D4F9E81241716137EB3A9AB6E13E212AEE83C3F99936EC51540C51B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427295, "uuid": "0a1f6bf1-6d74-4f91-b598-bbefd2f69e78", "value": "3072:WOCAQGtaf5NwdzISW+ZCsOtt4zpv/uh+413344keUElkBY:xCAQGtuNWsH+Ytye3Vb7lkBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427295, "uuid": "e0ee266b-0677-4797-a567-1bc069229d1f", "value": 154248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427295, "uuid": "7584b06a-0b77-4cf3-9b22-fe353ad741b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427295, "uuid": "b93b7e9f-56b7-4487-9ed4-21c0ef2a76f6", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37982fb-e8e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767471706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471706, "uuid": "9736e119-731a-4403-9900-29bb3829b2ce", "comment": "Malware payload", "value": "478506520e3d80ed6e655becac67fa34", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471706, "uuid": "02b2b5e9-bbc4-4dd3-a0f3-7c95abe8a481", "comment": "Malware payload", "value": "448563f007e88768dd3ac036250a19b3598951bf3f83ff8335fa19f04c6173e5", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471706, "uuid": "1862fcb0-1ee4-493b-8a10-a2a00b01dda0", "comment": "Malware payload", "value": "ad5b7c4f50ed8bf98133521a2d0127c092460f02", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471706, "uuid": "90807c98-097e-4515-ac32-51b250c0be50", "comment": "Malware payload", "value": "4e1592c8e734f099569f2d5c0288cc51624ce76120006a67795c120f507bcb6889fb9f338cf111b72437530930ff02f2", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471706, "uuid": "a153a04c-e2cd-4f02-9058-b4f459d790c1", "value": "T1FF37F843E2F4840DE11FC22E6115463FD223BD2D6D78B713D8368A096EA97B054BEB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471706, "uuid": "0fc5383a-31d7-48e3-a47c-2911250e4d9c", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471706, "uuid": "fc6e38a4-f925-4321-9c4e-77a18d572740", "value": "393216:gcJY0lmsuJXfTnO/8sQDMDjQbikRjFIUe/Hn480MSGf1N2WG1NoUioyYd+MA0R0f:VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767471706, "uuid": "1ff3ef63-772d-4c44-b298-6df08db146c3", "value": 22994944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767471706, "uuid": "a40129d8-efa9-47e2-90d0-7c6d71a3a535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471706, "uuid": "b4e2a4a2-465c-4fa6-a790-8bc229261b13", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deab444-e885-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431861, "uuid": "6dcec7e6-2fba-4d84-9a01-1d8ea82b8bfe", "comment": "Malware payload (Mirai)", "value": "baa1196b37fdb49548360ce05668cf51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431861, "uuid": "523cf028-0819-4d51-899d-eaf9e9d3dd42", "comment": "Malware payload (Mirai)", "value": "45f0dde1cbc67ea1f31f8d51e50207c6031d2fb1572f8081d786e9ccf748aa95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431861, "uuid": "85e7861f-340e-4c89-bd17-e1c6052df50a", "comment": "Malware payload (Mirai)", "value": "5d4269ab17a19a48aead25ece8557467bcb26694", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431861, "uuid": "0b0268ef-6667-4b67-b9ff-ac08217851eb", "comment": "Malware payload (Mirai)", "value": "823e5df6ef66fe90c9cccb62dc2e66de81c927a37df937a06d2ee63ef2613f63758ba1f07bfa672a54cccd3a71b854a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431861, "uuid": "cb2273b0-ee73-4124-b7c5-7d465f6cd5ec", "value": "T14373E846BD918A16C5D512BAFE2E118D332357B8E3DF73139D106F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431861, "uuid": "5f2138c9-f42b-4139-9743-0fc4ec08a8d8", "value": "1536:uRn5KZ9QUoN4j+zAfqgVTGseJHwe24JvvFSMNlT43wMZiF3q2VsIu+7R:NZSUR+zAigdGlJHwe2avvFSy3q2VsIu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431861, "uuid": "b3b05c4f-c004-4865-9c0c-4d8a4f5a5565", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431861, "uuid": "2dc5635e-d124-4e59-9124-29792745d364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431861, "uuid": "bb706c5d-9c43-44ab-843e-8aebc6f7f625", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138770f3-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445184, "uuid": "fcd074a5-0adb-4ccb-a94a-3f96f7b4564b", "comment": "Malware payload (Mirai)", "value": "00932f1205bc62bcdbb0814727592b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445184, "uuid": "c9ef6b80-0c6c-449e-9c9e-93ffad4e8bd7", "comment": "Malware payload (Mirai)", "value": "46280c6dceff8fe250699ec09396d2170a5ef12e74ffcca4a3c4ccbb839cc1d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445184, "uuid": "f9bb2376-92d8-4243-8962-188051b9ad62", "comment": "Malware payload (Mirai)", "value": "4bf921ef8d3253434ca1c3aa549348ece79edfc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445184, "uuid": "a1cd2f89-5764-46af-83e4-e68da0265fed", "comment": "Malware payload (Mirai)", "value": "bf47c3697db740bae58b7de4067c8e59a959e33a6e1edb30376980b15b5c22fb32f119ff66306e389d95d800b7730b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445184, "uuid": "06af0fe1-99e8-4236-9c80-f9435563f84f", "value": "T1EDB2D0CDE29C1987ED8C4C7921D443796483A7D263A69F6C33838C08FA9ED4BB89C474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445184, "uuid": "d54476a3-8aed-4247-92f8-43b9a1b62d1e", "value": "384:CfpCU00aldCbTpwbZCGCM0t/USVLDxfFy1lxGrjMKyk7k0lhVEM7cRWGVCz0Nvd:0LXbTpwbQGCMGUoDweJk0+M78WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445184, "uuid": "69d0ebc0-46dd-4f41-ab05-f4454bdadaff", "value": 24092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445184, "uuid": "3367415c-abce-4bd7-83cd-bed379771aad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445184, "uuid": "6faf2948-1457-4888-8bd2-479723d20090", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9353118-e89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442483, "uuid": "f6be9d1f-5314-437b-8dfa-2a75f7a700d8", "comment": "Malware payload (Mirai)", "value": "ca808aa197b894d82afd57938a5d0175", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442483, "uuid": "c949f5f8-185c-421e-9c03-5589c05d1f50", "comment": "Malware payload (Mirai)", "value": "47b6ea7455f1d34fb8f944247d09aa03bd0a8930c63f5ead420cfe9289a115fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442483, "uuid": "1e56f763-9bc8-4fa9-a315-46cb960f1d88", "comment": "Malware payload (Mirai)", "value": "2ff0e4cffa5e1766a66a0dfd04853eef9667bacf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442483, "uuid": "9fa98098-4bce-4ed2-a3a0-979232e83c21", "comment": "Malware payload (Mirai)", "value": "7cd624a3841054fcfdbf13a5e3d91cdb5b117184f308a651f05f5684ac6d58ea5dc4b3b91ecb42864970f1f5443bb1d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442483, "uuid": "28372cc9-61aa-4ec0-8444-9bae12f0313b", "value": "T1CE437E4372184A57D5E60A70293F1AE083FFAA6021E0B3C5645FEB6A8671F371086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442483, "uuid": "977ea169-f07b-4208-ae77-609d2121271b", "value": "768:C4O8kQlYyRCBwD4zsuTCS8nu2vnD4DIFc+Tv6cE/Zz4qPC3el00Z1vSn3Xi/lNuc:CckAf7uvUWGv5Exz4qDRvSn3S/XuM7Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442483, "uuid": "8a7756a3-e673-4c62-80ea-e2692b1d4fe8", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442483, "uuid": "3b6d0077-3c0c-4baa-a981-ed468576482b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442483, "uuid": "9075711e-8791-428c-bda6-a77d748e2428", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9149c9-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443966, "uuid": "5d210250-d495-4087-b7fc-9d8d1c535e88", "comment": "Malware payload (Mirai)", "value": "5e361de53f5ba76b90bb902cd75af79c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443966, "uuid": "f322d259-df6b-410b-a224-46d70bc7d8df", "comment": "Malware payload (Mirai)", "value": "487582b297127b1cce8109ce8d03927016677a17e7c0b47977da8091538e79c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443966, "uuid": "6352a48a-e80d-47c7-b811-a3cd9013e414", "comment": "Malware payload (Mirai)", "value": "ae04e415130591cc03a1edcca3e0d14db36c34c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443966, "uuid": "bbe3b49c-59f6-47c5-a412-ad26b99ffee1", "comment": "Malware payload (Mirai)", "value": "37e5dc1f75a08465b61894dfb31138891da39ca45a82fd2e8ece20bbf9716c29b66cb3963b797095b566024556317f2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443966, "uuid": "07f4ca15-4a73-4480-8a15-9caa3fad2fb9", "value": "T1E4041845AD418F11D4D632FAFA9E018833536BA9E3FA7102DD206F6173CAA8F0F76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443966, "uuid": "dd9e006f-27da-481b-8dc1-731527c304d5", "value": "3072:dQXtXVlWF3KFnMGoZ9LOSR40vVy18CIaxUH1SHs99JLR3fG718twbZnYwXD:dQXtXVlIKFvs8SRvV6lIaxUH1SHs9XtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443966, "uuid": "1490d7b8-44fb-4924-9f08-844e9d7c7c1d", "value": 175156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443966, "uuid": "9b49c7f0-d569-4f11-9084-fdf7b12b4169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443966, "uuid": "64759bdc-377d-4c84-a725-7b91d11814cb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5699633b-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463336, "uuid": "22ccb32b-582b-4463-8e14-73363c8dfa8c", "comment": "Malware payload", "value": "6f1f682da778221d8c9132e2295ef1cc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463336, "uuid": "0571964c-6924-4ee2-97f6-7b1269c3b849", "comment": "Malware payload", "value": "499f1c03c1b78b5074eccfedc7dd88270082e0019d3cf9fbc13d1d3c153c2a24", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463336, "uuid": "f7a7ba79-cb8f-4e0a-ab72-3f3d241b306f", "comment": "Malware payload", "value": "62b9fbb1143299d6c00194b6740166ece3fb23c9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463336, "uuid": "72c4c3b4-6d8b-48ef-be0a-47198458fde2", "comment": "Malware payload", "value": "a4bbbe7392399c4fff8b323703f31b096d5cddb0ebbbe1385fce3a846c3adaf3625b90d24e6c9d9abb12728a601693ae", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463336, "uuid": "97cba4cf-fd4b-4b2d-a79c-853c7141be23", "value": "T17CB62241B3E9D857E5B14F30E8B429E33A37BC610538871F9987388E4D726868C71B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463336, "uuid": "cf5a83e4-1c8f-478a-80c9-49a72871cab7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463336, "uuid": "bafeb404-c991-4537-8c8a-460964ca60cd", "value": "24576:Uwi9RnWDwaBNqsaFvJDXwN7bU0hBTUQ4L6mECZOhuCp0y2FQfEXZSF7GzwF:tUQNCnANtBTUpLp1Oh1j+IF7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463336, "uuid": "459e6676-c93e-4153-85fa-adff3f5b1f2a", "value": 10486272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463336, "uuid": "e10ef180-3b72-47ae-a282-26aa26b17e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463336, "uuid": "7921a1bb-f3a2-4256-9267-92da72d80120", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ca877d-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454122, "uuid": "9b0cdd49-8869-463e-94bd-c7a8c3355d9b", "comment": "Malware payload", "value": "cd0da699ddbcc1ef047890ca70417b4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454122, "uuid": "1a14c0bc-ac29-4e13-b3d1-c6fa78aebaae", "comment": "Malware payload", "value": "4a4aea5de7b193beff8da6611e9d11ee27ec53fc4fcc27356200b109aeff2ab4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454122, "uuid": "f9c08061-cfd0-4dca-9d1e-cc39a4d75177", "comment": "Malware payload", "value": "16bfcefb87ce2eed0f5b80cf90e1a7c7084ab904", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454122, "uuid": "bfc1eb01-c61b-4a56-a611-fb389a9df773", "comment": "Malware payload", "value": "4902d864f163e0f0793b3b9ac3992bf5c8424c4a34ec1508f11423fcb8144e0b5c7b19e9e39cddf9da5431b0da605cd1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454122, "uuid": "be616894-3bc6-4163-a368-248384114c3f", "value": "T12304E1F6BB008F1FDBCA1A571967A60DB02EE821DFA524BF706D71042197D84B4DBB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454122, "uuid": "e2773853-b526-4ebc-ba0b-b49882edc9ee", "value": "3072:Fx/SxiYOredX9JoFOeyWI+9jgT+MwKMMqb5URAyQd0m4dPpFC0M:Fx/SxiDidNLeyX+CT+P514dRFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454122, "uuid": "40ed7065-74ea-4c14-a7aa-dc3f4d3efc30", "value": 187658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454122, "uuid": "cf55cc32-8450-45d1-a5cd-1335810fd8d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454122, "uuid": "4570e1a4-2aa6-458e-b7ba-fb8365013800", "value": "cu21w45BD0bAwh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590cb742-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767443153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443153, "uuid": "a11acfd4-f73d-412c-9985-12592df29cc5", "comment": "Malware payload", "value": "5ff9be98fa1c240d2e16f244140fdc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443153, "uuid": "29e1bc5a-91c0-45b3-a2e9-545551742be9", "comment": "Malware payload", "value": "4a5d389a2b6280d48ff77a79b69b43f6cefe870eb564a8874377151debff3b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443153, "uuid": "6d780830-ec3f-4487-9f91-33601cca06a5", "comment": "Malware payload", "value": "b592b2039ae266df1497d86cbf8e4cc61ed776db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443153, "uuid": "0e1753ea-0d43-4684-abad-08002a408c00", "comment": "Malware payload", "value": "d708e0eb5541a506404c9c665bc8c015e2da7042d4f10a34dad0169148d2ad91df7ff7bd11bb643ecd7e687d3f7da7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443153, "uuid": "d78864f3-66bf-47e8-a07d-05d4944b9afa", "value": "T1F7086B4262EA04C4F9F7DA759AE66617C673BC122F30C5CF221C17291F736E09976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443153, "uuid": "32905b1e-6379-480b-a018-09047012db08", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443153, "uuid": "53738bbf-5ad7-494e-8ef5-6d96bd84c698", "value": "393216:skmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNo:s5NmdsJY62A0y8Xy5rs3wbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443153, "uuid": "98e8bcd6-74ec-4f96-9c16-70e70cf0621e", "value": 82049018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443153, "uuid": "4a19daf4-efec-4375-822b-849ddcdf56c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443153, "uuid": "affd74c7-c901-4c3f-8490-c5e04e02a9fd", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04271f90-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399202, "uuid": "b995289d-ccae-4c5d-a6cf-dcab1831ea0f", "comment": "Malware payload (Mirai)", "value": "96a37eb86555deda7928dd1db66509be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399202, "uuid": "64b51f00-bfe5-4a79-beae-0e38f7c1f077", "comment": "Malware payload (Mirai)", "value": "4b35e628dbd39a1bcc1c561db28d723c42fbba906294d7c61c8f450d1748088c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399202, "uuid": "dfa90bc0-9f89-4a2e-a7f7-5e5b6c3f2efe", "comment": "Malware payload (Mirai)", "value": "68f1b8ea18909000dd6dff25fcea24ccf95f0245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399202, "uuid": "05b1e8ef-1312-4775-8967-992b237fab9f", "comment": "Malware payload (Mirai)", "value": "792f943ef7bc5fc83cf6609a3bc5f65e37863977c6184fcd110ad70a24c97cb12f68760ff3d52d9de1b8c32f81969f3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399202, "uuid": "06d78878-0f12-4771-b7f3-15dd7b83afab", "value": "T132141942BD518F13C5C622FAFBAE018D37166B69D2EB3103DD21AF61378A5DB0D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399202, "uuid": "5cff8624-24c2-46d4-8634-4c458359ac55", "value": "3072:stxSpsIQOQt4C7TcTAPJDlNTDA5NS4lBfxqtOurpDRS7AJK:vsIQOQt6TKJBNTcLS4ljqIutDRS7AJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399202, "uuid": "893eb52a-b786-4ec5-899a-fa446ed731ed", "value": 196680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399202, "uuid": "fb8e7e0f-5fc3-400f-ac3d-463a43aab755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399202, "uuid": "a7103e9b-f9d6-4711-b273-68fcba3a5614", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bedb22-e887-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432778, "uuid": "d99386b7-8d9f-4d3d-beda-2502827fd599", "comment": "Malware payload (Mirai)", "value": "7ef8a03f0582ff5b9d2352d162b87278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432778, "uuid": "50989a4c-641b-4fbd-b4b4-4beb87097299", "comment": "Malware payload (Mirai)", "value": "4be3e2012e596696c0e66ebd67456791dc3f196af64c5587c2cdf65ef10eff64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432778, "uuid": "f41726a5-6758-4135-a241-df9936b68c59", "comment": "Malware payload (Mirai)", "value": "cb9c1d5741608d87e0c9ffefd1de99c4d4493b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432778, "uuid": "48bd69df-4465-423d-95ce-a4714927f54a", "comment": "Malware payload (Mirai)", "value": "560f0d83db58d0d8e0014ed1232b578859ca347a7a6a21bb0f6a972a11ff287b4304f312d40f7264a43c2f3df09f51ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432778, "uuid": "c2362349-e2a7-454f-b0d6-61ab323f81a3", "value": "T159635C22797D6D1BD4C4B47A11F74339B1F2270A26A8C61E7E720E8EFF207502257AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432778, "uuid": "bd045c01-e708-477f-9b3e-35309a248663", "value": "1536:1ajLSCNTCq1Pjs408VZeYuBBy+6X74QvEeZoDhiHge+chNg:8juCLhjXReBXS2diAe+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432778, "uuid": "d1a307b2-92ec-4269-9c70-79f38f8e5eca", "value": 69792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432778, "uuid": "d52b2706-f431-4156-95cd-6e176f08878b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432778, "uuid": "96f08163-d699-4a2c-9335-e998e009d3ca", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfa4a5a-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462489, "uuid": "c539b99a-669e-4aa1-a560-83c112adb3f0", "comment": "Malware payload (Mirai)", "value": "e73691be231ea70465d934914059e382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462489, "uuid": "570384e3-aaa3-4244-b449-33ccba2a1879", "comment": "Malware payload (Mirai)", "value": "4d515cda405f3c5c5f2ff966546efe9ff1bc80c4381f63b0460b185f33ed0aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462489, "uuid": "060f43da-00d5-4b86-bf38-510323727ed4", "comment": "Malware payload (Mirai)", "value": "253be4efeb76728539e7b58c5aa51cd9b4b9676e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462489, "uuid": "4a582f26-acce-46bb-968b-a45065295a6d", "comment": "Malware payload (Mirai)", "value": "266087e091afd7456cf530010f068f7601383a46fdfd4ad165d99842836cc20da42fe2f211428f0cdc2e7344fc5b1acd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462489, "uuid": "c24693b9-ebb6-45ec-8f72-70ccb1aa8d32", "value": "T15C93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462489, "uuid": "a7ee7d78-9ac9-4d14-9c2d-31bf6a1367f9", "value": "1536:NYCYxrXP40ODpPwHRQ9PlzTRfyToNoZq+i:qCYxrKDp46N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462489, "uuid": "6c1bd670-152c-4248-8a90-59bec1943e03", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462489, "uuid": "64ec8772-bf4c-4e50-9b4b-266f48e29746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462489, "uuid": "7ce987be-3962-4cc2-aace-031c965bac12", "value": "loligang.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a38f3b7-e8e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767474562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474562, "uuid": "0e4a8f7d-b10d-461f-be83-128b6478ab07", "comment": "Malware payload", "value": "3f0965d0594391dbe727bb86b5b121bb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474562, "uuid": "24b7a914-4cc9-41a0-ac08-84c0fdb49110", "comment": "Malware payload", "value": "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474562, "uuid": "2ea4eaae-be82-4796-b6bb-04dacc352db4", "comment": "Malware payload", "value": "a2c6ea56c098d29f0fea153975f1b025f52c2b00", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767474562, "uuid": "4baaa182-df3e-4cf7-83f3-898d4c72059a", "comment": "Malware payload", "value": "5dd00fea25afe24e19b3188f5e97b5973ad5e8563c78c86169871369e10919a22e53565b71ea6ed08a03c058837523bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474562, "uuid": "75499515-c977-4393-ae94-4c97ed06bd2d", "value": "T17347CE11A3E802A9E6BFC238C5725116D7F678462720D7CF2554A6E92F33BC09E79363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474562, "uuid": "6dc44208-51a7-4d02-a616-91a60d00917c", "value": "b819c89ac9b569d0bbb77889674017b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474562, "uuid": "7746285e-037b-497c-8344-4f8aaecc3134", "value": "196608:gBsd3+XNqcBQ9KRIWGmX+/ufnHEI5DEzoJc1MF70baKw0PKPRiM3IVNEC7BwSN7x:BAXhBQ9KOo+ykZM1Aw0P0Rzq1tcX9QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767474562, "uuid": "05808fcd-0ad1-4e28-bad7-a23d4937ac0e", "value": 25268810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767474562, "uuid": "2200f03b-29c1-45c0-b5c4-215105976675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767474562, "uuid": "db877245-1c0e-4a6b-b43a-0acec22afbcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb503a7-e8a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767444775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444775, "uuid": "34dee5c1-2c1c-45ad-9fd7-eb126b090003", "comment": "Malware payload", "value": "7a2036898f0db073eeac04f9ecd6cef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444775, "uuid": "ec5c6c6d-6c67-4115-8e85-e4a957dbc39c", "comment": "Malware payload", "value": "4e4301bda1cc5a02b6855b66c57d0d60b1fcbae10dc83ebc582b70486f65d3f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444775, "uuid": "515c0c5a-8e57-4c88-84ad-dee3e2965ad3", "comment": "Malware payload", "value": "65b98f286e11fa7aea43930c1a74c0127390564e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444775, "uuid": "3fc6cf34-6395-43c0-95ed-e2b4bb9f1113", "comment": "Malware payload", "value": "95e983bfce467238132f421f62214d8f77b4aa07fd184f333c7ff8a3f827635d580402dd3c0e4d319dab2ecf16864359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444775, "uuid": "eb6c056f-17c5-4f2c-b25f-cc8c0fa1eb56", "value": "T144763A93EE905225C59BD278EE75A2857230B044133123C3BFA35BB65EC7BC4573A72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444775, "uuid": "fe6d33e4-bdd7-4272-9b67-e535f1d4c9c7", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444775, "uuid": "0fd34122-bcde-4b49-8824-3a159c53ca76", "value": "49152:hUx5frb/TwvO90dL3BmAFd4A64nsfJcKtSStGmqw7W6x80K/NQLFCvpni9YyK13P:hUY0Zz2IQ3YQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444775, "uuid": "1cf76c4f-0391-47ff-b8c8-a5e16fbf3981", "value": 7451776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444775, "uuid": "e785c1fa-524c-483f-a76b-133994adba92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444775, "uuid": "0e4a05be-e457-4594-a314-e31594ca2dcf", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487e3c79-e8a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446991, "uuid": "6559f152-239e-4c43-a66a-02ed071cde9a", "comment": "Malware payload (Mirai)", "value": "fe04c7640cd7c4aa8cd87c11dd42a392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446991, "uuid": "ac12166f-de82-4708-b259-2b45944e72f3", "comment": "Malware payload (Mirai)", "value": "4e49fbeee717728935e64e493d8b0685c0da63b15b10c5c8875f1499e8a89a92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446991, "uuid": "b370abd4-2f0f-406e-ac92-514e3527be34", "comment": "Malware payload (Mirai)", "value": "c3c06f2d2626eefe9a45a76d089cbd3576023be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446991, "uuid": "20cd5b79-1e85-43a1-a588-496a296cceaf", "comment": "Malware payload (Mirai)", "value": "eb953751b6565d08a2f27bc4d0ad02a6802e251d98b5b3e7ae69a3fafa5df57dbad0358a254774351e10f23c637cd10d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446991, "uuid": "43f0f5a8-0925-4b66-9e4b-79ef140446b7", "value": "T194F26CB3C8222EA8E16A99F170348B391763E48592471FBF156AC36D9443ECDF14A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446991, "uuid": "b756fccd-3960-4fc1-98d3-8bd66dd5779c", "value": "768:zFlHCTVMKAftTaNooZ1mCZfJFUfb7f2aI:zFhdKAfteCQmCZA7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446991, "uuid": "098c5aa8-b0e3-4c65-bc86-9e8d347ce0cd", "value": 35004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446991, "uuid": "b6c33ac5-d551-4dd0-9c99-85c87d810483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446991, "uuid": "327b85aa-e464-4597-bd55-b99953026b54", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdb2bf0-e8bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767455266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455266, "uuid": "2c2e063e-e842-4d93-bb92-ec26964626c5", "comment": "Malware payload", "value": "4e7058fa9422107075193bdbdccf102b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455266, "uuid": "9164910e-055f-4824-8fbd-a55daf2d8976", "comment": "Malware payload", "value": "5009f58011bb6b23a3fdfb435f247f9b0ca6779fa5ad85cc3c1072e5c20d6b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455266, "uuid": "d92352df-2051-46d5-95be-434390a74ec1", "comment": "Malware payload", "value": "53bb337147245436f0f1efea84d309a8a3ca621e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455266, "uuid": "096c8299-7fdc-4ce9-af5c-9e7396b7f825", "comment": "Malware payload", "value": "4cb289e23b0b1385a4a7cade19e28a89198d1d504df1684575ff4b57af4a4673518644db8d4e98bc6d95a3966a5cc91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455266, "uuid": "e545c409-5f15-42c0-b985-76807fae899a", "value": "T1EA086B4262EA04C4F9F7DA759AE65617C673BC122F30D5CF221C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455266, "uuid": "99125bee-6a6c-4be5-964d-fdade255e23f", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455266, "uuid": "9ed5484d-5b67-4e34-b34e-d3f2e77d86a1", "value": "393216:lkmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNG:l5NmdsJY62A0y8Xy5rs3wbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767455266, "uuid": "fb57ed47-41ef-47ce-8acf-c41de030e53a", "value": 81944887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767455266, "uuid": "e99b3f12-8849-4c52-919b-780295cc8259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455266, "uuid": "ca51a598-6efb-4c79-96cf-5a93b34f5777", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8e1dda-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463564, "uuid": "c093428b-a75f-4e6f-9888-8d1688eeedb9", "comment": "Malware payload", "value": "848b594d73a6a6e2662babdd24de7858", "object_relation": "md5", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463564, "uuid": "d04366c7-1806-4982-b1d4-73d7db7d4d49", "comment": "Malware payload", "value": "5035d338eb47af1cc61a154e26a04622c0f05440a603c8623ca1ed2ffe570770", "object_relation": "sha256", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463564, "uuid": "26ee4d23-8bee-48d9-b19b-28fcbbc1f556", "comment": "Malware payload", "value": "52dfb2707460e50fadfa3a1cade5ac7968e4936f", "object_relation": "sha1", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463564, "uuid": "176218fa-cfe5-47c7-ac83-ef7dd36c215c", "comment": "Malware payload", "value": "7b9652116fcc3f4f6a4aa583737eccd5df1e147a51e4b09dbc9e5e664aa5da302d93b90595962c6ec4a1939d704c67f4", "object_relation": "sha3-384", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463564, "uuid": "fc40a0aa-7010-4cd8-b836-d0c018c2642e", "value": "T147232A1723F8516CF1A6D6308EB9A666E3F134877570834E23B085D62B77D729A2C723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463564, "uuid": "3fa213dc-a485-496e-88ca-31d4c57730b0", "value": "768:1ugN8NVklBXt2rqvnz0JVHaqyEQKU6fxgsCJH8KWBy/UqDqjW:Mgy6tOqeV6P8fxat8dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463564, "uuid": "1208ac45-5177-4629-a028-69cf6d7170c7", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463564, "uuid": "39c214e6-b0cd-4aac-9a90-c6ec60e502d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463564, "uuid": "8287cde0-d810-415c-9491-713ce264c6ae", "value": "Loader.efi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121c024a-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445182, "uuid": "5a4368c0-e937-4188-93a1-8258de254cf3", "comment": "Malware payload (Mirai)", "value": "878fb68ea2f88250cfdeab00dc693b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445182, "uuid": "7d0ab406-e822-47df-8534-09e8cbdc2fed", "comment": "Malware payload (Mirai)", "value": "507869e21e2f267a7362e06710a841245526116302422a1fd8ea0b3624a47202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445182, "uuid": "1eb39976-e7db-4451-a8dd-c56cca5c7da4", "comment": "Malware payload (Mirai)", "value": "9c60f01637af243f4a8718db82739e1d185035e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445182, "uuid": "edbbdc31-277e-4de0-90e8-edb243182048", "comment": "Malware payload (Mirai)", "value": "b859059118e59bdaff31d7ab9af1b9798f0181bd50004c1d79d5e3056f31c60ff38dde05da0c2bed8fb786c5076af354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445182, "uuid": "eb52a745-d2bb-4f50-bfb7-f36fc2e4bb05", "value": "T1FC13F849BC91DA16CAC55577BF0E82DC372603A8E2EE73039E14AF65365F83B0A3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445182, "uuid": "d73d8040-5f4e-4332-8c09-c990f47ecf1b", "value": "768:q8uL4fMLLTX9FmNdXKxBi5b/F4bAu+7RI:1uLLLL94XXdRu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445182, "uuid": "5c06685e-bc41-413b-b8ef-e04d98f0488c", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445182, "uuid": "6516aa9d-c512-4e39-9d4f-34b528508445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445182, "uuid": "4ad80ee0-ac59-4dc2-9daa-e9133771d203", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4364fe-e891-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767437386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437386, "uuid": "21e848b3-8af2-423e-bba6-902ffeda5f79", "comment": "Malware payload", "value": "eaa22713a85d2b54a0f3858ad7b96e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437386, "uuid": "bf9cffd0-5455-41c1-a68b-99ca3fa839f6", "comment": "Malware payload", "value": "5179fa3c81ad9a42a9025f6c667b463b0e0133487bfca0b6d8e4752073c801db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437386, "uuid": "7f584945-1c87-42e9-ae03-daec1391431a", "comment": "Malware payload", "value": "bae28cc84a6d8841248eee08f4a354d11860959e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437386, "uuid": "d82da1b7-ceef-431b-ac1a-a665dcd91590", "comment": "Malware payload", "value": "567306f87e562dd6b167b6856a9e1c44c0871876846693a034e465368956128316f10276f26f58e9e4b6fdc1648367c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437386, "uuid": "e5e39ffe-4c2e-4eb1-83e9-71fd45bbd902", "value": "T1CE4733AA735844CBFEB6123744D5EA215CB2BD2247A1D2C3C3F94A105D671E8FE2DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437386, "uuid": "341114de-3384-4aa5-a1fa-cd499843d5b2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437386, "uuid": "1e94d7b5-3ac4-4878-81f9-68bee49e234e", "value": "393216:l2oS/DoSMVl63xfhsFl7dCR1C99m2rW8tKcqiaRvIuE4PlAeYaGG2QjSdFSDvj2j:koS7oSMHFlUR1Om2rW8wcaRvfcFahvaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767437386, "uuid": "d967c7d8-eba6-489a-99d6-40dc0375f57c", "value": 24686539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767437386, "uuid": "3924a32d-f19b-4e54-b9f4-066c04e5cf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437386, "uuid": "2d9b488b-0402-48c4-b584-826dd060b5b3", "value": "laze_4635c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecca52b7-e846-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767405176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767405176, "uuid": "6958f1e8-d957-4430-a1bc-8294b8b062d1", "comment": "Malware payload (AsyncRAT)", "value": "a426516f94011afe32a6a31d6583951a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767405176, "uuid": "da367fc9-d7d1-46f7-adca-feeb869d332c", "comment": "Malware payload (AsyncRAT)", "value": "523ddb2ad8a21458742b2139f96dcf3d3acc34372ee8e0d4ac6ed44a94a3f5b9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767405176, "uuid": "7701e528-bba1-4fac-985e-e5eec382473a", "comment": "Malware payload (AsyncRAT)", "value": "cad8be3871c23e8cab553fbe4d759107f51edd73", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767405176, "uuid": "99369d77-ba3f-45ba-aeeb-a249aabeff7b", "comment": "Malware payload (AsyncRAT)", "value": "e01bbce9422edc88a89fa4667691942e689dc6c07140a4d17ba447079c4daee09ae1d6745ace14ee61552b87820cb18e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767405176, "uuid": "a6de114a-bd71-40d3-abb4-324b688555be", "value": "T1C0D30704335CC811EDED4BB4BFA2980D02B59D27E509F6CE7CC421DB56FABC589163AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767405176, "uuid": "67b9bed7-e12a-42db-a1c2-d77fe0ad3182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767405176, "uuid": "4c38591b-c883-406e-ab71-0597abc42a38", "value": "1536:/hAciRwUZ54506SGbbVwd46koRGWugehG/YVclN:/liRwUZ5nGbbVTMugSG/iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767405176, "uuid": "f2c3bb50-79e0-4153-a591-5ae8d17fe596", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767405176, "uuid": "0f71241b-bf2e-4f90-81d7-2e5e434b53f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767405176, "uuid": "31221ccc-a19d-4745-98a3-b49cdc5b41f7", "value": "dcom driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eafac70-e8cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463645, "uuid": "e0115ef0-9b4e-46a3-8fe4-924e9e73fb6e", "comment": "Malware payload", "value": "89e9a7b84cf4f6722a12aad3cbc810cf", "object_relation": "md5", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463645, "uuid": "6966a91e-edbf-404e-9733-74ff98370b8f", "comment": "Malware payload", "value": "52673e2e0161c9ac49e9cdde37ad5cf843bb834790b17eea9cb3410972e54c6c", "object_relation": "sha256", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463645, "uuid": "aacb858c-1118-47d2-b8a3-923f60c26e17", "comment": "Malware payload", "value": "2d8bfba2c3e027437061f6f834e68899c5bebe8e", "object_relation": "sha1", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463645, "uuid": "0a384a05-48f9-4877-a42a-809faf00429a", "comment": "Malware payload", "value": "2b83c0cd8a2b9ee29fbbec87fe474e72530e756bdd131562b289235d91a6ecb681acc81ac4d4f84956a436e0dce42d82", "object_relation": "sha3-384", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463645, "uuid": "b9627b5f-b2fa-4a52-b32e-0aec792c7490", "value": "T18FF3D737E6B2C4A9C05BD134EB439463F9F1BC484734659F478096613B6BEB86B7E280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463645, "uuid": "31ad4b0f-0c38-4979-ba0e-4574c8caac1e", "value": "0511a609479c7133a3b0e73483317e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463645, "uuid": "18013b3d-8191-4a19-b2d2-767c6efcebf6", "value": "3072:QkZkG4GmrHp1WMlGh0/KPB6vanJ1HGlpe09fmAlEl7e88v:QkZkbrHT9lGh0/KPMaHGl/9fmAYeLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463645, "uuid": "0e99e0f0-e8f0-4241-8d5b-3f544bc0a2a0", "value": 164392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463645, "uuid": "87d38568-7ca9-409d-beff-261c0b5b372b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463645, "uuid": "b80881b3-84d3-4d40-b4fc-6b3da0f42cdc", "value": "Nidhogg.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89da8b60-e896-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767439370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439370, "uuid": "c5f38d09-4e71-4c4e-8ea3-31baa35ee119", "comment": "Malware payload (Mirai)", "value": "b06b70eac05bc7630b3f621bd8d83880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439370, "uuid": "c442f320-84ed-4d06-9ca5-12b73d9ea1f2", "comment": "Malware payload (Mirai)", "value": "53f89d54775417c44bc0ac71aa6dc7cac9451ffea2d9fd2855381baaae6749dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439370, "uuid": "48fb0579-080f-4d47-a7d0-cf02e1870022", "comment": "Malware payload (Mirai)", "value": "100328d2045e0d4a85249c972fce9a364f62d47e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439370, "uuid": "4e5a7ca2-f79e-42e7-a229-f7dd6d8da394", "comment": "Malware payload (Mirai)", "value": "83ab0d32ed6df995b491495fa8161ab630710bd60ca6344898cbc4c47ab637e9100196003739c077b572e5e1701d1004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439370, "uuid": "d03e9946-8149-49b2-b06a-9538755d5248", "value": "T1A4233B21BEBA5C1BC5C5643A21E78235B5B5430A21B8CB3B7E710E9CFF90550235BA7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439370, "uuid": "89af7879-abe8-4ad9-8779-4c2f948914ad", "value": "768:1IZeiq+OHIv3C6fAW92S08qoWTO+I4aEe+ch4+:1IZeZIv3C6r2S0druEe+chj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767439370, "uuid": "2a240259-d2af-4fe5-8bad-af6590f0f706", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767439370, "uuid": "9fb7cd85-338a-42d9-95d0-759c8fd8fb53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439370, "uuid": "8e7c3d05-7d37-4d15-994f-ee4b3d96becd", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650d6ec4-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399365, "uuid": "fe520013-be8d-4d75-96cb-f61613220d17", "comment": "Malware payload (Mirai)", "value": "030ba8aaf3ab95c85bba74012f93e15a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399365, "uuid": "e7601700-4ee4-4fe5-89bd-6cdad27cc1e2", "comment": "Malware payload (Mirai)", "value": "54856ef7a4b3d2ef13221cd432e8544ba8a712a953540d7d87c86b42e35b4f3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399365, "uuid": "b11c5d48-f3d2-4c68-9425-d351fb99640b", "comment": "Malware payload (Mirai)", "value": "4fdf92501ff2d680f8b01c4ee4a9e7a5ad96d318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399365, "uuid": "c53010eb-274b-4f22-9fd4-6b2b9331c44b", "comment": "Malware payload (Mirai)", "value": "76f1bd44be9a8cdeadd217675c35936281884c6abb238a19a21cc304a263f8aadd240617fce9aab9a17ba4771b959048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399365, "uuid": "e376a9e5-8160-498b-9d53-a97f19ff46c7", "value": "T17A63F749F8815F25D5E822BEFA1E018D33676B78E3EF7112DD101B15778A92B0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399365, "uuid": "ec9ed009-5953-44b9-999e-e14fa15f528b", "value": "1536:m5nQZGA6QB8r0y7gR3oas0Q4gLXMoU5eXfbqNlj4ieq5/BXu:sAbBq2YafQ4gLXfU5eXU0q5JXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399365, "uuid": "5edee50e-2f91-4a9a-928f-52a834da1db2", "value": 73028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399365, "uuid": "1c222145-dee7-467c-b9e3-04cb10f0dcbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399365, "uuid": "63895bd4-f045-4fd0-9875-9eaaa825474b", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c97d86c-e8ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767476660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476660, "uuid": "db962471-1829-4d18-8fa7-dc04b637cdb8", "comment": "Malware payload", "value": "aeb82360fbfaa63d1f921e259c42cf3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476660, "uuid": "38bb9bde-93f3-4988-ad67-7e0fdb549492", "comment": "Malware payload", "value": "54bf01154d46c11b7a58b9162871a61778269f060905bff821928680d466e771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476660, "uuid": "5d5676f1-c612-4a8f-8190-206a33292d9e", "comment": "Malware payload", "value": "edae04905991ec662430e645ab5f83c640e1f54e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476660, "uuid": "1ad2fc99-5884-47d0-96bb-24a92736ebc1", "comment": "Malware payload", "value": "6c9e4710fe70a14862655ef09aaec161c1f72888a4b5cc931b81c0b4c593c252ab5576fdb91071fd22ec5dffe73f2551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476660, "uuid": "dade13c4-7516-45c6-9e94-db0bee672c87", "value": "T1FBF73300D18904AED2D5BD3DFDA3E634001B4C2A925C656C16E78F677AE6E27CB0DD2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476660, "uuid": "f929345f-7676-4989-b6d8-c87a80b5e4cf", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476660, "uuid": "80afb7fa-1589-4a85-a3d4-7a66f6d10957", "value": "1572864:12e4hdV6xflH37M0zLr1X3OznfxySo3RPqSluhmAWa6:12e4Doxf937vl385ySorOWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767476660, "uuid": "5fcebb02-a846-4e2f-80b3-3178f2714607", "value": 76369291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767476660, "uuid": "69442e23-420d-4e25-8b82-36214bf8e160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476660, "uuid": "38e28532-4af0-4c60-8b3e-070dcd59dec0", "value": "Yurex Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ed211d-e897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767439826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439826, "uuid": "f58c8b79-54b8-4c6d-9fba-83fcfc57672a", "comment": "Malware payload (Mirai)", "value": "fcc2f7d6e9f7ec74263e98c2186ba2f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439826, "uuid": "4e41b846-0b15-4ffb-b5e5-6f8b288de065", "comment": "Malware payload (Mirai)", "value": "54e6edaa823b61281dfef54d9e22df9f729eab69ab6dbf7aba488ca3bf901ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439826, "uuid": "d975fbdb-2c01-4a74-899d-3cec223886f9", "comment": "Malware payload (Mirai)", "value": "f26d6196d2832ce431023c146284a487e45be007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439826, "uuid": "0707d9e5-ee19-4355-9a10-8f5920f41ac0", "comment": "Malware payload (Mirai)", "value": "c14f399171e601ac1988677836ff9052782e8c7b67f902dd483b0cf40f5fd33873a22ab87bc7a3e93c7dda9b50b9e2cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439826, "uuid": "1aee6a99-f2e2-4092-a2c8-c2b5160460eb", "value": "T19683A64A6E22DF6EFB68C73587B78F20D758239226E0C241D16CF9045D6434EA45FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439826, "uuid": "e1bb8777-93ce-4951-9aa0-db1b3e4845bd", "value": "1536:CZFIcIh+a41YWLbjEqvNEdnFgZSSD+13QjSTc/TlR/TTcFURhlmqu+7Rad:KInh6YdFhSy19URhIqu+Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767439826, "uuid": "152d5edc-bacb-4701-b418-90ab45a78432", "value": 84636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767439826, "uuid": "341e6431-9749-4f48-9405-0425a27bb977", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439826, "uuid": "30452d3a-2c86-493f-b15b-bc1d7eca93c9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdcffaf-e844-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767404047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404047, "uuid": "1b7bb1e4-5df7-4382-9c06-9b7ba20f9b8a", "comment": "Malware payload (LummaStealer)", "value": "f654ca21590bb7894ed41f7191e838c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404047, "uuid": "c629cbe9-09fe-4a96-bc0b-990aa312e3dc", "comment": "Malware payload (LummaStealer)", "value": "5519da099d0c6a2c0f65061fea972fb2ae09f7e2640cc81a22814cb14a569c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404047, "uuid": "352a4ab2-81d5-40fd-b394-f54aa2b9be1f", "comment": "Malware payload (LummaStealer)", "value": "b9e642b1074e6f20d1958cc175f0265a35e84dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404047, "uuid": "a2564670-6b31-4919-8793-02962de69337", "comment": "Malware payload (LummaStealer)", "value": "4d24439683de43f1d692782fc68ca0246e07099b1cb05a85cd6ebad6abcd84898dfe4e101d5d28808eb438f939d041a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404047, "uuid": "1a8c114e-42d6-42db-bb0e-3e9b992eb524", "value": "T135274BD3FE644315CA9BE23AD871529622307544573221C7BF690B6A8C1BAC8573FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404047, "uuid": "04028115-593c-4976-9a72-da54353f61da", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404047, "uuid": "bbb9f1fb-af9f-4a19-b1fa-e9d1cd84c1d3", "value": "49152:YJMg9bjounXcOVJ47XcQWSkO5Tk0am/Wt6Ne/vPN6ukQPHUDUb+/Lrh4G900s9nW:YJHcO87ahk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404047, "uuid": "bf2d4fae-08f0-4321-b7e1-2c8cf042df60", "value": 22127752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404047, "uuid": "311964cc-bc31-4cb2-8d92-aa2a0538793a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404047, "uuid": "634d3ebd-7988-4284-87d8-fd308935d034", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade8c280-e8af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767450168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450168, "uuid": "bb96c00c-2e37-4e28-8275-fe10188f14a4", "comment": "Malware payload", "value": "4ac225bf392d0f8343478f6dc568143b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450168, "uuid": "eedb5f0e-94b0-4000-8694-72f3991621e0", "comment": "Malware payload", "value": "55790767e48d39d71bf0814ba9ab4bd294de825ccab8b01cfa854399e2e935c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450168, "uuid": "3f0a9891-74cc-4516-acd0-0a885fae20f7", "comment": "Malware payload", "value": "e5130fc13613fce0f9cf16e92f696068e8993802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450168, "uuid": "f12fcf1b-7ace-4f1e-a255-05855fe47081", "comment": "Malware payload", "value": "5d7ab0f4a2e2b2584909355264e470c62791538975eb10b5ffb3dcab813b6a57573a4adb009885e1f5b1213a54a79db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450168, "uuid": "b20dd889-c5f1-4b89-aed2-07e7472c9a7b", "value": "T1952733E89FD00CB9E863753B54359876B3E174580BA09D2F5F00622A3F774EA6C36693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450168, "uuid": "e6551947-e042-41e4-ae80-dcce9d64088f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450168, "uuid": "42f4f188-9692-4501-bda9-e98043d54d16", "value": "393216:kqyCr2bcsbAemqSEVJEoa163OPsZg2Ke4fDVymK435HsF5ladgZb7EPONNrtnC6y:kq5rpl8c163rLX4y6EUdwbCE9Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767450168, "uuid": "32865669-7d1b-4d5f-82e2-fe0e73141ea6", "value": 22241368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767450168, "uuid": "3f0a3b38-51f2-4472-98a7-76d4e935807f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450168, "uuid": "d965fafe-e7a0-4fac-aca3-da1803f15102", "value": "PoligonVRSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9076f558-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463433, "uuid": "1b8edf85-aaac-4106-a22b-53916cc19197", "comment": "Malware payload (Mirai)", "value": "3935f87222b41876f95bac53d51794ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463433, "uuid": "18773a87-4eca-473e-897a-ef2eb88aded5", "comment": "Malware payload (Mirai)", "value": "55c47f567e34714db9d84deddb9e183d3a7b510281444c44b5027bc9c500f699", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463433, "uuid": "20a60b89-6081-4755-b78c-443dfd774f85", "comment": "Malware payload (Mirai)", "value": "ba4552c37f656c893e8d0688eb859c73e4aca2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463433, "uuid": "1650d515-c9c4-495c-b120-c138152c48a4", "comment": "Malware payload (Mirai)", "value": "2835a77167a2a14128e0e09216b99fa1c684dd3a0d98b02ddea5247c7d398eb9385053bbb4cf330c94fc2105213b10f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463433, "uuid": "0c051a0f-a012-42f6-bef3-aedf27c1c21a", "value": "T12283D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463433, "uuid": "3ddd9092-74e6-435c-b704-b68f868d93db", "value": "1536:iVLyu95KZvkj752dCexuV/8UZlDwfkJ4MYfWF:iVLyMgUFezxu5VD1e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463433, "uuid": "fba7b1c9-b200-42ec-add6-ebd17aa006ea", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463433, "uuid": "96f3c2d5-2fee-42b1-8321-20dbbeacfcc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463433, "uuid": "f39ccc79-bf83-449b-a245-46e018f3ea51", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4dcd71-e84d-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767408024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767408024, "uuid": "c89b5024-8943-45df-8737-4923b901ca7c", "comment": "Malware payload (ValleyRAT)", "value": "e7795a09c2f11753b3e00d285ac3b4c4", "object_relation": "md5", "Tag": [ { "name": "23-133-4-98", "colour": "#945AA7", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767408024, "uuid": "16f93ec3-8993-4b6b-8a50-c09da71bd8b5", "comment": "Malware payload (ValleyRAT)", "value": "560ac051ba7e544ad7eecba19fdde685cfe538e68e5f721aa61a095b223c9436", "object_relation": "sha256", "Tag": [ { "name": "23-133-4-98", "colour": "#945AA7", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767408024, "uuid": "68408036-9ec5-41c0-9b1f-8f130cca477f", "comment": "Malware payload (ValleyRAT)", "value": "3188e32ba7a746ba82b4fa18f6d848fe263bde35", "object_relation": "sha1", "Tag": [ { "name": "23-133-4-98", "colour": "#945AA7", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767408024, "uuid": "7b1a0ad2-5d74-4654-b4b7-06d343d35167", "comment": "Malware payload (ValleyRAT)", "value": "0ab6a964a03da269fd5f767ffbb6c4966fc2a8b0e80b7bd75bccd2c8fd88d5535cd4e833c1166fcdd335fe55d1a38c00", "object_relation": "sha3-384", "Tag": [ { "name": "23-133-4-98", "colour": "#945AA7", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767408024, "uuid": "4befec9c-851f-45cc-9b9b-a35dca0a67f4", "value": "T119083321B17739A8D61F63BFE0B85FC884306DE1B317E96B23387BB146B164661B1943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767408024, "uuid": "61360c76-55b3-467e-b1d1-0ce4c52dc7a0", "value": "1572864:Ml7SgYK7KnE9m9hBmdn5TSaxDZe3iEf3cT8uDESzccn8VeVV:Ml7SNdE9mYHTSaxDY3jUEYb8Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767408024, "uuid": "5c2b8ff8-bf84-4ba3-92f8-3924b549dadf", "value": 79492608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767408024, "uuid": "8afecb51-462c-48b4-b648-aaf0a033f185", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767408024, "uuid": "5364f1db-5ef8-465b-bab2-a4530625ce4d", "value": "google_Broswer_202512031.123.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a457a-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454152, "uuid": "95c82bf5-f2d5-4e26-8c2c-3cb9234c2024", "comment": "Malware payload", "value": "1fa45e1f41bb3dd4c227d132b851d45a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454152, "uuid": "3a73c827-34ee-46ff-82c0-b970683971fb", "comment": "Malware payload", "value": "5714a9676eb8e40d7fd65feed408b4a1a924759d337821ab8ae505a9e2512736", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454152, "uuid": "da2fdef9-3587-4207-9540-4a52979c540e", "comment": "Malware payload", "value": "354071fdc1eaa60d55067ecb212646190a5ae2d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454152, "uuid": "2865e41e-5876-4302-b66a-29043dda8d5a", "comment": "Malware payload", "value": "34f314b4b6b26647774febf52f5e65ae959a532b4282c27b7d2897d2e2797bc215d2c4ae715adee7efcbc726c8347c78", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454152, "uuid": "fb98ef8f-14d0-4a22-9f89-a0958106788a", "value": "T1D424F18FAC56A895BBC9108C20177D787A93C86E77B83DBC91A5E93D2730D4C5BC7086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454152, "uuid": "8988944b-ea1a-447e-ab82-2d3faac16f8b", "value": "3072:GhrolTh7VLnXLI9rcRf1tuSTZUE3t9yULovd/TXpS1+P9TiNJJbjCFOEiKL5:3u9r2dUuZt37o1/TXVP9V1iKL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454152, "uuid": "c0720fc8-8ae1-4d58-bc93-f598c407a7b5", "value": 213086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454152, "uuid": "8c36f8a7-7df5-4af3-b133-bb7dc373f2cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454152, "uuid": "03b41eee-6964-4609-a9d2-9355b6bd8274", "value": "lRh2Xojq5pzgLJ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b306bdf-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443023, "uuid": "95fad8e7-4568-4013-919c-6a788579742e", "comment": "Malware payload (Mirai)", "value": "527900145319d4b62ec85146d9a818f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443023, "uuid": "e17b5d7f-1988-40a9-bd37-d4b31b0679f9", "comment": "Malware payload (Mirai)", "value": "58e20bdf7b1c8a960450298cb2e03fcc2de1f29dc7a5c184c9d017e0212c6317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443023, "uuid": "d0dd4b4c-11b4-40ff-b61a-d42916d35659", "comment": "Malware payload (Mirai)", "value": "246114083d1269838dcde9fd656edc3ed2bd90c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443023, "uuid": "de27d7d0-9b45-4d5e-a251-7ecf7e6a4676", "comment": "Malware payload (Mirai)", "value": "ce3ba35f648a83d2b26457b710a8d92159b278b1a960eaaf0503c1d3a91615a229911f5c485c37cd56a093cbf0b32618", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443023, "uuid": "4ae05d76-d9d5-4be4-93d1-4ae0a4a6c5f5", "value": "T1C613F849BC91DA16CAC55577BF0E82DC372613A8E2EE73039E14AF65365F83B0A3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443023, "uuid": "9606da20-e585-4b8e-8d8c-c995dc05c97c", "value": "768:08uL3fgLLTX9FmNdXKxBi5b/F4bAu+7RI:buMLLL94XXdRu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443023, "uuid": "b22df2a8-59d8-4986-898f-9360dd3e9cd9", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443023, "uuid": "d5452d02-093a-45aa-8729-d6b29e049377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443023, "uuid": "a9ef0e9d-321b-4692-bc60-fd593a384d84", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d98c02-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468519, "uuid": "56d11bce-3a17-474e-bd56-72de894f36d1", "comment": "Malware payload (Mirai)", "value": "179e53765d533850863a74333728e1fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468519, "uuid": "8ade2e91-4ee6-44ad-802d-5675a98462db", "comment": "Malware payload (Mirai)", "value": "59a01014e31106d9feb3cda6bf7584abd329fe211fc63e32c184196c1f9f41ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468519, "uuid": "c67fa123-4d7b-4751-8c71-47b78eb9e4c1", "comment": "Malware payload (Mirai)", "value": "d9d8f0f3083bb05d773cc8ad5fd6402ee1f8718c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468519, "uuid": "bf0dfced-2607-4490-be2a-2e1010d5bb2a", "comment": "Malware payload (Mirai)", "value": "8942d2f3f275a75e0c9572b8e378665d9c4691755d91b9ab15647f2a4b9c35ede067f035707afbca384249fa322e1d66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468519, "uuid": "f00d9f57-5c0a-4754-a164-57d4c298030c", "value": "T125F34B06B70D0943E2632EF43B3B37D1D3DFAA9121F4E644251FAA4A9172D36158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468519, "uuid": "a2a1c096-101f-4ffe-a7fa-e776fa6f8862", "value": "1536:5iktypP+FM+Zgq1rvcg4x8j38xvyZtxE3NqQi7ButjrujGJsfVvADIdzMxqvA1kp:5iktKP4M+RJixdvC+3BsfVCI+T65+wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468519, "uuid": "435f8862-991d-441a-845d-08dafb473477", "value": 159564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468519, "uuid": "4870ee27-a632-4868-a669-ba918b3274b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468519, "uuid": "8ac826a5-10ae-49c5-81fb-6b7fec8d8c6a", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687b9b00-e87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429006, "uuid": "9682e916-a1c5-4224-b1c8-eb8d474fb477", "comment": "Malware payload (Mirai)", "value": "ad41b6906f4d76e554744a6120ea19bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429006, "uuid": "13a289dd-8f33-4eb1-8682-a0feb1d07a92", "comment": "Malware payload (Mirai)", "value": "5a8aaa8944d1b882ef7771180e7ec625cd55d2fde12648208e26956d0e94f104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429006, "uuid": "8ff5f0aa-6de9-4021-aa92-0f3aa3ab04f8", "comment": "Malware payload (Mirai)", "value": "a867c2f5190819a06ede6b85efa19d4f79860b73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429006, "uuid": "4680a2be-82c7-49b3-bcf8-df5becceded3", "comment": "Malware payload (Mirai)", "value": "01fb3dfd78e68125048d44140123e6e469cb627a474a28968a037432ed0d31c11e7e549171617459888a1a62a6cffe59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429006, "uuid": "6fa21cd9-8328-4fa9-bd68-5229d7c8d88a", "value": "T1F5531845BC81DA17CAD462BBFA1E42CC332653E8E1DE72079D116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429006, "uuid": "37c7a7f9-25af-41c9-948e-d93b9b888de5", "value": "768:gMLtf0Bd2xQMGWoIUXYphdE2eR9nwNx/WFLeIhVS8KemNsUh6BLx4ueMbZu+7R:L5fSd2CXYze9Tnwn+leIHKYUWxDu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429006, "uuid": "baeef0d5-ef5e-4a8f-9d2a-399e9f922c2f", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429006, "uuid": "a1c0dc0b-72e7-471f-a1ca-66addc9e6efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429006, "uuid": "93579779-eccc-4064-b80f-f9fe07059993", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0387f3c-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443380, "uuid": "a197f360-cdb2-4d07-88fc-9e08b0a964e3", "comment": "Malware payload (Mirai)", "value": "9a82331c50b7ba0b1012bdfd0bd010fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443380, "uuid": "a922de86-99a2-4ed3-aee9-363d6314ecc3", "comment": "Malware payload (Mirai)", "value": "5ad80816365cb777bbdb74915d982ef053b05cc62e8df026ea73c990b2fbeed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443380, "uuid": "f3ae89a6-eab4-48d7-b9ef-e015755ed446", "comment": "Malware payload (Mirai)", "value": "301812f0151bd2b9647507808f50c504b983b4b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443380, "uuid": "e85a6176-0e41-4b9a-a75f-411dec496ff4", "comment": "Malware payload (Mirai)", "value": "fa376aafc1ead9e4e6258432d0be152ce036b56f70620e64d209ef1ab0ade473e61fd7f7f9a6cf233d783c75394ef116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443380, "uuid": "877c6b95-3b1b-4522-bfbe-ee5f95b8db04", "value": "T1CB534CD6B400EE3DFC4BE67AC0124B05F524334566930F2BB76BFC936D721988969E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443380, "uuid": "421690ea-1c06-4800-ad9f-0b7ef3e6ef1a", "value": "1536:Fo3+A4xnm5tFQkyjoUWcrrLYvPJWHAM9A8/bDPO:Fo3+X8Qkyjqc7YvcAKxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443380, "uuid": "a3387ac5-f515-40ac-a4e8-9966e18f138b", "value": 64128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443380, "uuid": "ab42d66d-bd2a-4146-9516-4f1c0dc4612d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443380, "uuid": "07b4881e-2812-4256-860a-f84a779be236", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23a58da-e8d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767464778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464778, "uuid": "c92e58bf-56b1-445e-ac39-1fa0f4b38e27", "comment": "Malware payload (Mirai)", "value": "6bd411a61c9e5f7cb973bc33b67df0c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464778, "uuid": "bbb5af8b-2eb9-471c-bbd6-f6f4fe4fd8b3", "comment": "Malware payload (Mirai)", "value": "5b4828b5ce9f8ca9d08cc88a2f259490ef944be29265fde7a80cec4e4d7fc026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464778, "uuid": "4cfbc1da-d749-4f29-b3e7-1de614090a83", "comment": "Malware payload (Mirai)", "value": "e203b45161eb3937ed6566df1aeaeab7850c8976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464778, "uuid": "692bd3c8-e704-4628-a140-6c2d5538a62a", "comment": "Malware payload (Mirai)", "value": "adb5adc743b26ccb0a53bd647476f9a3e29cc9fe3176d05bd2686eb47c70ffa873c4d2bc2370b6d898f6b88bedb51524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464778, "uuid": "89c4116d-afbb-45cc-bd25-f4543fde3574", "value": "T157733A96F8809B12D6D1157AFF1E528E3313077CE3DE32129E24AB2477879A70E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464778, "uuid": "653985a2-0bda-4107-810f-a0e0456a7f29", "value": "1536:6InBLgdjV+aPOfQTMaYiL0t3lavG9dk5W2OHYSp:fgdJ+aG0x0t3lavG8/oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767464778, "uuid": "8ca01904-9824-4134-ab36-ae310836e5d6", "value": 75728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767464778, "uuid": "ec04a4fb-46c6-4c61-a1e5-45260b693050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464778, "uuid": "461d980d-6c17-47de-aba8-fc044d208c67", "value": "frost.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11df27e-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400459, "uuid": "abad8c5e-6ff2-492f-818e-95d5a72031ec", "comment": "Malware payload (Mirai)", "value": "157f313e27fceeadd636d9182ae5615b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400459, "uuid": "e607c4b4-cb82-4257-b7c4-93eebd1519a4", "comment": "Malware payload (Mirai)", "value": "5ba4f7231054ae1d85fa61dc8fcd74538d0951afa1f11e69c676075dc837aa3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400459, "uuid": "09ce5585-0807-415f-913b-33fab2685782", "comment": "Malware payload (Mirai)", "value": "494c12e03017b1c75ea71f16b1f572576506da34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400459, "uuid": "0e83234d-ebfc-4f36-84b8-a70ebc20ec35", "comment": "Malware payload (Mirai)", "value": "e6ea55f56b24433ae4e6cbb01381c811ff15e44b0fd99c05e8641bf6bf04107d94fbafe5ef2394f2dcfe152544d88c59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400459, "uuid": "dbd15b66-208c-4637-92c5-a8e1e93293ec", "value": "T14934B55E6E328F7DF7A8873447B78E24975923D626E1D685D1BCC2001E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400459, "uuid": "e3e5db64-3605-4d91-aee2-b2e805a97729", "value": "6144:/yqU3yRwcYyrFCD6XkvpsApnQ/aUFdv4GfCaE9kG:qv8wLVUF+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400459, "uuid": "15bca7c9-0c06-41a9-8b03-b580c21fb3c0", "value": 252328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400459, "uuid": "65da1158-5d09-49ca-94f7-4e9bdc272e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400459, "uuid": "d352d400-7648-48a1-9623-d89e0afc51e7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0419f60e-e8d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767467063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467063, "uuid": "fabb29c0-59f9-4942-b289-8da7c49ed99f", "comment": "Malware payload (Gafgyt)", "value": "527efadb0717097d298301ec0fab8aef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467063, "uuid": "7df878af-fc0b-49aa-a644-1e9a55bd1259", "comment": "Malware payload (Gafgyt)", "value": "5bae82ef71a776e0e9514c4dd8a1b1c41ff61e8b185dcc0d453663ce8aee2b25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467063, "uuid": "471d4842-bf4d-47e0-90c0-0b670fb5d85c", "comment": "Malware payload (Gafgyt)", "value": "e40ed42bfc70dfe43e77323fe1244e39a038e74b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467063, "uuid": "040cd625-2eed-434e-bb88-f74e9280b24c", "comment": "Malware payload (Gafgyt)", "value": "f94a9b35b22be1095886a059209f75216457be9daad0136429189057d482eb64683a47b1f7c6b512bf65d9f74c7c1882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467063, "uuid": "25bbe2f6-1c7a-4471-9f8c-ed1cd5f3e7e0", "value": "T1A5F3B60E6D215F7DF2B8833843B74F74A65DA3D612E1D585E1BCE1013EA028D296FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467063, "uuid": "526168aa-6561-4173-8a9d-9ac70af64d3c", "value": "3072:vKzpzNXyEwoSh7D0J4VHeVgrGySsFOoGLPDLcrG:iVzxwD0J4BeVuGRsOjPDArG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767467063, "uuid": "74a14453-1cae-4fc0-9556-65fa4154f6bf", "value": 163704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767467063, "uuid": "94de30ee-697c-4e96-b0bd-742b7ba4dd0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467063, "uuid": "b952e482-0756-4906-8a70-644ed3590b02", "value": "rondo.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220398a6-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432324, "uuid": "39dd8476-74b7-45ab-851d-240cbb3d76c5", "comment": "Malware payload (Mirai)", "value": "acd13f2278303c782c4a935829cc18e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432324, "uuid": "95389da0-cebe-4d96-a3a7-8c2d753bdaf8", "comment": "Malware payload (Mirai)", "value": "5bae8e3b8a6eb5164cbdb49b00533a487a6b242d162db542b58f045335da4d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432324, "uuid": "685d2f05-29de-4cb9-b16e-8a930685d6f8", "comment": "Malware payload (Mirai)", "value": "71b16e7fb938c217a2f230074836b051217f3394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432324, "uuid": "58798ea2-4f46-48b5-93e7-871313b9d8fa", "comment": "Malware payload (Mirai)", "value": "0fc56d6cfea3be523a96ab42f5d0660ad2404ca3a65c8db9f7268d1e5274442bac63b2d78eeb251d2afd41ea4df91b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432324, "uuid": "f3be3ca1-555f-4073-81f5-bd54984aefed", "value": "T10083B60A2E219F6DF76C873587B78B31D798339226E4C245D1ACE9005D6034EA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432324, "uuid": "d4a4ac3b-6b6d-4b19-be17-538bcf272939", "value": "1536:eK7FLNondaAlZwOwkXEmxa+qGqpgfoalDij43jlJ3jjQwy1/tquGcu+7RiaT:ekNUdAaavGBHry1/Gcu+IaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432324, "uuid": "93e97b6d-0eb9-45eb-b057-917c2dcdca38", "value": 85848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432324, "uuid": "f9c41ca1-c7bc-4161-a62a-500d14b071be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432324, "uuid": "80318e97-bb4d-40e0-a1af-e0e502fbb0cd", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdcfa96-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454144, "uuid": "71121689-752c-4df6-9bde-0f46494456f3", "comment": "Malware payload", "value": "0732f51fa6643cf01b7ba99130abf6fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454144, "uuid": "aedad164-bd87-48b3-afa4-50b712e17064", "comment": "Malware payload", "value": "5cbb885c283a2ca08171b641f9c85f28e21571841a92fbf722205d9554336ef7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454144, "uuid": "1db7becc-89c8-4868-ab81-d5017756671b", "comment": "Malware payload", "value": "d5f00597fc967d425b269e607e08eeaaceedbead", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454144, "uuid": "550c676f-3f59-47db-9bb8-e52a08d1da01", "comment": "Malware payload", "value": "03451c464524eed34154ca67b3b673bb4b53ee6ea4e781aec33ae3edf11277bf13ac4df175b926fd0c0fc9ba3e6356a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454144, "uuid": "08144d39-43cd-4eb7-bdce-5b648ee95577", "value": "T1A614C0101531D91DCF8715523A9B197F9B2CB8A81FEC878CEA469C515F9BBECC9C3A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454144, "uuid": "f2641566-1ff5-4aff-b782-80ace0df3019", "value": "3072:S4UOvZ9/kPKgaRRO1Zy1Je4sr0PpeuUTUUgZMaPIReY80gIjvO3DAJmNTLsILsV:vUqLTgaRRO1Zy104seCTSZLIwyxvaMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454144, "uuid": "1286ff0a-5852-48e2-959b-7bc938c64cf8", "value": 207006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454144, "uuid": "66c0ad73-18cb-4b31-85b9-f3403d97b8e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454144, "uuid": "b60e4eec-b888-49fe-8081-9beeabd5da2a", "value": "J4BLXVKDC10ehO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c71c7f6-e8cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463721, "uuid": "8a71e7f5-1e14-4565-88df-0e703108388a", "comment": "Malware payload", "value": "9bbebba5335b8a3af1d42073666d00bf", "object_relation": "md5", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463721, "uuid": "b8447579-7362-4c65-9a86-204570ff5b79", "comment": "Malware payload", "value": "5d401ee467f6b3924af02cc25d998404f4aad0de35c338ab10b4100b90333ef8", "object_relation": "sha256", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463721, "uuid": "0500250f-23b2-4435-b084-28baae4fd413", "comment": "Malware payload", "value": "c7403b9ec081e8927b5800bbcdabf6b9884b2ed5", "object_relation": "sha1", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463721, "uuid": "5d2ce0a6-d921-48cd-aef2-8b504475658d", "comment": "Malware payload", "value": "a74516dc8bc88cbcdd27a1eb247c9c2d9866c014c6b3d420912ee6b5c6b5460ff9e7fd0cfef67246793ed7350fdc7043", "object_relation": "sha3-384", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463721, "uuid": "d8520ce6-a87c-43a7-8efc-2d51ade256b8", "value": "T1F0D16273FC002D1949F2C3537990E20AEF188274DD5A1D7EE9AE1180B1A27EC0D2C5A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463721, "uuid": "30d631dc-e9e7-4c12-9d34-a76fe0e82a45", "value": "48:iNzmHPeCbEYvJYqoZeOgWUBTFwBYmPROFiLHFeWpoXPjC6oUFHR38cQYgtmX1PxC:FBVfpw+mPE6HFloGk2tmFPxGr567g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463721, "uuid": "e071e81c-3846-46e2-85ad-5c1e7f10cfec", "value": 6638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463721, "uuid": "e51f299b-406c-4846-8a11-ba295d788fbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463721, "uuid": "532e4123-39b6-4037-81c8-16667205d7d3", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd43e22-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427886, "uuid": "9053b28a-5bc8-47b7-bfd4-686cc6edc907", "comment": "Malware payload (Mirai)", "value": "293fcc6c4ca562a18ad9b412c3f9a8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427886, "uuid": "7f9aad95-56cf-4d98-974a-b8c141e5859d", "comment": "Malware payload (Mirai)", "value": "5d8488a2f82e88c95d8fbe7176e849f2e023c1c7db76fd80fbb67115fcfa27d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427886, "uuid": "29014944-1871-44c6-aaec-8fdb35cb7bef", "comment": "Malware payload (Mirai)", "value": "36cecedfc977886a33a819f61f89289d03c1d5d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427886, "uuid": "7845927c-dd26-448c-ba5e-558270243522", "comment": "Malware payload (Mirai)", "value": "cd9385ebff22e05b50c0c94489c1ee9744c9e9703a581acc0b1f745a9feabcdfa12e0e12f392374d5547790d6d1b193b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427886, "uuid": "cee9a710-16d7-4d79-b175-da0ccdafed70", "value": "T16D5302BDC5D9005BE739263A60AB6A0F0884FD9AA02F81F45F424CF9B3B6D9C58147D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427886, "uuid": "24b04e27-e71f-4da4-b915-924565254fb9", "value": "768:/sjkzfAEix6TvPyIRXIHtxfRMf3dTmK4FK6px63xNCKFzNeh4EORRslrNoNzin/+:0Z6ra24HY3dPOUXzwCslRV/nouy8Hyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427886, "uuid": "ba1a5629-2fe2-4317-b325-bfc9ca828183", "value": 61248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427886, "uuid": "bc5f2b31-c4a5-4f7b-82c0-19b698e6eea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427886, "uuid": "0e5e4356-45d3-473c-a576-25d64b8a13dd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fac349-e8af-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767449918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449918, "uuid": "28deed7c-341b-43b3-bad8-f625f86dbe88", "comment": "Malware payload (AsyncRAT)", "value": "950e74e23b7af0e24188f0cf0187c805", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449918, "uuid": "6a8a6231-e944-44c4-aa2c-90590cde4023", "comment": "Malware payload (AsyncRAT)", "value": "5e1458a02de57e6a1ba403a11b0a857af2146dda385e893bb6f4ea5a0e33fe68", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449918, "uuid": "7731f2f5-627a-4d31-bacb-770337d38924", "comment": "Malware payload (AsyncRAT)", "value": "05d040f7291c4e94dada2d784f80e82409d061c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449918, "uuid": "5d3022f4-fd93-44c3-b319-f1f1d1708122", "comment": "Malware payload (AsyncRAT)", "value": "b7f7a912c548cccbc8f7cab2b1fd1b688e9aa05bfd53e4ec125f62fdb0b843cd35216832e96fcc79fd12b3a30be08af2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449918, "uuid": "7734ab7f-14ea-4520-a26c-e3e280267646", "value": "T109C22B0473F48262D1ED4BBE4833A200D375E64B5D13DB9F2EC494AD2A23BC9C625BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449918, "uuid": "ff8762e6-c6dc-4773-9e27-7f815930f72e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449918, "uuid": "ca86df17-f88a-4451-a1c5-315a540c954a", "value": "384:xu048twEHJ5zgeHQQkFAMymrJhxUHqqbuUsJQxnCJf+BWfXWA/Vu+:xF4ZqJ5EJQk+MyCJhxaFbHBFByu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767449918, "uuid": "6490f847-56ba-4b01-8f7d-ebf9e84bf547", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767449918, "uuid": "f3075b7e-d588-4be7-9410-71a3d9c470bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449918, "uuid": "49770bdd-9363-4b9e-a057-8c65be302e5d", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65d79fa-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463550, "uuid": "d9e98732-5d98-4ef2-be77-ca15766a4a55", "comment": "Malware payload (Mirai)", "value": "785d1a2b6dc9d4df9b870af54a3f310d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463550, "uuid": "dbb5356c-844b-4e9f-b6a1-c82153b6e60f", "comment": "Malware payload (Mirai)", "value": "5f024357838bce8fe3d456ae6c406bda80300ba2c2433afc0e21058c6966a22a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463550, "uuid": "5e554e20-2759-441f-8384-00a1063361fd", "comment": "Malware payload (Mirai)", "value": "04d0cb17ffa64a5dd04a761cdc825c0d2d5ac52a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463550, "uuid": "30c0c356-d2b0-43c5-926c-abb38188f7ec", "comment": "Malware payload (Mirai)", "value": "106c8b4d3029da610182be6dc34fc1487f268ecf59f7b0c645caacdae9097f301d6521eadf4568e35f7b9313ac4b2764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463550, "uuid": "cc3ceb23-5b0a-4fa4-b433-5c6ab9b6b864", "value": "T12B656B05F9409A6BC53761B4918FD371C9306A3847238B8BBF8D6D347A2B3D1AF28756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463550, "uuid": "71a28521-7a8c-4306-bcba-ed9af14d7d6f", "value": "24576:uRjouDcSyao+8OoNTp/zmUWF/UX4zfftpDx3wadaqmQn652+Oa0JL:65cSyl+8OyTpDUcozntpDuadlt8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463550, "uuid": "1f87c4e4-a08e-4f52-8ef9-0cace47c96c9", "value": 1444352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463550, "uuid": "eeb7d2f0-d6fa-4076-ae44-f8e79bd72385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463550, "uuid": "990e92f2-76c4-4455-8eaf-d66952fc4009", "value": "UPpUrg2RPxX.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784e2391-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400256, "uuid": "99de4de2-02a8-4363-900a-009e5b79d563", "comment": "Malware payload (Mirai)", "value": "41e887a737138fbd7d3f681dea256928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400256, "uuid": "b20cce53-fe54-45b1-b3bc-65377b2dc13d", "comment": "Malware payload (Mirai)", "value": "60234fca52e069a9dc260e80041cbf2916acd53d2083bba025535a2b785a16fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400256, "uuid": "be9a84cb-b6e2-4a34-9796-5636abc24498", "comment": "Malware payload (Mirai)", "value": "7b422cfc8d70e83578840d713131fe9ea905c57b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400256, "uuid": "03a4b76d-621c-4b7f-bd50-1a807b673bf5", "comment": "Malware payload (Mirai)", "value": "54ecbaf3ab1903b4c662b0ecb564aee23ca64ea325b9b09d81b5b3032fb8c0fb4e34acb3872e68185c029f5b8f33d067", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400256, "uuid": "06fdc472-df38-4b34-84ec-dc32c7b42a15", "value": "T1F1936C02B71C0A43E1636DB43F3F27D1D3DAAA9112F4B648394EBB499072A325587F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400256, "uuid": "2c86ca8b-cd9a-455e-b5f6-9d889a29311d", "value": "1536:hOrF1pkPQ7P4UVXi60qSUIGu79tR8eyPwLD5qYtSJ:krLwQ7P4UVXi60q6BRryOAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400256, "uuid": "5c533bf2-85bb-4a97-b764-d775af2c3c53", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400256, "uuid": "f23ae4c0-6524-48cd-b6c8-f631a47b2eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400256, "uuid": "46ccc2b1-6242-4875-8d7b-c26164e010e1", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713d3c36-e892-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767437611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437611, "uuid": "1e4e11dc-04a5-472e-ba77-f9ea7a28a71c", "comment": "Malware payload", "value": "c22979dea74dd3aabc9da030b4aa0c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437611, "uuid": "376ec0bf-f27c-442e-ada1-ed0b70a3484f", "comment": "Malware payload", "value": "6040b3fea0fac6d847ff6f0f5d60d68551728a24487818f119956cadf2b036b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437611, "uuid": "a8742441-9c0f-4560-90ef-f6cde9efb13a", "comment": "Malware payload", "value": "603f4270ca6d1ca131058291dc69ac2bbf82dbf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437611, "uuid": "c8cc9cbc-8dd3-4ee4-b602-cb48fe4492df", "comment": "Malware payload", "value": "0b95e2fffe16f0bffa50ae708750beaf7df9e2d25b717932418ea3a164cff9654e9cb2459ffd8298f0379b17bd402e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437611, "uuid": "c2ddc8f1-8159-44b1-8da4-f80076e52fca", "value": "T118663843FD948268C19FD239EE75A25AB635B045133123C36F630BB18EDABC4573A729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437611, "uuid": "692845c6-5ab2-42cf-86e9-abc7203a6625", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437611, "uuid": "65ed7fa2-50be-4b7d-80bf-bddc1540b624", "value": "49152:xj/fJkrb/T9vO90dL3BmAFd4A64nsfJTxr2wmBizYxwFby8NLSS8bLML/gzoxK1A:xj5ZRxY8FEdvsnaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767437611, "uuid": "58132ee6-e47f-4a32-957c-540319d44aea", "value": 6631552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767437611, "uuid": "0c104c70-8d85-4881-b00e-f048ea55b173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437611, "uuid": "b2ce3e3e-0233-4c2e-a683-30e7866cf444", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c3eada-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459595, "uuid": "61e4a9f6-30fa-4685-bc8a-45efd859cd11", "comment": "Malware payload (Mirai)", "value": "88fc7f937c7946dcac17ad165b85b70e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459595, "uuid": "705993ee-6026-4f39-a7f7-15d4bebc8658", "comment": "Malware payload (Mirai)", "value": "6042e93dbc4f7aae0bbeacbf95ae819b249595526eeb8f39272053ae344359f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459595, "uuid": "45208315-5611-4f78-9f9f-a2093886b791", "comment": "Malware payload (Mirai)", "value": "006caeec8b1d346c0ef15f4a3392621b74a72197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459595, "uuid": "54745c97-cc6a-4a65-a97f-20a7eb3083c0", "comment": "Malware payload (Mirai)", "value": "68c248d1122c24d338a46f49bd68fe3b404eaccb1efaa3dbb7e38dd3227d211f70a29f5c099308e7b5ca1946d088edf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459595, "uuid": "7ec1b9ec-4d05-443a-968e-ea2f44bc44f0", "value": "T166935BC2B783D8F5FD6612B4117BF7364672E9390029EB8ACB25B835A819502F72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459595, "uuid": "ae829284-c36c-4c13-86aa-3a99c6233f07", "value": "1536:F1k5kUFsjpTXTtiwoHGIBbyX0e+UnQHvDWA4CXQvtAhWBeJo87cZN3ZmuFn:UmUF4pAwoHLBbyAUQHvDWAvy8K8/oZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459595, "uuid": "3fef38e9-c904-4e16-916d-bcfdb0062747", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459595, "uuid": "7d3008a3-e8a0-4751-a706-566deb78ec41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459595, "uuid": "de6e98fe-dd78-486b-9702-dd81cfb9d88e", "value": "x86_32.uhavenobotsxddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6eed9f-e879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427105, "uuid": "4461eb1f-205c-46e0-809b-9598f4c5df90", "comment": "Malware payload (Mirai)", "value": "2e2d7f2f81968b5f6c0b9728e6d1f2c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427105, "uuid": "e55c0d3c-fd39-454f-aecb-62e72a0d32f8", "comment": "Malware payload (Mirai)", "value": "6086fcc4143e5d6fff3de221c8237abe1253a4943fde4d1c7195a3a58b51227d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427105, "uuid": "000d7529-87e5-48dd-9e65-7e1ced2b8fd7", "comment": "Malware payload (Mirai)", "value": "c83b3cb7a35ff31341bbe9a947fbaab2dee71498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427105, "uuid": "194b6e4e-9b0b-45f0-a095-cf92515c6b0a", "comment": "Malware payload (Mirai)", "value": "87192ef9fb0e18d39c66247933e1ea50271c4088f0bb264f15b7de314a13859254ba3893a14c5485f0a1bd34a7ccaa88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427105, "uuid": "646fd361-7e13-4fec-b7f8-9dc678d2e1b2", "value": "T1E173121449479297CB326730ACF91D5DB85943A5A0E932CAB04607787FF6D163BEC3C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427105, "uuid": "9e47f69f-d537-49b7-9a6b-010ffc5826cb", "value": "1536:T5ZenTRvyT14jl03D24vAaR8hYZPAyXwMQwqRWKkANzZ56GLx:XeTRvyTlfvAa2aZ9XwM9qkKB5HLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427105, "uuid": "421fd2de-1061-4cab-a6ea-180c40c4eb0d", "value": 76240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427105, "uuid": "c1d9f8a5-e893-4c49-b0a8-c73ad378969f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427105, "uuid": "115d22ad-5125-488a-bf2e-33f66fb5086f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50844bc4-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431113, "uuid": "4cdfaeb9-6074-4ce7-82c0-6492d252ceb9", "comment": "Malware payload (Mirai)", "value": "bf91eebd8e1f982f2447c7b7f4de5ccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431113, "uuid": "a3aaf9e3-5db6-4992-915c-1eebb773db08", "comment": "Malware payload (Mirai)", "value": "609747cf1919c0342ac2c0920844b957942ffb1ff9a694ba564b52e06e15b57c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431113, "uuid": "b5faa6dd-06d9-4105-b178-ba986b4c88a8", "comment": "Malware payload (Mirai)", "value": "c95008793ae82243e5d6d3d69163d29d31c1e6aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431113, "uuid": "430db176-f186-4251-8fb8-a2e9cf19b4e2", "comment": "Malware payload (Mirai)", "value": "3d9882ef897c57e48472fcf00bd46b873fd720305a98f744dd3a98cbccaa5279c6bd691f4e6a70a2e14b0fc305c9ac14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431113, "uuid": "49b982c7-0afe-4bd4-8e73-07a5f26a011b", "value": "T148836C13563D2B0AD0E4F47612B79392B1E62B4D01A4D69FBD720E5FEF223801E5B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431113, "uuid": "6587d617-7bcb-487c-afa0-498d9a0020a7", "value": "1536:ZyewuBI80GsGLIXp9SEDBHBBXPb47DJpcF6ReYTVxYwKP97ZWmea+P5:ZyewgIJhnvHEcQVvA2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431113, "uuid": "5adbe750-cfe2-450c-be36-fb12dc7a6649", "value": 84516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431113, "uuid": "79ca8428-b8e6-4fe1-a40b-58c42c223cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431113, "uuid": "538a82f5-c020-4b79-a5f5-1695e8bbabea", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d4d1c3-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463442, "uuid": "4314b832-d128-42dc-92a5-72a9921899c2", "comment": "Malware payload (Mirai)", "value": "70e8cdb6497aad8e192b3d4c28ccb094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463442, "uuid": "6a0e7b7f-2028-4c4e-86d2-298f34865fcb", "comment": "Malware payload (Mirai)", "value": "61ad8757c4f7e8d1c066098fc7cb30e1ad89632a0d9be4f1155c11175fb67a54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463442, "uuid": "9f1f9060-a5fc-42b6-91fa-0076eb8e811a", "comment": "Malware payload (Mirai)", "value": "2fb0ff06155f72bb6b0b86cc36103e123d7552cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463442, "uuid": "db24efce-78da-4455-8217-d0345d2d60d3", "comment": "Malware payload (Mirai)", "value": "333470890be33496739e62ea9d1681feb27ae497be992bd3557026db212437144923f813ac85122cd86909a531083c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463442, "uuid": "344b144f-a6bd-4210-8b66-73501713971d", "value": "T13283A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463442, "uuid": "d75dd028-00bd-47a7-8cdb-0068cfdc5afc", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTU17ZDYovZ73x/nL8y8b:Rakdn2Eo3ePu5GTaRYo99Be037Wd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463442, "uuid": "b279b173-783b-4fb5-9253-e8df5e16cafa", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463442, "uuid": "1063753c-f391-43b4-98c7-af36042b7743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463442, "uuid": "34cc3f84-efbf-4e66-b3d1-257b172a7ece", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965a7256-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445404, "uuid": "cb06da04-ceda-49b7-9157-ff4954ec90af", "comment": "Malware payload (Mirai)", "value": "bb9468d5a3dac7d609ca313e22d28581", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445404, "uuid": "4bff6a22-e16e-484a-ae46-0832023c8bde", "comment": "Malware payload (Mirai)", "value": "621886c0961743d0f1a50ba3888f8d742f6e0d7778ac190b68b23b65e4b1cdd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445404, "uuid": "41f52a8d-35fd-4886-9c05-52cafea5b174", "comment": "Malware payload (Mirai)", "value": "2159fc235587fd94e8e0032ae6ca867afcd14f4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445404, "uuid": "a189d077-795a-44c6-ad30-67e5fc9f5944", "comment": "Malware payload (Mirai)", "value": "809aefbc27404fbf53b19e1ab8e3894c7ce9e62f7653f1b997a8d66f3adb1a2e901b6e860f862fd2aa3a8587cf9d4da6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445404, "uuid": "398cbca2-75ff-4acf-9b5f-f4d0532584cf", "value": "T197330856F9819B11D5C1117AFE1E124E73230B7CE3DEB312AE246F2067879BB0E3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445404, "uuid": "bf55445b-eb89-4cb7-9790-e118bba82834", "value": "1536:g5n/xUqnLW3WS8EKpwadCJ10eDhRiS3lYk2W5pYZ:SnwWSxKpwadu3l/2Wn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445404, "uuid": "38dcafa7-0c27-4ff8-9ec5-3c75e62d947e", "value": 50308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445404, "uuid": "8cc700e4-87ed-477d-bb98-6f42739befe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445404, "uuid": "7ea70cd1-3cc7-4029-81d3-52c815f0313e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dc4091-e87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428012, "uuid": "292493e6-095e-483f-a3b4-a489e9bd67e2", "comment": "Malware payload (Mirai)", "value": "09bf86c52d479209836c8874f669ee0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428012, "uuid": "928036c4-2e71-4916-8ce8-bfe372708d0d", "comment": "Malware payload (Mirai)", "value": "6263794f392a4aecdd16c288276bd6003cd751f72163e4ef23a8580f5bee062e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428012, "uuid": "ce3896de-d4fa-46d8-9e62-c1909eda6772", "comment": "Malware payload (Mirai)", "value": "400d6bf2eef9d1cb48b384e4619a68f8ea67db62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428012, "uuid": "ff1c0c9f-d2f6-437c-84f9-e4a8fd602d5c", "comment": "Malware payload (Mirai)", "value": "e54f55a8ae1c4eb6886267b38d5104bc46434db4370b9075eb7875e8a1618971a07db694ec137c958f903498cf648a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428012, "uuid": "dd3d9774-c8ce-4f3a-8f51-d2372a2752f5", "value": "T150137C238679DE69F22D96B575348B794B53E211E38B2FF62609D5248043E8CF64E3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428012, "uuid": "64b36ed2-cee9-44a2-a55f-d0dc39d14a2e", "value": "768:EzwWOJdo9Krd2DpvDRQjam6aZFIdECPtjULCPO5Rgoq9eC0bu+7R:EzwWt92dwrRDFdjPlULf5RP6eC0bu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428012, "uuid": "43540ba2-2b79-45ad-b2db-89d838ad19da", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428012, "uuid": "17fa778d-7a5e-4450-967e-4b8f20695870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428012, "uuid": "2c8ad690-ad8a-4f33-aa83-9c6964a2fac1", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5484a9a-e885-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432168, "uuid": "49595229-0189-4900-b62e-9065e94272b5", "comment": "Malware payload (Mirai)", "value": "daa419d35bb986adf4eeaa595d9e998b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432168, "uuid": "84bafc31-86c6-497e-8d35-e6f48850cbb5", "comment": "Malware payload (Mirai)", "value": "62c9e2cf37965d3b151280179763d2096479fbd421259e6063ec2c72d468f104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432168, "uuid": "7e969bbd-a2dc-4a80-9e08-9900272f946c", "comment": "Malware payload (Mirai)", "value": "727fc934ca4eed60ca5c99586d90ee5f783ac0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432168, "uuid": "0308deac-b7c2-496c-9a9e-49c016afb8bd", "comment": "Malware payload (Mirai)", "value": "696377ea1218552349f898c238cde3abe5d46d21f421461324163b8dfbff9ec6cc796a8dc523aadae43a73136ed5c7cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432168, "uuid": "afc1f2ab-e3fc-464f-b244-500cd41a15b8", "value": "T11F533B86D401CF7DFD8AE67AC4130F04F538635166821F27A6A6FC936D731A9492AF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432168, "uuid": "4bce957c-b082-45cd-9863-99ad9a42f0ef", "value": "1536:EMFmpnsYNbTXLS5Y7tcNB9Eb7lmI4f9zPLfq8WEDP2:EImp3fS5YqNcbJmVzzfJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432168, "uuid": "87c1e4ed-a932-4390-b83b-5e4984fc2205", "value": 66364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432168, "uuid": "55e84caa-0e82-4993-a364-8dc8a58c48e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432168, "uuid": "ab2690ac-fba2-48ed-a848-7801d9c7aa28", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15a5cf7-e891-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1767437316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437316, "uuid": "c0c3e475-be96-403c-b1bf-34b8a026056c", "comment": "Malware payload (RustyStealer)", "value": "07e523ebdf024fd655e805d886a8e290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437316, "uuid": "d8469cd1-876d-4512-81bb-cf051cf69347", "comment": "Malware payload (RustyStealer)", "value": "637b99fc848627b592bf18e1c040aa8e37927e98b65851bc1c6f04f2507b509c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437316, "uuid": "2d006f48-f397-4932-af74-84fa0b2a5904", "comment": "Malware payload (RustyStealer)", "value": "f3bc5a1db6980270fbdafd88a9ff9f100086cf3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437316, "uuid": "26ecee7b-2b69-40b5-9038-502db96ee8cb", "comment": "Malware payload (RustyStealer)", "value": "be4c71db8421d60e3bdb0f19d7f372efb440a5639f62493d21d77cbb3d90c07517b3258bb99ce2edbfab984416ba5f72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437316, "uuid": "152a2708-2862-471a-88a4-558811795c2b", "value": "T1490612067A4052F4F05E82F966DA4F629336F42535A13D2631F4B720BBB97DABF1A304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437316, "uuid": "f927d4d6-a976-4456-b6e2-ced79263a543", "value": "b25557f316c563f336766cfbc5e9ece4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437316, "uuid": "a9a0133a-7b6b-4eb5-baba-862d58ea4997", "value": "49152:kYF2cx0vhaxbF8RjLhZyoFQEedZkE5SWCSRnNLDbe+UL6xVDji7OKy5NgDztKstM:n2coYb6jezk3rSJs+DM7U+ztR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767437316, "uuid": "70c0f835-cfe0-4a59-adc6-a2320cd14e90", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767437316, "uuid": "94f515b4-9196-4ca6-a326-7e268b2a0cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437316, "uuid": "8b37ea76-04cd-468f-a9d8-0d4761863213", "value": "RelevantSpoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529a645a-e8a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443572, "uuid": "c3487fd8-a0f6-456e-8a8b-f595b422196e", "comment": "Malware payload (Mirai)", "value": "d1a97409c3757f113453e2c7bbb927fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443572, "uuid": "a8de48f7-ec83-47d4-aea1-06e4960493be", "comment": "Malware payload (Mirai)", "value": "63a9cfa617301ac1a5e363ec82e8be2161c06b1c6a85cb81dc6e3c89b8103f17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443572, "uuid": "7b0a6a7d-d9cb-4671-9cd4-f976c77589d9", "comment": "Malware payload (Mirai)", "value": "276f37a84d44703add287fa7ce267642c10821d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443572, "uuid": "098e0750-0e51-4c37-a6f1-545010f71dd0", "comment": "Malware payload (Mirai)", "value": "86b7d1ed30ff08e0fbc9c4ea4e40ed0022ae1da4f2e78b64a2d50dc5a4e573b3da8696d145cabf915934037339181e91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443572, "uuid": "28c49e62-fa8d-4c75-855a-b022e3df35f8", "value": "T1D5132A92B400FD7DFC0AFB3BC1530E06B171764682915A23B376FDA35D722A4992DE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443572, "uuid": "8ace653d-6032-4dcf-bc4f-5a02b1d59dd5", "value": "768:75m/mOgAmwmlgbuEd1YJ2c0JQhPeWBBsJxMtNqLpPYny6bUscjd/fLQ49wBu8dTe:sLWBBsJxMOLBr+Uld/ft9Cu8dADPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443572, "uuid": "47200172-9650-4acd-9189-dac55a7f398f", "value": 44684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443572, "uuid": "1bee1a16-b1c3-4ba6-9f4d-03831ffdf1f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443572, "uuid": "d9f0ca42-6cd6-4f74-af04-a7d770a00b47", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7a177d-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443022, "uuid": "77db2595-bac5-40bb-bd43-c20925fb7593", "comment": "Malware payload (Mirai)", "value": "c92eb9a9ba9848ba877d3692a3fcfd37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443022, "uuid": "8af7a90f-cf0f-48db-b515-efe1379653b0", "comment": "Malware payload (Mirai)", "value": "648a1ad85e1ef2c1306e922cb9fee502490224f527dfbcbd9397c11a1db03cb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443022, "uuid": "aa4c871b-8173-4669-8c0d-b338f5fa2a1f", "comment": "Malware payload (Mirai)", "value": "e5ebc7e7360919389b697dc1a6e1731222e525d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443022, "uuid": "5b347a47-2b32-4599-b381-60997972fb93", "comment": "Malware payload (Mirai)", "value": "a74c348f890fc3905360c5a640597d2065f2f4d92fb30509d7e0682a20723759df8437f6ef12e47dc7f4a21df923b28a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443022, "uuid": "075282ee-5698-4c7a-868d-b200593b20e7", "value": "T19BB2D0B821E14DADD53AA0BE4FF00765187847B9D8035F8B2E4CF25ABE5A9D438437D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443022, "uuid": "687ebcb3-6fdb-4c14-a037-26b369197f81", "value": "384:hCt6fS/dAulj9nQNZ97MLcYXs+iXvoRV+7JcBTTuxNSjQg6Va/MCHC6jaee5JgG4:hmb/SU9uTeviXv2V034ThTjC5JgGlzDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443022, "uuid": "09e28eed-0000-4347-9a5c-3811aa5162ac", "value": 23932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443022, "uuid": "25a054e3-0128-4f43-a8f9-c38380ccdf35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443022, "uuid": "c47b39ae-781a-4abf-b714-b7d544758c0b", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5967e3-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462485, "uuid": "dc2b2e58-688f-4850-bd9a-406dbb450cfd", "comment": "Malware payload (Mirai)", "value": "db46c7ac7af261bd12949111b873d787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462485, "uuid": "0075a9c9-e5dd-45aa-9bb0-7805c848d2e1", "comment": "Malware payload (Mirai)", "value": "64abfe3973562d73361bd45dfedb2e43e8293c45417866ef17d90d67c8ff1389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462485, "uuid": "b95d517e-5e51-4cd1-be60-68e7baa58c69", "comment": "Malware payload (Mirai)", "value": "a330aa3d0f4a5a69d7a89f01ab410640a5aa546b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462485, "uuid": "4c90a586-481f-4840-b0e7-9253b1652a85", "comment": "Malware payload (Mirai)", "value": "83190848c33581f9a89e46a436ee65d9f807ec57bdd1a076034108aa446dbe67862632c604295516aafe443b5ae52b92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462485, "uuid": "5df26aef-ae1b-4654-981a-f58c5b277261", "value": "T1476319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462485, "uuid": "34f59ad1-69f3-4086-91e2-d0c5dbe77dcd", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8nHxouJeZWDFI8DM:GbtexU0r8HCKw2FbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462485, "uuid": "cdec5d87-f181-40f9-96f9-73277ffd5de7", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462485, "uuid": "20fbba89-d875-4f69-ba46-943d2be1e841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462485, "uuid": "c5ea5ca0-b12e-463d-8ef4-6bfd0318d9dc", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978b6368-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465163, "uuid": "e25f7763-cdd6-4992-b4c2-b8130dcbcf9b", "comment": "Malware payload (Mirai)", "value": "9ddfb16fa8840a9d54d43cc335df877d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465163, "uuid": "a41159ad-1b34-42fa-aed4-a6136cdbdcbc", "comment": "Malware payload (Mirai)", "value": "64fcc78443f443f1a15004d24e3edfa6d338e4d7aa6abf0fb0518182707f266f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465163, "uuid": "5516456f-d387-4b4d-a7be-97793c5c0ec0", "comment": "Malware payload (Mirai)", "value": "6fa08096a6bb9a55f6e59d3b9dc4d9940b36f629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465163, "uuid": "62d06080-9859-4339-9771-0fc8e4fa0e78", "comment": "Malware payload (Mirai)", "value": "468ddb038682251f57486b88a388e265901116361a76569b7b071a03e7b1228d9de48b440b5e940f0b7d2e17d3289182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465163, "uuid": "74929209-35c9-4193-a27e-9e7a94cd8d63", "value": "T1CCA34C92FD81DA12C6C562B7FB1E428D372713A8D2EB33038E265F21678A51B0E7B554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465163, "uuid": "9a4b08c6-3010-4d91-8f8b-62f60f808157", "value": "1536:cOM9ec6y6RWqTPnpQDUNzRoz7eQcoC0JcjwO/sLn4fiSVpv6ODGK:cOMIJy+WqTPpQGez7vXC0axJ8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465163, "uuid": "ac364490-8f13-499a-a778-b788a3ad4b77", "value": 104020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465163, "uuid": "f10537dc-ccf8-4007-b26f-aabc03601da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465163, "uuid": "840359e9-b164-4c62-a40c-8a3d084d11cd", "value": "arm.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3f22a0-e8cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767462216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462216, "uuid": "f7db8333-7db9-4b91-96c4-2d84d42c2a00", "comment": "Malware payload", "value": "7a904e607323e17b1e7fb2be7d849bae", "object_relation": "md5", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462216, "uuid": "ca87b3fd-a0d6-4f5a-94f2-5becee3ceaa7", "comment": "Malware payload", "value": "672484fe2df718e226fff8180c00714d203c43fe97cb9e359ee43dceef39e57e", "object_relation": "sha256", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462216, "uuid": "224741ca-fa46-4359-a1b8-784b12963ec7", "comment": "Malware payload", "value": "3439997de6782cffd5bb9570169fe6049b070a25", "object_relation": "sha1", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462216, "uuid": "c95d3bc8-9f06-4894-beeb-b94d520fb89f", "comment": "Malware payload", "value": "c5d25eaf52481589d9c11c50d761a41a7510273fbbe8a625701f4581615c899a232f62edfdc9e3046adb9c07a23911b2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462216, "uuid": "881502fd-c547-45bd-aa8d-b00693ddbd1c", "value": "T104817E0549AA536F6FF3796CE29DD0F3D2D194146E098519EC1C01A75566C8C2281D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462216, "uuid": "a2f20257-35b1-457e-a2c8-50c3f7c3be72", "value": "96:9ZVrk3dGrf8hWeOP6Ov5IviqFs5svBfiBflvLJ:0af8hWaO5IvtFs5sB0fJLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462216, "uuid": "5ae376c8-5e87-4a0f-bb90-2113cfc6a644", "value": 3976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462216, "uuid": "1ef98f3e-5f1d-40f1-b8c7-207a91d7922a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462216, "uuid": "36fccdcb-bd2a-4737-9899-0cbef07d79ba", "value": "takdoom.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7762876b-e88a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767434185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434185, "uuid": "e80d3826-cba0-47a9-acf7-a322a8b75708", "comment": "Malware payload (Mirai)", "value": "4b7728d615d3af42d1855843cf99e48c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434185, "uuid": "c0da9287-b017-4595-be8a-3e3020b01014", "comment": "Malware payload (Mirai)", "value": "67739d2832e05fc257c09057a27201153a7f45ecb6e4305d540837726624f28a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434185, "uuid": "df192097-15f1-4900-817b-44b6ea4548ff", "comment": "Malware payload (Mirai)", "value": "205410b8abbab39e136d90585c5bfdc2946bfd50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434185, "uuid": "106d71ab-2034-4b33-bea0-baa00b7c1903", "comment": "Malware payload (Mirai)", "value": "99f239c2a55c3b268a9130b7ad2e2d33edf5caf668bc724206ed2dafbdcf2f290680c66088f1b4c870980ff6e62f7911", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434185, "uuid": "aae0317d-f0a0-414a-a3b2-52c8db5c818b", "value": "T19AF2D190D52A5DECFEB80DF4E69ACAC217F2870863E7ADF1408DEF212E0A411B545DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434185, "uuid": "7ff84883-bde2-4ad2-9505-683f3de1532e", "value": "768:mbAyti8Z3Tz3D1FqAY9eS5JgwzveVb4dCZK8oS+TwXH4uVcqgw09bQ:mbAyE8RrD1FPOevwregi+wH4u+qgw09k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767434185, "uuid": "edec0793-fe1b-4d79-8d9f-48697aa87c34", "value": 36028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767434185, "uuid": "52d34739-3c33-43d7-afea-dc7e78a58c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434185, "uuid": "2b1887d6-1c53-4180-b900-7ffbf1a3ad99", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9c5bc2-e881-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430244, "uuid": "c488df66-0872-41d4-8596-867c1ee1291d", "comment": "Malware payload (Mirai)", "value": "cd4c4a23c6bbe452834c5dc01bae2d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430244, "uuid": "d937ecc2-6ed1-415c-93e5-212cfa7c9662", "comment": "Malware payload (Mirai)", "value": "68677dc3ad8ef39de7844a74f4948d9f7705ea5b520cdad96c3d3a12677f5455", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430244, "uuid": "d7e3ab20-9b3b-4039-8479-a18170de3e1f", "comment": "Malware payload (Mirai)", "value": "e81eae9855e41967abb0ef6a836548e3c379970d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430244, "uuid": "1f4ca427-75eb-4064-9e0c-a41583a31199", "comment": "Malware payload (Mirai)", "value": "bef37bfa06bfc5e91754168a827ca188e31e5bb355d506f75620a92c71c1fc4b240625b2ca2e1d2abfb06fe06779bfcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430244, "uuid": "545ff2cd-b108-4a7d-bfec-b30141076052", "value": "T1B8436D86E409DD3CFC5AE67BC41A0E04F5287351A6830F279766FCA39D731689C17E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430244, "uuid": "370a0a49-f25a-4b30-aa04-e9bcae5e9be2", "value": "1536:VO8yEFjMfB3DtZmZd0xKLDoJtcmqXKd6s8I6ZPm:VOFEFjMJmZdNLwtqKA7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430244, "uuid": "7004b168-5f89-4300-97ef-ebe28c981d80", "value": 58684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430244, "uuid": "6a746773-9011-41c5-b9de-dc1b015d8835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430244, "uuid": "de9eccf0-abb5-480f-bcd1-f74f1749c419", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc05a98b-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444286, "uuid": "79f4c8c3-9f87-4bf8-86ac-355b6e334e3c", "comment": "Malware payload (Mirai)", "value": "b9a06ffb1480ddd466f42518e893582c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444286, "uuid": "0f3625a6-1da7-40bb-8f03-f25e2d71e756", "comment": "Malware payload (Mirai)", "value": "68778863750c4edd98b5c80a871177343a0cfe4571109886849c263937897088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444286, "uuid": "0363c05e-d6f7-4491-b868-cde52bf56216", "comment": "Malware payload (Mirai)", "value": "50afa9a4dfe0780772acc7a044168a601c6d9874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444286, "uuid": "fa6bb57c-4712-4b50-bdae-a2a7ef8f757f", "comment": "Malware payload (Mirai)", "value": "0170604fe546e3b6d4b29b507da68b5595f40ee16b621f899db566c26eab7110bf002095b038591eddbe222642c6add6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444286, "uuid": "58bb8872-a78b-4c64-973e-1e9b70be408e", "value": "T11073F2B6353DD23DD498BD73446931A0DE773E10E64627B708A93BBF8382A096471F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444286, "uuid": "be640064-98d6-4868-a14c-daaa90d9ffec", "value": "1536:UcEKKPIyBRcZaRIuxgaeWxcGl5ye94nIZss+XZvSW:UcrKAybmB4ga7/5ye+nIZlPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444286, "uuid": "fdb19f08-75ee-463a-bf70-68f1d1bfb5a8", "value": 74336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444286, "uuid": "4561148d-dff4-4eae-8a9c-870e0f2e40e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444286, "uuid": "983cd54f-d268-4f13-89ec-be6c7345bb02", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2204645-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767429559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429559, "uuid": "6a14eb76-25c1-499f-8dd8-6ae9c93dd23e", "comment": "Malware payload", "value": "4f6bb297521d455afdaaff2e3962f667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429559, "uuid": "0bf7b311-43fb-4a74-bfd5-9ba409724b84", "comment": "Malware payload", "value": "68ae7c336676d1be6bcea4626d453ce45b98be5538848bbffa57f717737b6aac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429559, "uuid": "d3029cfb-f9ed-46f3-bb89-525a65801594", "comment": "Malware payload", "value": "8a93049d95c358e86a1864a78c34b13d950a4bb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429559, "uuid": "9d1a5c8e-2111-4582-b363-8de1e9aa731f", "comment": "Malware payload", "value": "53cf559ec5ce228b1b12b49eefd4b27139dddd370ac72d1a2913c1d3ce1d143a43046e46cb8480e061ddf7416e1e5a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429559, "uuid": "00ace0bd-c9b7-450c-bad0-0504770031ff", "value": "T1DFC44C55F8809F91CAD529BAF65D929C33070779C3EBB20799245B343BC78AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429559, "uuid": "ef024df8-bb88-4a30-be34-58c365127abf", "value": "6144:fm6nfjVkkswGS6TJ29lIJpe9wODPjMvw1xaoZb5DmhJ2kXbtaDgugpZ6m1Qs:fmAuks8Ggi8h42kXp2gpZ6m1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429559, "uuid": "7047ed36-f80c-4b96-b8c9-da51291f83e3", "value": 553740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429559, "uuid": "c34ae6af-1fc6-412c-9511-e538821ec980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429559, "uuid": "6f1e73ab-955a-40f4-baef-bbecaf8d5c17", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45de7f64-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427230, "uuid": "13caf0b7-7ef5-4d7b-9b7e-0fe3238d65aa", "comment": "Malware payload (Mirai)", "value": "61bdf8485ea6d49d3f16100c91cc9082", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427230, "uuid": "2119ac60-0d19-40cd-bae9-b0e78bdb8a3b", "comment": "Malware payload (Mirai)", "value": "68e56a2a203a004cf184374939dd3d6bc05196aa69b37fa5a9b7c791f5d8d54e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427230, "uuid": "8a5b4371-e5f7-402a-bc9f-1de12d017ac1", "comment": "Malware payload (Mirai)", "value": "71afd1fac48b6a18f835e35e0cd95b30e6b36747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427230, "uuid": "3f543c58-8cc4-47fe-8772-2875e739f4cb", "comment": "Malware payload (Mirai)", "value": "ebd1e654fa89c7b7969058c80d5f2bbeccb859e286160cb3bab760e3a4b5b6370bbf31d381a27efcca48acc2b2a69c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427230, "uuid": "fb7d4389-bcef-4f05-afd8-7c9534fcb466", "value": "T19B5302F7D0FEDAC0D22DC036C5EE7E861A54993A01F4A3B69ED32438514AF1E6E14381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427230, "uuid": "14e8a9d0-5956-4683-a25a-3fb510a7580b", "value": "1536:TRxDlcSKIoLEGe4kjdWpDXUK6o819cHRKQ0R9QZ2cbnouy8Hy9:TRxD6fIopfkiDX9p88E9bYoutG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427230, "uuid": "30a65320-7484-45de-ac03-b13b21faa42b", "value": 64024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427230, "uuid": "4364cf34-d657-48b1-b9c6-6fa51a588084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427230, "uuid": "d0a93e20-47a0-47ed-a88d-310fce17eca2", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22d1294-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430821, "uuid": "5bb5e2e5-ede4-4f1b-b3ea-c51d00a26ba9", "comment": "Malware payload (Mirai)", "value": "52317b4a75331c2c323e6c970f3ae172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430821, "uuid": "02a536d8-a17d-4d48-a0b3-5d019fb348a8", "comment": "Malware payload (Mirai)", "value": "695d0abae584202b3c232b6aac0427d50381b76d7d4ce7c8dc4778f6d97c8082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430821, "uuid": "c4472a43-afaa-4044-b0d0-a848098bd210", "comment": "Malware payload (Mirai)", "value": "fe07467eb1d037dfa48100d5aed05d6989b34617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430821, "uuid": "27f29fb7-03ac-4905-995f-4c6b0dc5ef2a", "comment": "Malware payload (Mirai)", "value": "4be812da081af083ed4b2e336db9983b1693e32f159f4cd41e31015b4ec8e2a5b506631e1f82048ca4aaa6616be14ff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430821, "uuid": "e7446971-ddbe-453b-92d9-09b1d64bb5fd", "value": "T10E232AD3F100EC7EF84AE33AC5030915B5307A5585A1666373B2F8E39D723A9583DE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430821, "uuid": "459e5090-7056-409f-a027-fca228b1b169", "value": "768:kdo/3kWqGvwUv5GqC71YBy2bFwaNJdHjFnMy33K88sTPADPlTi:vzqGv5v5GqCR9CFwaNHjFMyHK88sbADI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430821, "uuid": "e9732bd8-9ce0-4488-b557-2fc22da27d01", "value": 46920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430821, "uuid": "32e9bcdd-5e54-4118-885c-dcd6eb2621ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430821, "uuid": "cab88e77-9c71-4b24-802c-023839d04123", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630659af-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399362, "uuid": "a0a06856-abac-4b53-9b2d-5c869343ec8c", "comment": "Malware payload (Mirai)", "value": "fc741919b98c74ba66341459082ae7c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399362, "uuid": "d4e06809-6a8f-4155-bbc1-cd972c1cf653", "comment": "Malware payload (Mirai)", "value": "6b250b94683df01ed1b4c235735d00e14257c77f95dbd30d24d52de3df5c8fad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399362, "uuid": "14f6d859-b72c-4b2d-a4b3-07afa7223ea6", "comment": "Malware payload (Mirai)", "value": "19e873d2da80b42cf2bd283d7237cc7efc2f401a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399362, "uuid": "b60f52d8-fbe0-44c3-891a-57636c8141c7", "comment": "Malware payload (Mirai)", "value": "956894590957af387ab91a4ef39d1b27de2fcd65185720268f054d055568a16129cad8d8a256e412e7a4a07ab05fff25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399362, "uuid": "1f57dbfb-fe6e-45ba-962d-a4fee8bc0c28", "value": "T19673D846BD918A16C5D512BAFE2E118D332357B8E3DF73139D106F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399362, "uuid": "5c910697-f08c-4ec7-b1e1-7a52370fc78d", "value": "1536:uRn5KZ9QUoN4j+zAfqgVTGseJHweM9JvYZSMNlT43wMZiF3q2VsIu+7R:NZSUR+zAigdGlJHweM/vYZSy3q2VsIu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399362, "uuid": "c07322c8-f7b1-49ac-800d-6a769976eb9b", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399362, "uuid": "d33b3305-7737-4fc3-9555-8fdd69e1418b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399362, "uuid": "29a7cdc2-b36d-482e-9777-3b7ec129ddff", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14327d18-e893-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767437884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437884, "uuid": "ba267e0d-b83a-47e7-8408-a1fc88aba82f", "comment": "Malware payload (QuasarRAT)", "value": "6fefc8df0247519259414381bbdc2a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437884, "uuid": "607c17b0-5887-475a-8559-c951e14e0e4a", "comment": "Malware payload (QuasarRAT)", "value": "6b4996326303764ca4546eb9cc63fd3e1e5931d20f1f2e1293f6bada09d31268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437884, "uuid": "cb297276-b1f2-4671-bd67-3ef5d4aa8ade", "comment": "Malware payload (QuasarRAT)", "value": "a7cc75b0ae5c9dd556c3ceb406b392d929b8ed61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437884, "uuid": "f75d7e2f-42c9-4511-998b-4226d8f4882e", "comment": "Malware payload (QuasarRAT)", "value": "99e473ceb12493ea3dd0c8509b13b77ab3c5f1bbdf393a1a377e9996b1f66720a3b664bb45dbf9496f67dc010b2048a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437884, "uuid": "d68cefe2-ba3d-46b9-8c72-372c0d92fb95", "value": "T1F2E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437884, "uuid": "755b0865-1780-42c3-80a5-573073739df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437884, "uuid": "dd2e18e2-ba1a-4f9e-be15-9139303c0fc0", "value": "49152:WvvI22SsaNYfdPBldt698dBcjH/Cl1JZLoGdqLTHHB72eh2NT:Wvg22SsaNYfdPBldt6+dBcjH/CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767437884, "uuid": "b0652ba7-c4d4-48ef-9450-ce217f0146f1", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767437884, "uuid": "5e1afd73-dd31-4e61-89de-ec98f0356b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437884, "uuid": "07ccdd34-769e-4aa2-855a-5ff3147c18fb", "value": "Zombie Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838348b6-e8d3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465559, "uuid": "67871d1c-5df0-4ad1-9ecb-b43a3419905e", "comment": "Malware payload (Mirai)", "value": "eecef363869af037deb5d4cb8add8c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465559, "uuid": "a6020b26-97e7-4252-9a15-f5bbc25148e0", "comment": "Malware payload (Mirai)", "value": "6b9c9cd6c06745f34621fe65b2e2ba52a413b80cec88c16665b853487956c065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465559, "uuid": "3e1c9bc5-a787-4d89-80a3-76fcea042b0d", "comment": "Malware payload (Mirai)", "value": "81c452111eb8d224fa2dcaafce1f9f9ee29d357f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465559, "uuid": "b7b1d53f-84c1-43ec-98f4-31e0d0a6cefa", "comment": "Malware payload (Mirai)", "value": "84fb491d8a70ad3e12eb1aa8d791db47ee818fc5cb1c14f0cef728b397d4fa633c6a1635e644308755adcaaaa6ff2a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465559, "uuid": "7cf5dc9a-ab77-46c7-9762-1de1582f82af", "value": "T1FA6318D5FC41DA12C6C11277FB9E82CD77270368E2EA32079B256B61378796B0E3B509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465559, "uuid": "405bc717-3183-4a28-a6a4-45838de6d3f3", "value": "1536:PIyCy8PnOuKLzvvX+v1cV/GG69VXkOfuXvh8j:fSG3/vvdG9VEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465559, "uuid": "cc295983-be84-499c-a6d0-b20993609e20", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465559, "uuid": "4d0cffb1-f8e7-4478-aed3-bea516010c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465559, "uuid": "0b4408ff-f33b-4048-9b53-976d3567b61d", "value": "frost.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c04db4-e8d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767467248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467248, "uuid": "fc407543-a3ee-49e9-b6eb-0f7b88fac0fc", "comment": "Malware payload (Mirai)", "value": "aa196e380a3f6357d0aa07fc0e2414f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467248, "uuid": "1acfe97b-c030-447d-9934-dc1546df44ca", "comment": "Malware payload (Mirai)", "value": "6c22f3988afce709b39439a4ad253b4806b6f7f3c3581e1a1966b4f6848895c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467248, "uuid": "05db9b22-a4e4-4b0b-95a2-30349e607d4f", "comment": "Malware payload (Mirai)", "value": "68360820fe26e2cfe45a16c994246020c04e6744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467248, "uuid": "e438ee4b-8cea-4354-8cdb-37c187ec5617", "comment": "Malware payload (Mirai)", "value": "579a09f96c76a4314d76e24918033d22d607842b7324add63c9735d98d88a91c471dad7fcbfd10c4997f5d947d4c958d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467248, "uuid": "fb206e9e-2f7e-4087-8dd5-34d5e6cfcad1", "value": "T15C63F6753945F2ACD6E94078F4436EE91E1209283EDCD1E36087143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467248, "uuid": "2ca0d6cc-2c17-4736-9996-c600c45d81f0", "value": "1536:BWq4mXBnUM+mxqIKaHIZVBIVCCfy0K9UZRN8:dUM+/IOunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767467248, "uuid": "b70e4e60-91e6-408e-9de0-aa85f794dd40", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767467248, "uuid": "7bcc2c1e-b287-4451-9447-03ffcec4640e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467248, "uuid": "96706b6e-6f18-4885-8d5c-dc86bd28c4df", "value": "Mddos.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68848a44-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468520, "uuid": "e6f2939b-ac56-4346-99ec-de8eafa769c1", "comment": "Malware payload (Mirai)", "value": "ddc6ec09c26771ebad90a73ea8fa1a01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468520, "uuid": "5126de55-35c6-4cf9-9783-28de6e3422b1", "comment": "Malware payload (Mirai)", "value": "6e1c7d4bbc6f9bb8303e4ee6aceedece45d282ba8765aa136b79325725cdf156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468520, "uuid": "b8350919-e801-42ff-88a7-ae7b90678575", "comment": "Malware payload (Mirai)", "value": "780673e730b6eb236c7140cb6d5b4c2af0c89383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468520, "uuid": "b6dcdf3a-8518-4057-85b4-b96512c3cfe8", "comment": "Malware payload (Mirai)", "value": "31c585129e4dfafe4f603d770436f075bfce2aba81054da13b8a21006127b7d16c03eab20e06e1eee68323c41c117ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468520, "uuid": "44a3e48b-fdbc-4612-a27e-6e20bd9baaf2", "value": "T14B935BC2A793D8F5FD6612B4217BF3364672E9390039EB4ACB25B835A81A502F71735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468520, "uuid": "87b98ed7-ece3-40f7-bf49-1000b0899cbf", "value": "1536:F1k5kUFsjpTXTtiwoHGIBbyXi4tfA41QHvD+A4CXQvtAhWBero87cZN3Zm9+n:UmUF4pAwoHLBby7fA42HvD+Avy8KW/oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468520, "uuid": "eda3ff4b-ae5d-4fdf-9399-b931afb73c8e", "value": 91124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468520, "uuid": "210727cb-789f-4f23-ac91-3d2507abf123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468520, "uuid": "367a3cbc-8516-41d5-9d2d-93da3e1804da", "value": "x86_32.kokz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142f6353-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445185, "uuid": "5530ecd8-0c47-4334-90cc-f3e2bff954e7", "comment": "Malware payload (Mirai)", "value": "1d567bf199e4ce47273da33740f8757a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445185, "uuid": "d539919b-bfec-40fc-9845-9397a87015c1", "comment": "Malware payload (Mirai)", "value": "6e4e5b9daf0a4187cc3c75b0182af4f5fcc35dd94c373e27fa98b748af50e8d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445185, "uuid": "4e14fc64-1411-4e12-affa-98d6262a99f4", "comment": "Malware payload (Mirai)", "value": "a6fa4ec58d0eb2dd5b1fb7ba646d752a2a5f1e6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445185, "uuid": "cbdbaf5a-088d-4020-bf00-e1c651596d6b", "comment": "Malware payload (Mirai)", "value": "6b2a7d58db4b117db56afd575a5ddfe4fae7645627e8a359be8493d9238de7f350c4532db3b30c14f98e5af4fd40bf17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445185, "uuid": "189f9f52-6220-4833-ad70-76cfd3e774d6", "value": "T180634C217A7D6D1BD4C4A47F21F34235B1B1574E36A8CA2EBD720E8DFF20650214BAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445185, "uuid": "44139305-0caf-4568-a55f-486a84f931a8", "value": "1536:nE97YrXmu/S2OlokQ9CqcrbZeugCYtPn8qedmlfRehe+ch/B:E97YrXmuacD925wU2Ge+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445185, "uuid": "4eccc045-a08e-4c45-864f-cd79b9dcbba4", "value": 68536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445185, "uuid": "dbdfd8fa-3645-463d-b9c8-5da0f39e93ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445185, "uuid": "c3924aa4-2792-41d9-8251-d91263652054", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbaa2e4-e845-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1767404369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404369, "uuid": "7f719fa2-468a-47d4-8d8d-4f1dd8fa5aa9", "comment": "Malware payload (Vidar)", "value": "b00e4448ff28a1e2254e341d681224f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404369, "uuid": "f932aeed-8e96-4aab-8bb0-4cf9816823c8", "comment": "Malware payload (Vidar)", "value": "6f44d1daf096096c942ef6c3d6f0abffbe5b48aea1328b767716de924abebb86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404369, "uuid": "c281c8d3-6f8e-481a-aa8c-b40b644ae21d", "comment": "Malware payload (Vidar)", "value": "e575e76fd17d7d298c6ef756fd37981882d4f7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404369, "uuid": "ac1d81bc-4187-4771-b2d3-3cdaf775774a", "comment": "Malware payload (Vidar)", "value": "5f4261c9d9d620722a0d42bed99892e4fe1165edaad8263716f24131d605cf7b1c39bda3c2b8c892b6bfd4c3671d0b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404369, "uuid": "1bb4c273-5003-47f8-9dee-6d57e7395ccd", "value": "T198283AD2EE545265DA9FE23ED47162892230B185173211C7BF6807A58C1BEC8673FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404369, "uuid": "3778b81c-6cc5-41e7-bb83-d1c0087db207", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404369, "uuid": "94b5dcd1-ef65-4235-a279-afabef6d0904", "value": "49152:1U9G69Qrb/TZvO90dL3BmAFd4A64nsfJm6BNqtDIRsnlce1KHJA7Vk6j8spbOH//:1U580IuE+Ul47Evtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404369, "uuid": "8cabb450-1939-4467-8cf7-47bc12c50a4a", "value": 95170696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404369, "uuid": "a478b9a3-9cf4-419a-af8e-4c36beb58e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404369, "uuid": "b3b41316-24e0-4195-a0de-8a22eeae8232", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645f4ad0-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399364, "uuid": "643ecc8e-8dd1-4425-9555-118b427ee4f5", "comment": "Malware payload (Mirai)", "value": "eaef3ce79da78b11a6a5145fdd28751a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399364, "uuid": "c7bde3d6-b3d9-4019-9f54-f99c0342777f", "comment": "Malware payload (Mirai)", "value": "6fc19d0c4d19419e0b543b56f4e655b655d5a0e214f936ededee6aaf97f3775d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399364, "uuid": "35c0dd97-66a2-43ce-8b12-fe57c2def018", "comment": "Malware payload (Mirai)", "value": "21881680f30094a16bc4f8c39bc57e141dc0a81b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399364, "uuid": "59b03935-9ff2-4cf7-8f54-2cdf011e3d5e", "comment": "Malware payload (Mirai)", "value": "c1b28c963ab20a9f24d503dbbecf5442b966cb02e02d8410360a8b870c995dcc678e9cc7314d034ebfa13d6814db2fc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399364, "uuid": "5cfa083f-5324-4a9d-b63d-9fbd3d2f4fbc", "value": "T11F536D4272184A57D2A60AB02D3F1BF193BEA9A021F4B3C9750FAB5D8571E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399364, "uuid": "2bab0ba7-951c-4fc6-939d-845dac32c81e", "value": "1536:1YYbbwRexDZFR8mbFk8k05O5kFmFqMu+7R0h:vNDF8E65kFsu+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399364, "uuid": "bf9d5b0f-6afd-4e5f-a657-9808f3edca68", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399364, "uuid": "eb8bdd0b-a33a-484e-ad23-9db92149f202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399364, "uuid": "e5a17ace-123c-42c5-ac9f-7c68ab07c601", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cad7a0-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399742, "uuid": "ba05b975-16ff-405a-8c5f-1aec75c99e5a", "comment": "Malware payload (Mirai)", "value": "2d62fdd5948ba69f2eacd685a85f2513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399742, "uuid": "9a1c243a-9f62-48db-a9e8-9b29cb0d28d1", "comment": "Malware payload (Mirai)", "value": "6fec59aa2a5ad87f9361c71a366150874c44742f1b20f52dd59d286e0c5cd6da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399742, "uuid": "f9c7530c-4bcf-4e88-8f9b-3ad0d6a7ee0f", "comment": "Malware payload (Mirai)", "value": "35c50bc9ef6be7863241c8b155fc35c978e39ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399742, "uuid": "bdbf38a3-bcfd-4f14-a267-434de242b62a", "comment": "Malware payload (Mirai)", "value": "7b53fa5e025a219330387fe1f7a47ff1cb2adfd79b6c9c3c2a7186f9efddfedde14de347da141c771d4b44318a4a3e54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399742, "uuid": "4c96c3bf-c687-4afe-8c0e-4c3aa5d6a1e3", "value": "T1FA143906B5C080FEC499C1744BFBB13AD972B49E123CB19B67C4AF222E4DE705B6D685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399742, "uuid": "fc799510-fe3c-47e4-9180-b48ba6a89dd8", "value": "3072:cVrScLffjVyf1Kul6+U5nYLzbtwcIiEtdtYb81bRBC11ca4Jp/+D4nup8eUoHrNQ:KrjLffjVyf1pl6+UZYLIVbkcfJ2U2hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399742, "uuid": "1d6cf2c9-c717-46e8-a5df-91d0a521da87", "value": 197288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399742, "uuid": "8e07b1a2-63cb-4859-a913-2780a09badbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399742, "uuid": "e6f7dce5-24d6-4cb7-857a-dac54a0bd024", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2318708d-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443063, "uuid": "f365da8d-d209-4895-9771-5dcde08c856a", "comment": "Malware payload (Mirai)", "value": "55138d69b27aaa3e7991c82249a4e1ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443063, "uuid": "833106ca-4528-4ff0-ad84-8cad04882d75", "comment": "Malware payload (Mirai)", "value": "70cf3e3d69a15f6efd77846dc8b8a0834e2ea73ba1b3b4dffbd5ca4d45c807be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443063, "uuid": "53d446f3-0a55-4e67-8fe0-7a2fae0a2afe", "comment": "Malware payload (Mirai)", "value": "539286d679e23c58bd24e17866cb82d22d99b187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443063, "uuid": "ce87c8bc-8900-47c1-87e0-2b5d3a3b4b6b", "comment": "Malware payload (Mirai)", "value": "7f7546a8e2b45029f4a4735c138fe14c27f8f6648368509bdf61bb7dfc9db3bb1fea084658e7189cc8382869767b7213", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443063, "uuid": "73b2a9b7-382e-45a2-bf07-8c1373f27367", "value": "T1C033955D6E328FEDF668863007B34E21A3A973D922E1D785E2ACD1105F6034D646FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443063, "uuid": "7ee9f396-16c8-44e6-8851-61d978c36b40", "value": "768:OlqTYA/N505OWGFSrr6L5D5hfm/y7MLrewwdD1vI2K:9/3fFyrQ23e3NBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443063, "uuid": "b8820144-cac3-4d99-9d86-2cc06e707894", "value": 52244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443063, "uuid": "d5fab015-05b9-4ce9-8f2e-1ce0d536fbd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443063, "uuid": "d171555f-28f6-4728-a62e-196b6280831d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763811df-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432465, "uuid": "da7ff402-a6c9-457e-ac41-776c725c14c5", "comment": "Malware payload (Mirai)", "value": "e4b841771ca0d9c65d721ae75d6040c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432465, "uuid": "a4528839-b1e3-4e35-a73d-6aa123dc12bf", "comment": "Malware payload (Mirai)", "value": "71b769b79f7ad9b4c3863f7a2607e416ae0be9856b183fef4d68a0ba1c71c154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432465, "uuid": "d4750575-4509-4195-b34c-88af4da1a022", "comment": "Malware payload (Mirai)", "value": "997eb517c5d8e51c66ddc964c6f253351b813de4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432465, "uuid": "4b824bf5-ca95-4eaf-baf0-4f05c09c0f87", "comment": "Malware payload (Mirai)", "value": "5777c67fc5f169ab3498c7e84191955fab468c551750d2bfdc1c3feb21eedcb94cc80b7762cc592e24300d74854d22ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432465, "uuid": "05a48b82-0531-4f3b-b127-4f15f1ce63cb", "value": "T190437E4372184A57D5E60A74293F1AE083FFAA6021E0B3C5645FEB6A8671F371086FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432465, "uuid": "2dc507fa-7c3b-4b0d-a661-bad256ebf17a", "value": "768:C4O8kQlYyRCBwD4zsuTCS8nu2vnD4DIFc+Tv6WE/Zz4qPC3el00Z1vSn3Xi/lNuc:CckAf7uvUWGv/Exz4qDRvSn3S/XuM7Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432465, "uuid": "f3ad3133-0a84-493a-a718-b4a94c426c8c", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432465, "uuid": "679b9d5e-5091-4bff-8c00-3349e73b4dcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432465, "uuid": "1f3ba4e5-2941-4852-b3c1-df85fd80d08c", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d35d46-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399707, "uuid": "902241e9-1b4d-468d-aa4b-2751d8c53e73", "comment": "Malware payload (Mirai)", "value": "591c420352f12853d850a7ab5c25094d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399707, "uuid": "1477f5c3-e411-480c-9360-b6da8caa2a3e", "comment": "Malware payload (Mirai)", "value": "7212ea8ef83078217dd9175e966d3ed28b51de53fe3dcf1ef2421b274737d101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399707, "uuid": "041fb5ff-c262-492a-98b6-dc9925a06787", "comment": "Malware payload (Mirai)", "value": "2e31f429eb7c0f8755d9faf449f9db5a9b774d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399707, "uuid": "8c1fe94d-e03c-4b08-97be-550be7306b68", "comment": "Malware payload (Mirai)", "value": "93c365aa597e3e05ae26ba689dab2d5c24ab7c2413e08237b6a3673c51e42024db37e7c02e7229a68bdc98c07cd66104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399707, "uuid": "2d97bcb9-69bd-4fc0-95f2-7123458f2102", "value": "T155147C63D9669FD6C16294F0B3F29E385B42BC1549171EBAA8A3DAE54043EDCF1183F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399707, "uuid": "4e40ddce-54db-4c5d-8a0d-b440f7021f99", "value": "3072:eakgdz/h4rz+ADJRTELASFUOubJx81r0QW1gg7CKXdk:eanz/yrNDEL1COubJyG51jXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399707, "uuid": "ea2750be-27bc-4624-8bb6-f632ba5e8fef", "value": 205984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399707, "uuid": "447efb98-3d4a-4eb2-a36a-a26565f3b9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399707, "uuid": "4444af44-f6c7-4098-ae83-e46024550df2", "value": ".4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b1bcbf-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442656, "uuid": "21ae357c-5fea-4204-9bd2-a28cf769c1bc", "comment": "Malware payload (Mirai)", "value": "77c66f19d270ab49146a48fc10a602ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442656, "uuid": "a3c1d16f-31f2-40a3-8df0-fb4dbb1bf9c2", "comment": "Malware payload (Mirai)", "value": "724465a8a0fc9c65c62d3d38cbc085d9fc0b6addaa7744f3d221bda1804ac23d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442656, "uuid": "7a805e30-021e-458e-8f11-6442d64f85df", "comment": "Malware payload (Mirai)", "value": "b63ab0e3ed246237fa1dcfc7a9551e9691bf4b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442656, "uuid": "ae23e297-d46f-4d3e-9147-a61143ae3c90", "comment": "Malware payload (Mirai)", "value": "f41b8b9dc998150fcdc9d7b22bc7a3e2e87ba7ced309d6fab6677b4e9fcee4b1da047a6194316244944eb679b9da000d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442656, "uuid": "d5c17d5e-996a-4958-a365-b7c207f4c85e", "value": "T1B383C605BB654FB7DC5FCD370AB95B0529CC950A21A93B3A7D30E818F24B24F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442656, "uuid": "0a095543-5a19-42a5-a06e-e819178d7e8e", "value": "1536:usnMQoTuryToYfDU9kMh59NFOHn2n7sOSldWUfIMHiu+7R3:usMQo0yTDfqkg9NFU2Ajiu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442656, "uuid": "5c0a6890-2fae-4fc5-8215-18c48342144a", "value": 86508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442656, "uuid": "76c5b3a1-42db-421b-a7c0-e43463b2954a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442656, "uuid": "f9ed5884-11c9-467f-8b2b-5d1934798cd2", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cbeae5-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430847, "uuid": "ad878427-e43a-44b6-90be-5fb25ccd8e94", "comment": "Malware payload (Mirai)", "value": "d70442a00374fcae46fadec9fea5d9cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430847, "uuid": "2ab44653-989f-4f06-814b-36babde8447c", "comment": "Malware payload (Mirai)", "value": "72aaeb2553b878b97efbd4f438fdffe9a51500719233f54fbbf191822fd75267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430847, "uuid": "812336ac-3150-4ce5-91fd-a35bebdd980f", "comment": "Malware payload (Mirai)", "value": "66529a7ac8bd4b6bd672019af02d38d85a73ad6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430847, "uuid": "39dd7426-dc99-43a7-8e96-3c13a19f5118", "comment": "Malware payload (Mirai)", "value": "d81500586c1497feb55972cfcf22430ad71336bbd62f517a0d4c1a5920bb8ca67abb999e944c958dd612257c436cece7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430847, "uuid": "e8e31ebe-4872-45ea-a779-5169b0030a5c", "value": "T11C042945F9418B11D5D632FAFAAE418D33536BA9E3FA7102DD205F6023CAA8F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430847, "uuid": "4c581e30-0aac-416a-a55e-ba0759f9fe73", "value": "3072:mTC5skZpO1nTewnibulrrJNJkPmCia+5xzfD5ZlyEkdfodNHXcD:mkZpEewyulxNJeDia+5xzfD5ZQBfqNHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430847, "uuid": "86c65a90-c3d2-4d3d-8e03-5fc59a46e910", "value": 174516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430847, "uuid": "b7d56ab7-7f1c-4307-836a-8f9b1aaac635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430847, "uuid": "3203c45b-4315-4752-92c4-51017aa2a53d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca83e03-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444287, "uuid": "394b50db-31d6-4b96-9446-5397d6c7e458", "comment": "Malware payload (Mirai)", "value": "a0fd37d3c069f7370aef4dd1f06d0db6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444287, "uuid": "d93c4138-dfff-43f4-b37e-056683b6c5f7", "comment": "Malware payload (Mirai)", "value": "72bf7021a323e4f8668499f2c124973c6d4744abddab61449824d7b5334249f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444287, "uuid": "97515fab-eeec-4e4b-ba56-14fd97027f6a", "comment": "Malware payload (Mirai)", "value": "0aaf65afc33451397443e7f7accc5d2f6076d81a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444287, "uuid": "25e6977d-4392-4e93-b865-3b19e6247a96", "comment": "Malware payload (Mirai)", "value": "8709f6cc81ae2e42e898fd84763b3698f2290c4b7aa40e20e6c29d4d4333420ae078ba5c15dce3e55e7bf261a4288d7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444287, "uuid": "c82b6c7b-574d-4d28-80a0-9b1c784d90a9", "value": "T11523D8D7F800E9BEF81DD73B8497040AB170E69501A21A372367356BEC762E81977F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444287, "uuid": "fda2ad49-c0f0-4c3b-934b-f9e6fca0290f", "value": "768:OzDxR6VObHfM6PCGuSBuhaCP2GJaGI8rsU2KgKvgVhBsxa+UTYUykjvyKosIT:kR6cHkqPQhpHVI8rneKvKhBKDUTYUykW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444287, "uuid": "292d9d46-98f3-45dd-8b26-0a1cf323044f", "value": 47600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444287, "uuid": "307bccbb-05c5-4a27-bbba-4c29c6ca1c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444287, "uuid": "c950a2ad-cf2a-45ae-a9e4-9b1f6aa48792", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd1c47c-e8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767448990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448990, "uuid": "a1b418bc-c2ab-4bcb-bccb-a99443152d31", "comment": "Malware payload (Mirai)", "value": "e4377b76ae8299d42034da9626c981be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448990, "uuid": "da844bfd-d7dc-43b5-8e9d-1f63449647ca", "comment": "Malware payload (Mirai)", "value": "73b9157a1e531dda1588e404117ca7c6ad70f008f3e2c8b3a27887f0fd6a9fb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448990, "uuid": "c72bb580-17a5-4bd5-b56f-711e9f1f3dc2", "comment": "Malware payload (Mirai)", "value": "b6b207ca72e8a02f09e4d5bbfc9b98dad408dcac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448990, "uuid": "f62d6fb4-51d9-4642-80ac-6b98d659f7df", "comment": "Malware payload (Mirai)", "value": "297a03f8f90500f6ff0ab2b81993c34856b9f1b5f6764b395a704edfba41f704ce804ce61230d04b405f574328b9aa7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448990, "uuid": "4f4791b6-0304-4f4e-9c26-b7203d5365d0", "value": "T1171439C7F800DDBDF84BE73A44630909B530B7A210925B376257BD67EC3A0A54977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448990, "uuid": "9688ce30-42a9-4db1-a7cf-257a04122276", "value": "3072:j5uhdfwrIweyZ4lm1yvsoeRarp6ybyK2Q3NCtq4VTvfzZsu6cVwjbiULbuFVWJZt:j6arjm1yKj3NCtlVHqu6JLbKigeJ8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448990, "uuid": "9f71f171-a120-4cdc-b905-821fccb1592d", "value": 207936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448990, "uuid": "386c9b29-7dfd-47e3-b4e0-d4980b0ced11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448990, "uuid": "05e5200b-99e9-4fa6-9f88-39f5732c1379", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38b7e2c-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430823, "uuid": "5cf2e7d2-795e-4eee-b55f-1c39aaec7809", "comment": "Malware payload (Mirai)", "value": "999cc1657732d8003c399308c8eb75df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430823, "uuid": "3d048599-ae5b-4307-b164-75deeb1df7fa", "comment": "Malware payload (Mirai)", "value": "74103f26affd073c20c2a82f4db4844d5b4a4ea75c3198ac432ca1239bcfffc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430823, "uuid": "26370cba-1f76-469b-908b-027ecc2e5be8", "comment": "Malware payload (Mirai)", "value": "00877be47fb23d9a4c1424afb2a376156527e305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430823, "uuid": "83bc9c4a-4e35-4710-b1c6-1693e332cdbf", "comment": "Malware payload (Mirai)", "value": "22bbcc27d58c37d0ff6ed3d56c8832c1eaea0d67b227cebf7ab00dfc46c94690bd07f2718228230720e83bac2805dc52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430823, "uuid": "742486d2-a9f0-4a91-be91-6fc5efa09867", "value": "T137530845BC82D616CAD462BBFA1E42CC332653E8E2DE7207DD116F15778A82F0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430823, "uuid": "05e71a61-2c5d-401f-8741-bb3a35077c1e", "value": "1536:vHxnCpy88n9Rc257bIhg/EaauUP6Zu+7R:vHxnvAd95Pgu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430823, "uuid": "0134ef5c-8212-42c5-9afb-aa33e491f619", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430823, "uuid": "3dd71afc-94e0-44e5-919d-90662237914b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430823, "uuid": "be26a895-cc63-49d3-83ee-d777deb0ca9b", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f9fea6-e8ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767477109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477109, "uuid": "e46addfb-2d40-42c3-8cc8-d2cd96abbca3", "comment": "Malware payload", "value": "2369763fff2e0fbcecc9fbcbc25c3daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477109, "uuid": "e3db6f2c-5e76-4334-aeb5-25321b9defde", "comment": "Malware payload", "value": "749a094dd333916249a24c7e9540c9f7f22c8ead8a9b1bb353aeaf1b8e195fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477109, "uuid": "e1f6cb4e-86c0-4ccd-8b10-b6f205e69c95", "comment": "Malware payload", "value": "f74ff834923f4492eb9dc3c8e4d3e4108d6db5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477109, "uuid": "1b57f299-9f32-4658-8420-5030dc101698", "comment": "Malware payload", "value": "d4256394381ec606fc745f4b4ff57b6f620320702900d8872311d8f83fe1d37e70070f37bb232e4d28094a748cdfeee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477109, "uuid": "a228c83e-ab6b-4eda-a13d-f7d46e45dd7c", "value": "T1E0173327B28A633EE5BD0A3759B2D2508D7B7661A91E8C46DBE04C8CDF1D0A01D3F257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477109, "uuid": "6c2c3eaa-919f-4e5c-9de4-60f9856066a3", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477109, "uuid": "23eccdf6-d5d3-4adb-b9a0-6890e6f47f1b", "value": "393216:CHvK/NqT473DdUO80fC0pDjrFmVU2hQvquHULMXLSAAijjsIIRqI:UKNRTKFmDQjnuHUQXLoIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767477109, "uuid": "ab884eab-5e06-4b54-b8f2-049e02bcea39", "value": 19430545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767477109, "uuid": "e360a665-58b7-4410-a1f1-3f671f7759b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477109, "uuid": "db6c1919-a5d6-472e-b01b-f7fde46460ae", "value": "Setup1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da076f80-e8a8-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767447235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447235, "uuid": "e7ba0040-ee9e-41c9-99d8-587365e68f74", "comment": "Malware payload (AsyncRAT)", "value": "23a667c0e593efc6ee498819de6e7b5b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wealth-platform", "colour": "#3C6B8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447235, "uuid": "877b0a5e-353b-4638-9c22-9c9e64d36a8b", "comment": "Malware payload (AsyncRAT)", "value": "74c70fff02b4385b2234c5ef330fcfb498d713ffb355c699f1446e5d5f3d8d6e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wealth-platform", "colour": "#3C6B8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447235, "uuid": "a8ae6233-c080-4ad5-a710-85cc056414a4", "comment": "Malware payload (AsyncRAT)", "value": "95148777b28a0f6076528f500d77dcace6277945", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wealth-platform", "colour": "#3C6B8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447235, "uuid": "420983a4-984c-4fc1-94bf-c4fa1f10ba35", "comment": "Malware payload (AsyncRAT)", "value": "a281ad565e114eb355ca017de16cd676a6ca5e76505cd4b0ba5b8d70864d8baea36d4234e9a7165376ea5edc499e6264", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wealth-platform", "colour": "#3C6B8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447235, "uuid": "7df4b2ef-9d9e-4491-83af-e9d5f4c5e749", "value": "T1D9232C0037E9823AF2BE4F789DF26145467EF5637603D64E1CC4519B4723BC68A42AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447235, "uuid": "c94a27e4-96c1-4583-b8fd-3667c5784104", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447235, "uuid": "4e8067d8-dcc3-4447-aa14-4bb23ced6d90", "value": "768:RukrVThkxx3WUL2sdVmo2qD4zDI+OPIozjbegT3iebZubMOBo3BDZOpT:RukrVThSV2bnz3o3bhTSebIb4xdkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767447235, "uuid": "0763c400-df35-4703-9896-f30f16052949", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767447235, "uuid": "a3d30f76-ff77-4c7c-8b02-21fd1ab0a550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447235, "uuid": "b5c24e93-eb8c-4047-8da2-f840b257b1ac", "value": "aurora-wealth-platform.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31864192-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399708, "uuid": "9697ecd0-4c1e-4540-a055-695289126ace", "comment": "Malware payload (Mirai)", "value": "39cb975e307e9f6534202ba4e97b59fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399708, "uuid": "6307b75f-d1e6-4d76-b851-299cec3ffae9", "comment": "Malware payload (Mirai)", "value": "758b63c3c7ea975aae3ec8861fe486c63a403f288bb27b206d5fd2f82e201c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399708, "uuid": "8d8ddc5d-d1cf-46e3-88fa-17be4ea33744", "comment": "Malware payload (Mirai)", "value": "39e372c4573f1766ccf5d64cdb42c0ed949df6f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399708, "uuid": "072f99c6-c68e-48e5-8a48-c7de8e4a4c56", "comment": "Malware payload (Mirai)", "value": "b5d1563808e98c67882c6b97aa089b16a69d7ea53552f31db6110c9c7d14707e103f4c61a76a660779a8f5093deec412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399708, "uuid": "0dbc0e3a-9c12-4619-9204-f8475ed60f55", "value": "T14C73F297637EACFCE4B505B120E603F4F76A7B5356151A8BBC86D20D9FB0C9825318D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399708, "uuid": "a46c1706-3835-4f14-98b3-60bf13a4096f", "value": "1536:FRvWZ/qmOPi3MBHKA5g08n151Um87SFeQTJRvNa:FoZ/qk3aqMq9h8+FzJRFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399708, "uuid": "e393cc41-328b-4810-907c-b7254eb1239c", "value": 74216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399708, "uuid": "846f4010-819a-4895-b61e-3d395f0f0475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399708, "uuid": "94e5f6a6-6bd7-4497-a369-632c3b83800f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c9a975-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442660, "uuid": "d60969b0-ead2-40bd-a884-0e20dcf2b098", "comment": "Malware payload (Mirai)", "value": "4c8216023b259460efb20c48e25606e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442660, "uuid": "f74e4569-df23-4bf8-992f-807948aadbf7", "comment": "Malware payload (Mirai)", "value": "75aa30fc031d710ffad4dade42a90d8b98e9070cc3d8d732e3c00e006a0b096a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442660, "uuid": "67b79762-a211-4734-9701-d6bf298f2449", "comment": "Malware payload (Mirai)", "value": "3ad6ba92b08675ee976492f07ebf4a904d00b970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442660, "uuid": "158d8a79-0a37-4eb1-8a1b-5e61241c0d14", "comment": "Malware payload (Mirai)", "value": "6f360ad922686464df2f2a277d5400b33b418cca4921c3489d42ad3d417fae2ddd3b30f5e2e54346c7b464fdc91b3270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442660, "uuid": "aaf4ab22-39a5-4f3b-9778-ea356a22f606", "value": "T19853023DC0B6CA49EA9B04ABEBAE724B3455463BB1984AF07749AC598D05E6F3D04702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442660, "uuid": "3df5b872-e8e1-477f-b3dd-e30eafab2a02", "value": "1536:CRtZ/7vBWTnrmdEnZGMx7evEci5bPPiIhQwS9bRF2tXfrr08Qnouy8Gy4:+tx47CiZDeEcgjaIhrgkNn6outc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442660, "uuid": "581ad684-df4f-4c0c-b68c-cb69a46b7d5b", "value": 64412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442660, "uuid": "e81ba93f-4995-430e-8dc3-388f4e38cc1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442660, "uuid": "5f4e0610-3664-4303-9517-fb78ae60d111", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb274cf-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459588, "uuid": "ec9fa14e-b4a6-4099-911f-f810472951d0", "comment": "Malware payload (Mirai)", "value": "d723127d19f2ed48eeeacb21d1d0abf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459588, "uuid": "91b02cdb-52d5-4bc0-8a90-774a28457f5f", "comment": "Malware payload (Mirai)", "value": "76502965c67d00de1ae6705affe3517d1aa15732b184337deeacce723c620507", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459588, "uuid": "1139b0be-241f-4cf2-9201-a04287cc7cde", "comment": "Malware payload (Mirai)", "value": "6914ec7568bad295148ea6d9b99c8da45ee9da86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459588, "uuid": "5f527652-b30f-4d5e-be12-e66853736781", "comment": "Malware payload (Mirai)", "value": "c099760d0adbb87ecf18c19e9ba2386a0a882fd6f1d72b9801bf9eb08ba45f3b8b88b3e7182db252334d0bd71a09c89b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459588, "uuid": "144d7e75-e8ca-4880-88ca-49b13275a4d5", "value": "T162F36C1AB78080FFC48AC37842EEB636D8B1782D1279765D5780FF257C99E21372E685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459588, "uuid": "6aff6b44-6f39-4b4d-a1ba-2d2ba7c6457b", "value": "3072:c6IiyQnRmyr5sxvBpQraWT46KDb1kB/oXApdbYL:c6IiBRXr5ovA2KoRko9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459588, "uuid": "ee511574-eda1-40db-9e84-a9dbc01c313e", "value": 169776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459588, "uuid": "e0d7c639-1d7a-4d63-b944-49bb1f28fa08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459588, "uuid": "04897d10-5a0d-4890-a876-942d060b9c8c", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d47b9b-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400068, "uuid": "0ffdc144-2258-4a08-89db-c839d7b598a4", "comment": "Malware payload (Mirai)", "value": "77c0f7afd745b0bd7d1257c4b42bd66a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400068, "uuid": "e058fd90-84c0-4876-81b8-d8c75d77c127", "comment": "Malware payload (Mirai)", "value": "76cb65701c76bd53dd71e0a7c26243883066abc75252936bfb2b155cb8613f1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400068, "uuid": "93f0f4c3-8c96-4c46-a2da-7808727066fe", "comment": "Malware payload (Mirai)", "value": "8fbfa1f341b06e7933787a7b0f73d73098591e48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400068, "uuid": "7694a6f6-e0f1-46d5-9ec6-6c782dcb2b48", "comment": "Malware payload (Mirai)", "value": "411c23453d9b4a3180ab9d25d0704062ce6ce77fd39f179d64d657f7ee486936b1865366dfecae9944c3cfcf966fb2f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400068, "uuid": "889966bb-fa04-498f-9ef7-d1ee5dc9d344", "value": "T1FD131AC9AE83C8F6DC0A09751577E73157F5D93A1078FA9BEB98D935AC12702B20A34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400068, "uuid": "51bb5d69-024b-4e1b-b9db-d196c8da94c9", "value": "768:ez+l/Cpi/uWC+DBf3e91goGX6GdI5dirWDtl0nxR:ezO/9/hVDpu91xpGdI5dmytl6xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400068, "uuid": "a19652d7-bcb5-4c1d-89f4-ba2b7bac6b69", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400068, "uuid": "fc13bf7d-92c4-48ce-bf6f-bc01e824646c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400068, "uuid": "077e0114-14db-4c6f-97ee-85ac1eb40634", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46948743-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427231, "uuid": "e1220a8f-4967-4563-b017-5cccddaca5ec", "comment": "Malware payload (Mirai)", "value": "d63d27a7308511a1e15f37d607bf9df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427231, "uuid": "de99a6e4-626d-4d1b-ae8d-fc0c3179e8a1", "comment": "Malware payload (Mirai)", "value": "770307149f727dbbe089664ccc93e0ffdee37cdb5360d72bfd741e301a4dc2d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427231, "uuid": "ceaf5a16-3419-4fbf-bb12-a470d60348c6", "comment": "Malware payload (Mirai)", "value": "7e403aba126a2f9e8553d1c885f8ce3afe0853cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427231, "uuid": "8d3a2ca3-d528-4f7d-bc8a-87df2e3ac7e3", "comment": "Malware payload (Mirai)", "value": "9efc468c4c50c401f037b0a553ce1359d3c26b95074d04291327eab003672388567d2f9e84ce6abd0ea1878dd2cad1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427231, "uuid": "0383057c-5b33-47cc-9933-71fc5727e637", "value": "T1847302C76D018EEAC35AA63B4C921BC6B63E98CD53D11D8FD0C4B987EB490A490F1C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427231, "uuid": "d22a3fae-7d10-4b3a-b427-5b37aba8a81f", "value": "1536:wdrdI68WZUaI0kzBVp4ZDVND94z23tsCOdQU2H9VJuK:idIj9R0kzBHsNDIK+CUQU2H9VQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427231, "uuid": "844f82ed-366e-4761-9e67-66971d0e67f7", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427231, "uuid": "caee3f89-f4d7-4de4-a0d3-e293854b7a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427231, "uuid": "ca6293ed-557f-4ac3-b606-02b5a853000d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316290ba-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442657, "uuid": "7d70de44-eda6-44de-a269-588fa00925c7", "comment": "Malware payload (Mirai)", "value": "d07dbcb5d854d3e6a53b8460e0792b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442657, "uuid": "fd16aecd-53f8-44c3-babd-576d15fb8b2d", "comment": "Malware payload (Mirai)", "value": "7719a0c1193f721e3f41e46b40021be6e7c513fa04eedf89b5e97a32a4429c8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442657, "uuid": "8f626df8-b3f2-459f-b9f5-1bb58b2d79f0", "comment": "Malware payload (Mirai)", "value": "2b35eb4d15e82e94bbde307d17f47b3f1fef7dcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442657, "uuid": "6549f2f6-7122-45b9-85f1-85cb09e73d4a", "comment": "Malware payload (Mirai)", "value": "172dc424674ec3becec2608849e231299eec249ece0305cbcbe7af1cb387ea1aa6465cd35f66ba392773679c04bce9d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442657, "uuid": "c3b0a853-3493-4c1a-83f2-61b996993516", "value": "T16E04AFA3B70B2890C86606F80BDB4B9D362311035D6BD6E7AC5F3939AF365CE55123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442657, "uuid": "bd50bef1-0c01-4ca8-aaa0-16627ece64d7", "value": "3072:fT6DReOv+yon2rCsX7StDiil/ZQPBMdfsqCqNGg4CBU1PattJvwbZnPq:fT6AOv+y5r5umWSCh/Cm4Cy1PcfvwRPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442657, "uuid": "60c4879c-a064-4156-8590-dd8da53297a3", "value": 182156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442657, "uuid": "9ec58f79-5aeb-4210-8178-363bfcd4736f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442657, "uuid": "301e214b-ae12-442b-8d72-e3b894e5d06d", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b20162-e8c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458746, "uuid": "6040f38d-6a0c-4c4e-b465-e319dd61d35b", "comment": "Malware payload", "value": "09215189b0b5d51309487c32c7726065", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458746, "uuid": "ecb9b2fa-e460-4887-aaa7-b4a9fc6b96d7", "comment": "Malware payload", "value": "77576ae75f5e8139698a78a431dfeffb182998850020a4b1328a7d3b01c9b9e8", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458746, "uuid": "be249653-fcf8-4b3a-b1f2-e8cae11039f0", "comment": "Malware payload", "value": "3d17a82ac06941a80d758cfc1fcdbd278690505b", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458746, "uuid": "0089a235-d46b-4009-8296-d7a0d39d2e11", "comment": "Malware payload", "value": "4552193e4aab6b6e6e9cad6c346dcc1840af5f7a00718971997bdeb4d86d68cbebc5e72d0393ca1895148aba91b2761b", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458746, "uuid": "57eb988b-7b85-44dc-a8eb-122106a0bfe4", "value": "T181D73321B26269D9E62F63BFE0A85FC940347DF0B31BD66763747FB589B068610B1903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458746, "uuid": "553d323b-0ded-4e82-9f60-90ee99fd524b", "value": "1572864:t7D8loPNBWA9+5aeS+en8MtGXj7oQc82wEtFY:t3k8BzM5aeS+OjQv2wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458746, "uuid": "7a10b5be-3449-4526-a416-08ef6f6cab70", "value": 61978624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458746, "uuid": "a96a8e4e-c1a1-4160-9c7c-40b0018beca0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458746, "uuid": "da4a515a-e987-4890-984f-39a94125afbd", "value": "googlo_Intelestersr_21.26.66.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53431bb-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468702, "uuid": "3a9db941-5c5e-4815-a62e-fb2e0463d4f2", "comment": "Malware payload (Mirai)", "value": "5c1aa2f0026aeeeae2eb31dd14c22356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468702, "uuid": "1d4ad2d0-ae63-4bdd-89bd-a96c84ad2a0d", "comment": "Malware payload (Mirai)", "value": "77eff96aca7e24a0276efb0c3ebec9efb39a700049d1f331d1b454a7f9fdcc87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468702, "uuid": "62837d3e-dab3-434f-86da-9bf2fdb98330", "comment": "Malware payload (Mirai)", "value": "129b0376171b52111e005d398f3654875479794d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468702, "uuid": "560dbab3-04b3-46bf-96d5-d410acac2827", "comment": "Malware payload (Mirai)", "value": "2298cc2152de3b9c285cd37e35bcbc4e48b8024b061154ea2e1dd58ab080b887257996fafc030c27ee1b123d02068d4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468702, "uuid": "93eaab66-f71a-4eb3-b96b-26b1367ce4c6", "value": "T1CA83C80E6E219FECF678C73547B74B21D39833D623E29685E2ACD1145E7024E245FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468702, "uuid": "65eb13f8-c91c-4a5c-b562-33d7599a4b38", "value": "1536:NyqCGNy8BXnIR35O+TPbPI3z7g59fh1T6vPaejLEifqs:sqC/5O+TPbPI3z7gzh1T6vdtSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468702, "uuid": "03a86a05-732c-419c-9d55-6a04b081284a", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468702, "uuid": "164d43cc-c502-45f2-8ab6-2dbfdb8288c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468702, "uuid": "45f2c061-69fd-44a8-ad44-5e798d4b491b", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddba638f-e890-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767436934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436934, "uuid": "e60c97fb-db9e-4492-95ba-b441f4f24ad1", "comment": "Malware payload", "value": "4620f74799435659d016458ffdfe91dc", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436934, "uuid": "5b80a127-0c38-4f30-8a42-0144db15d365", "comment": "Malware payload", "value": "782114a07a575d079c6ee3db172ff2c0c426c5106457a683501336e97b96309f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436934, "uuid": "05a34dfb-3560-45ed-8702-63a55f62fc47", "comment": "Malware payload", "value": "cd1add9198b914baeca03d74545d016f7bf71bfa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436934, "uuid": "6b5f4e58-642d-4c45-868a-eaae874f30d6", "comment": "Malware payload", "value": "be94754881f473e918e75921941ee48b08799d1d389f2de76f663d3269fb7c329e07b1e468437585e4a172b935fa4e9c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436934, "uuid": "9be4a6ca-e366-4953-82f1-09bb6da84305", "value": "T12DE4B587F1208AC7F44FEABE04904314A9F0E4704607F2552B6E885E2FEB9D89F557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436934, "uuid": "c12267e9-51ab-4517-bf34-2f59589baa5f", "value": "6144:rOuOu7rIveruKo+1VBkVVkGjOQ/8uqjIAdh81eMX5Uh/W94gpr2T9ktPjhMozV:IUbkPji5unU80CNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767436934, "uuid": "2136a0a7-13a6-4115-8fe2-0fee341b3019", "value": 689235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767436934, "uuid": "3e38124a-0de1-42f3-b944-fc814a28d1b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436934, "uuid": "a3c641c2-2362-44b4-98a0-07dc939d00ce", "value": "Working bundle dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2fa248-e895-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767439027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439027, "uuid": "9bde8a8b-54f1-468c-a1fa-79303feb9a30", "comment": "Malware payload", "value": "5aef21b5fabf09f7ec95cd09d8198e81", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439027, "uuid": "cb81512b-3918-4d1a-b3cc-489ff3021697", "comment": "Malware payload", "value": "786d892b0cd97a0d5e222dc89831e9a956fa79777b7faf7fa8855c529a49379e", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439027, "uuid": "04c43af0-6cda-4c0d-a363-c0309a7a4bde", "comment": "Malware payload", "value": "532a91956611487d3f0908fa9384fddec023bf1f", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439027, "uuid": "83f0fc58-78bf-45e7-a133-d58400dff960", "comment": "Malware payload", "value": "2ab3f54d0bd962f3b49a213d2cb855986116949b5942231541c6e1f3ef7cabf029ecd1fda77c968769296643c760ad29", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439027, "uuid": "598d9175-7f8a-414e-a36f-04a69517b0ed", "value": "T18D376D12FF4DDAD8E5E4A8740B2355F6F21E90ABE509493099D27FA71C217A09C1E32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439027, "uuid": "a10bdf04-545e-4fb4-9bb8-4057b2bc3aee", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439027, "uuid": "6012fa56-bd8c-4610-a349-e35eac6e881e", "value": "196608:H6vyc0mA6Dg1HIJROEeMVDfXBZiCiYh63PZ16MijNi2swSKw1gHV9/lO4MvV35ZV:311HoxzZ17wc/aHD3u+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767439027, "uuid": "eda5bd86-3c03-4348-99ce-c374b9b41bdf", "value": 23481856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767439027, "uuid": "e4cda333-f6f8-440a-a5bd-0a2efc18758b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439027, "uuid": "c087ec11-9766-412a-9947-11dd8cb4d740", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16bdf2f-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459596, "uuid": "2fed167b-6bea-4ec3-9130-f4fe0543c7cc", "comment": "Malware payload (Mirai)", "value": "2afb1ea0978d0bf336970ad48035aa99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459596, "uuid": "d0f77fac-14f5-4c3d-a700-3bb5bae7270e", "comment": "Malware payload (Mirai)", "value": "78954ceb3fde7ca10e324a229a4bd1ca97a211689dcc4f673f0e2a7c97114fd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459596, "uuid": "78b79b20-32ed-4b71-88b0-b0f6c791bdc8", "comment": "Malware payload (Mirai)", "value": "e13cd75b201d7f1014da3c1c46dbc2215e3d245b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459596, "uuid": "2121821e-3281-42cd-a618-019e2178b484", "comment": "Malware payload (Mirai)", "value": "59a1658e9d0c83f4a4e57b4faf2dee95972399f6922db5fe7fcc4de35d59feb601d4acaed9df09367c6c57bc1a3f6e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459596, "uuid": "0a664291-b055-4462-b7a3-76e624143454", "value": "T173A34D92FD81D612C6C562B7FB1E528D372753A8D2EA33038E265F21778B42B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459596, "uuid": "9ea655f2-748f-4913-a9fc-36dfe9d1cd68", "value": "1536:qtMT7smJuE54OW+UCi6Koipxtow9wWXNfXY2j/OknwrunQTGs1xJjE:qtMTgWn0vCi6KDcw9f9fXNeTP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459596, "uuid": "c4ac37b1-8892-4d1b-8aa8-922b6605495c", "value": 100440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459596, "uuid": "02ca6478-31a7-4b11-a6fe-a04f495d399b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459596, "uuid": "c52cd205-5d28-43b9-84a1-553f474c6c7f", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a220d993-e8c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767460026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767460026, "uuid": "f5375e58-9474-4675-ae69-3d3f6e1352c4", "comment": "Malware payload", "value": "ec566044d00ca5d6f9ccbced6aaca7cf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767460026, "uuid": "ee073539-3e03-4a17-8a2f-966300ea9f5c", "comment": "Malware payload", "value": "7922d096c73fe9259a9bc2f421ed9119676fd22b41db7dc13aba001b6c798dd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767460026, "uuid": "aed103e3-4a21-4ae6-9ca0-427234844217", "comment": "Malware payload", "value": "69df9a35f28dae0a44dafcd7146a7ecf51dea961", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767460026, "uuid": "af19add9-35b5-474a-a113-c3589ff28381", "comment": "Malware payload", "value": "d1a6b07d0adf33f165aa82dadeb20c0a710211fce22487e04640a0d777d12e38832c4465e96a2b10647774d0b25bcd08", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767460026, "uuid": "7505cd10-dd40-46f2-ae27-283d5326d62e", "value": "T105166C5273E65050F5F32BB06A7A62604E7A7D30A934C19EDA107D0E79B1F41FA26F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767460026, "uuid": "c48f5e19-1c8d-4826-bbb6-11c059ef5d72", "value": "5966c41f6619249c5eeba04d3c447d56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767460026, "uuid": "868736fd-32ce-49bb-bdcc-24eb09135610", "value": "49152:KarkVZQtgl4zh3H3mRJOM8E27HE8v0p9pGxxeeb1Rz3qUy59Qayr:KarkVZQCl4t33mRYHD0p9mHz7yT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767460026, "uuid": "2c549364-9f88-4144-a5c8-de1122c8a6fd", "value": 4296192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767460026, "uuid": "5390ba0c-40bd-42ef-8c51-6c234eeea251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767460026, "uuid": "138d894f-cad2-4d80-83d9-78d692031390", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9402869c-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465157, "uuid": "ea3db604-0d96-4bf1-9e6d-263d3cddab50", "comment": "Malware payload (Mirai)", "value": "f63f3c5cb27a8b0c8a21c7d44436704d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465157, "uuid": "44fdc7c7-13c9-4edf-b9b7-572ba0e37a7d", "comment": "Malware payload (Mirai)", "value": "7923dfdf7ccc76a59c83125eb3086b6b7e7af4e4b072a37227b8ef65d46542c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465157, "uuid": "5b3a6a24-dbaa-44fd-a026-3344fe0158f3", "comment": "Malware payload (Mirai)", "value": "dfbaf88e60278c05f83beb4e809ae7875f009ebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465157, "uuid": "ba888291-a86d-4549-9ccb-3bc21aaa2448", "comment": "Malware payload (Mirai)", "value": "f10f829d8bc371efb371bd7a274a385e539bf6c2b7440bb62b9e2a39fa151b32215103c5d3430935d1a8a579aa120993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465157, "uuid": "21706ed7-b90d-45c9-994b-c2e5d0e5e6ad", "value": "T1E1F36D86E747C9F2F81906B46077F73709B1E93D102BDA95DB75E931AC21502E62B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465157, "uuid": "c8559b13-793f-41a4-b308-6d4e37e74fe1", "value": "3072:vNvkhLXLn+MtSYYiWw7GBXfjZM/lP/nODEwgeoVos+JP:VvkxXLnLYKytfjalP/9wBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465157, "uuid": "8f666501-b587-4495-8ca9-568ce3c58a54", "value": 161652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465157, "uuid": "e0716b93-aa1e-4fb3-bed4-7ed01f543c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465157, "uuid": "b41f4973-5d64-4b12-9171-a5bc070091eb", "value": "x86_32.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7b206b-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463429, "uuid": "fb3a633f-ab0c-4b82-8cbf-2c771d3d5375", "comment": "Malware payload (Mirai)", "value": "19841c54e0d1d20c664442fc998fbeee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463429, "uuid": "93297f47-2de6-44e2-9fd1-4b3470ca5b7b", "comment": "Malware payload (Mirai)", "value": "7a29c3b5ae734cbab3cb893551eb85a17f5513e943d31de55d4c1c399f29c6dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463429, "uuid": "92b84ddb-090c-4ca2-8cca-8dff7082ab29", "comment": "Malware payload (Mirai)", "value": "e30097801503e8ef179a04f3d09cbe12490dc717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463429, "uuid": "d80186d9-5453-415f-8de3-b55c11ccac7b", "comment": "Malware payload (Mirai)", "value": "7468c856b9c5740bf5d4fca08864268b23fdc58e7387a2df72e7e9d3530526039f419a2680f0e1798f76108831e591fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463429, "uuid": "bf88c397-9a60-4191-964f-0cd787ee3443", "value": "T110438D36E96E1E74C04641B074748EB56F23B5C883972EBA1AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463429, "uuid": "ec877917-f813-45c7-8507-4f8f97873b07", "value": "1536:9aa0brW/Od9hlCRjKKxKQXACspfDCMx2+WZ:9v0brWGd9XlKYQqpfDQ+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463429, "uuid": "a08ee639-6386-4f1d-910a-3665fbdf142c", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463429, "uuid": "77b1aa8d-5513-4428-a92c-d7814c332b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463429, "uuid": "1db93627-2b10-409a-b574-48faf1419055", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1290000a-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430580, "uuid": "5c8ba717-0d63-40e9-886c-5a297d07d76a", "comment": "Malware payload (Mirai)", "value": "63ac9c15a8392da3523523210a70b4a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430580, "uuid": "70cbe9cf-ee1b-449f-a128-bc3251cf20fa", "comment": "Malware payload (Mirai)", "value": "7a6b8ef8f02a8580a8c60e5a37503c9032e8984de00b8736053f53227113070c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430580, "uuid": "55fa669c-f5ec-41f6-aafd-afe304a700bb", "comment": "Malware payload (Mirai)", "value": "5e8f111a1571945739a0c09d9f50ee5269fb1885", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430580, "uuid": "560fda17-dbbc-47d3-ba9e-12433c61a956", "comment": "Malware payload (Mirai)", "value": "d1aa253fd905bc35192abf58afd4378116c49cfff773d725242512e0738d89a449c4073abebf3c60689b12fe4724dc34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430580, "uuid": "5dff2b6b-715e-44d5-a9ff-8215200e445a", "value": "T1BB932A82BC81CA6ACAD4237AB67E528D3361B3A5D2CF3617CC104B1577CA65F0D27B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430580, "uuid": "84048541-cc8d-4b8b-9605-48f139b7f261", "value": "1536:J6S9hnAvpvONnjFyXQwPLp8VOGCwCOVFGD+8O6EAAxSY834afXTAX03G8muaIwvs:J9XnAvpWNjFyXQYt89o1N7kEnFZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430580, "uuid": "8306c65c-cdec-4bea-8450-9669eeb3d5d6", "value": 92504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430580, "uuid": "0a416814-cb78-41ec-9450-18312ff099f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430580, "uuid": "6ee828b2-ac58-450b-8647-77403b426c5b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce68892d-e875-11f0-a129-42010a9c0007", "comment": "Malware payload (PythonStealer)", "timestamp": 1767425312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425312, "uuid": "da5c472e-b6f1-4ebf-a793-cdc561494c80", "comment": "Malware payload (PythonStealer)", "value": "40752f2a055a4e85f0681e75191095d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "unknown malware suspicious", "colour": "#9CD898", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425312, "uuid": "0c9e95da-81a2-42c1-92d1-defdb29b184b", "comment": "Malware payload (PythonStealer)", "value": "7b6862a926537656084f882ad08d4a97bbaf74347f5ebff847235c3834817d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "unknown malware suspicious", "colour": "#9CD898", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425312, "uuid": "e5fe7e38-b936-4e30-8ee8-0772fb9bf423", "comment": "Malware payload (PythonStealer)", "value": "93bb5bd802e91a404b8e93dec061f66c0035f37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "unknown malware suspicious", "colour": "#9CD898", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767425312, "uuid": "5524609b-56d8-43b0-b4ae-19f710521bf5", "comment": "Malware payload (PythonStealer)", "value": "112ca905f994ed15b7ef2980a4c20c47d6e295d89a4c02bdaf8f65fcf3b85cb7826cd326e88f066c78992ea82627078d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "unknown malware suspicious", "colour": "#9CD898", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425312, "uuid": "e6dbebf0-2316-463d-ad7a-bdee9af81577", "value": "T1E107339B13F298F5EB43C7780DD78ACB453A64420374938613609DA7AA171E04EF9F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425312, "uuid": "43c8c892-930b-48f8-9e80-15f403fc2732", "value": "18cc960925e8468abe2bad7b12f031be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425312, "uuid": "a167d326-b2a8-42f0-b8f5-ec2608b3e3e6", "value": "393216:8AYhi1vXqWeLaPNkaHYjMFxGxaFCm+gpt84x4PgvXCJmFjY:XpPQLqNDiMF6aIm7TKgfCJmFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767425312, "uuid": "3b1e2d2a-93c5-4d6f-baa1-6b48f8ced526", "value": 17653248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767425312, "uuid": "068e266f-fc4a-44d0-a19a-49fbf38a6cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767425312, "uuid": "67b16a40-8b4b-44e9-93a9-a16630a482f4", "value": "LuaMani.Updater.V2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bfaae5-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400794, "uuid": "69cdccda-1979-462a-816c-07ac32c32709", "comment": "Malware payload (Mirai)", "value": "aa0b04c0886471dd190334166c38c973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400794, "uuid": "2d836890-462a-424a-a8dc-ba1ba38b795b", "comment": "Malware payload (Mirai)", "value": "7d0f0c97386f2f5a62693ae808d386be72ff03e1f3918b8ef6110fe4d62460f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400794, "uuid": "01aac7f3-9f72-4215-9ee8-ee6f399bd6f9", "comment": "Malware payload (Mirai)", "value": "7bee1d8293c7a4e9d17a405a3d6979a416a8c592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400794, "uuid": "294adb99-39a6-4b03-b631-d68272b78b95", "comment": "Malware payload (Mirai)", "value": "b335d6659ba46f13d84a1207fa7fcad942b13587d8a296834ef9f67d67439ad843ae894f1ec3556c7857e5a1de664961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400794, "uuid": "f731ac75-712c-48c6-b2e8-c3bdfc40d57b", "value": "T1A7A33B52BD81DA13CAC162B7FB1E428C771713A8D2EB33039E255F31268B96A0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400794, "uuid": "f3e6c14d-a249-43a4-982c-c99aaa959740", "value": "1536:76jcWXm18uI0bqt5z1kyq3uvZPLYRd0ZEAhslVjwO+czqqL0Fyh6U69b:76jcO2vS5z18eBLoC2AhsfeFYJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400794, "uuid": "7b2bab85-f787-41b9-8536-7c8434d328d0", "value": 99952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400794, "uuid": "7db1b89f-8b69-4110-9a76-e64125428429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400794, "uuid": "d233b1bb-b534-4e70-898f-ced1140b4efb", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119bfe39-e8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767448617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448617, "uuid": "c1866a9f-c1c1-490a-ad90-b1deca325087", "comment": "Malware payload (Mirai)", "value": "6510eec4205debe6c0a127ff88dffacc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448617, "uuid": "dcb7f3d6-7f7a-40e3-b2e2-949d0bc76801", "comment": "Malware payload (Mirai)", "value": "7d206d32b7a1520ecf92f096434dbd2f69d5da5649cbdfa0ac6bab0e348688a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448617, "uuid": "43c2b4b5-93c5-4ad0-b0c5-d583b16a7a5d", "comment": "Malware payload (Mirai)", "value": "d3df5a9be8fc1273e442c01ff8a3fe724b84368b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448617, "uuid": "3e6a9cc1-46ca-415c-a89a-32caad518db3", "comment": "Malware payload (Mirai)", "value": "5bfc81604a279bfe1c01f1259a2697db421042d061aa9ed1119088cb7df6e7b4443f44c4c9f9d049e3118d36d7177d63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448617, "uuid": "1db22a3b-6ea0-44fa-a9dc-c9a11fdaf6f4", "value": "T1DB43E74AB991DB15C6D551BAFE0E528D331317B8E3EE73139E14AF246B8B42B0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448617, "uuid": "12a4189c-d5cb-4095-abd8-61e04cdc32b0", "value": "1536:6hnz73mq58jrx9esqyHweIiswJLM0SuMvw3RMKi/zj2kJ3u+7R:E73758/exyHweIiHM0czj2kJ3u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448617, "uuid": "a798c6c4-5156-4789-8893-24013b9b2af5", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448617, "uuid": "b2b78219-af4f-405a-8319-b00c328cca6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448617, "uuid": "528d5133-fa39-4303-8072-cf8212b1af5b", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8745a399-e849-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767406294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406294, "uuid": "43502199-a0d5-4a36-958f-fb639716689e", "comment": "Malware payload (QuasarRAT)", "value": "a40bb1d5e6ee9802cbe43bcfee52f887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406294, "uuid": "e4d20581-5978-41b2-99f2-a9c923741f21", "comment": "Malware payload (QuasarRAT)", "value": "7edad86c094f657569d22c11fdd5c593723160bd0c131208b96658b655ba6afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406294, "uuid": "4b82f4db-627a-415a-b434-3223d49d904d", "comment": "Malware payload (QuasarRAT)", "value": "2b0c36d24dbddc89adcb86c96dd94dbe1ae35502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406294, "uuid": "88249378-ccb6-4860-a356-6b56b841890c", "comment": "Malware payload (QuasarRAT)", "value": "678c782f0945d65a2bddf96ff456ee533d327bf4931d13c184c5751a2003a095f7ba80635e89346a6cc42e09d8d002ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406294, "uuid": "a81bee45-84d1-44fb-b1ca-f6c2eb5ec90a", "value": "T13EE55B043BF85E23E1BBE27395B0041667F0FC2AB3A3EB1B6191677D1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406294, "uuid": "3436bc68-866f-4ff7-82c9-3c05ad14a825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406294, "uuid": "6e38ae19-846d-4e0e-90c7-f8c610fcb609", "value": "49152:5v7L92ZAaqPmjPol3CFAa5ILA7DovGEEsvkCqMLoDdg5STHHB72eh2NT:5vn92ZAaqPmjPol3CFp5ILA7DovGST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767406294, "uuid": "d40c1564-3e36-4c47-aff1-432c6e58ce41", "value": 3271680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767406294, "uuid": "272ca3e3-9da8-4b36-a112-5f0f495074e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406294, "uuid": "bd6424f7-09c6-4c82-a2be-b5810d84ec5f", "value": "win11_driver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9c68d8-e87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428179, "uuid": "9f1fab22-d16d-427d-8d40-d39f6dd8afa8", "comment": "Malware payload (Mirai)", "value": "637c2aaa8f891f2e7f4659a06e8b8d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428179, "uuid": "758b5911-4cd1-46e8-bc8a-9517ef4fe6d4", "comment": "Malware payload (Mirai)", "value": "7ef5aad03bafe856e6e0b959abf6981cbd6c5f9f84a049588ff87f5ad98e3145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428179, "uuid": "04a18f7f-eeb4-4537-b631-ec07ab709f4f", "comment": "Malware payload (Mirai)", "value": "453b744147af90a2acf5ba729ee8531692b8f324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428179, "uuid": "4077e5d4-0842-4314-8dce-2c00baf36d0c", "comment": "Malware payload (Mirai)", "value": "4b2cea9e34f84086d07584ecc341c0a94da7f06fe4d35ed67621533fd0eb4a7617649364eb50193c1fadf11b3ed93b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428179, "uuid": "af5cfa6e-28e4-414b-b5cb-400f309cf5e3", "value": "T19104AEA3B74F2490CC6506F80BCB5B9D2A3321039D6B86E7AC6F39396E761DD15123E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428179, "uuid": "628cc553-4c43-4809-aa4e-75e2e202a601", "value": "3072:sb8isVjYNddyj97SMa7PSbuSZG8nS0B3XkdT5qLxCGg4CplaPWHtOq:sb8HSdGpAguSMs5UVQLY4CraPSOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428179, "uuid": "a7d670a9-fd76-4258-8028-44ee022a2a13", "value": 182156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428179, "uuid": "2a93738d-cf92-49e6-9405-46e827053202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428179, "uuid": "1b48eed6-938f-45ae-a0ef-b456ae7530bf", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e0c0b7-e8af-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1767450161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450161, "uuid": "0fabc76d-b993-42ed-9698-d3d0e24e6ddb", "comment": "Malware payload (OffLoader)", "value": "150d26a81e6f83eed9f2c3a33a2a6ee0", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450161, "uuid": "5dee3378-cdea-415f-a688-99a5627dd521", "comment": "Malware payload (OffLoader)", "value": "7fde952c0ffa524b59b2f5102e7c567a92453315c0792374e7d61e0ef89cbbea", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450161, "uuid": "fe10a86b-22ec-4099-bfa7-c2cc26ee1293", "comment": "Malware payload (OffLoader)", "value": "21acbf8d45405133e22e9ae440bc906a5ff5648e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767450161, "uuid": "2a28f88e-dd18-4830-89c4-0c2e8061df72", "comment": "Malware payload (OffLoader)", "value": "fb4d4a0a324ab9d5736f3e8d826f0cf46b07656d05d8b6af5f76a82f028554b669647b6913a7498d209dcf06334c81f5", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450161, "uuid": "fb8afd73-cfc9-4502-bb50-f6572134e03f", "value": "T1F2B62373718E972FE43E463749B7C2144C37AA25955A4C0AA7F4584CCB3A2B21E3FB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450161, "uuid": "beb99d66-fb0c-4103-89bf-6cdbe39ffff9", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450161, "uuid": "e0488cf9-e870-42a8-933b-14306ea5f757", "value": "196608:0VQeWfKAbVPdDOTmdl5ogas8Zl6Jw/FfYaqScfyUWAMNUMU70N9z4Hba5ae53FNq:0VQeWfKAbVPdDOTmdl5ogasu6IRYalh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767450161, "uuid": "2eb0ff99-c8aa-4fa0-8959-d6dbcd6e1aeb", "value": 11238539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767450161, "uuid": "292f0833-5b7f-4741-8773-6d792bc59e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767450161, "uuid": "c5d24d9b-3d3a-437f-b20a-aa9d0fe4418b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b29370-e8cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767462155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462155, "uuid": "53277b94-3ca0-4371-909f-013a6f0da610", "comment": "Malware payload", "value": "b3561957fa1dc56bde14108eea35c51f", "object_relation": "md5", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462155, "uuid": "6dc58297-3c6a-465c-a036-5d8841e81f3d", "comment": "Malware payload", "value": "7ff9f7b3d5ee5db2673b8210539b617acffd690f2b125097d51a83b750fcfebb", "object_relation": "sha256", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462155, "uuid": "b5641261-e1bf-4c92-8bfe-705350e95fc7", "comment": "Malware payload", "value": "72d7ea8236f816ad646bd7a89b3d80a9bb113d40", "object_relation": "sha1", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462155, "uuid": "a25baf5d-1c34-49c3-8473-f4d9b3f5231e", "comment": "Malware payload", "value": "3880c20cea9726c7a3e8d18ac0b782e85fca0d279281718b2aa077d1fcb60599bd0b50815f6e2be6ca3d139fbe57cd66", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462155, "uuid": "dbf2ef1b-dbae-4ca1-b957-cb2bc0889c66", "value": "T15F450CED9CA02944BE4976B48E7FDCBA9C035DAB3AFF036143F0519207246ADE436875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462155, "uuid": "d1ef1a2c-f9d2-48fd-9f7b-049476f677e7", "value": "768:SLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbLbY:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462155, "uuid": "b4ff57b1-deea-4331-a2fd-484b58769596", "value": 1267042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462155, "uuid": "a86abb9a-e291-4955-92a8-22512528b505", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462155, "uuid": "b294eaf8-fd0c-4330-a39e-2009e9bafd19", "value": "SysTask.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e01d7c-e89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442480, "uuid": "ae7f6217-f71c-43fb-a7d2-9c00e284d127", "comment": "Malware payload (Mirai)", "value": "349205af3d41146abbba7f0ddd623ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442480, "uuid": "cbb85cda-2314-41fc-8425-e16a5e0aef39", "comment": "Malware payload (Mirai)", "value": "8027c6f089be296b3961b35fd9f4dc03edd64d05288e5e51ded9a3a25c0ab6b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442480, "uuid": "b32b3b9b-a5da-4886-a5a0-4ff82adb5a85", "comment": "Malware payload (Mirai)", "value": "a008825ff571be7d0422914f0b7a2f7ccdfb9f3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442480, "uuid": "f69a0c0c-8f6a-4a9e-9379-528f956dc4fb", "comment": "Malware payload (Mirai)", "value": "7027924101596ab66ef2234588f44d9077618cb3429642c93fcca0574e818e9b271bacabd592403c5ba33687d848ede0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442480, "uuid": "813a8720-a8a3-416c-aedc-f0953b7b8d4c", "value": "T19F2302928423F92583690CB5D38E1B936989DAE551EC3973B716426E31F6D038B7F0CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442480, "uuid": "3c2e25f9-a233-481c-be62-2c71af7031da", "value": "768:R0MnAKVirm0ysfS16tXuGDMWR3MWJj7JtI9q3UELwcOA/l/8PryQoPDzW/kBwGSt:WMAzrVS4ZdJtxLw/Ap8Pry5PHW/kbSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442480, "uuid": "f55c799e-d2e2-47d4-9cdf-616883d3cfad", "value": 47892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442480, "uuid": "b89e1fc3-8d2c-4a0e-911c-b2c89e900c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442480, "uuid": "c80033d3-633a-44e4-a515-2c04c30819e3", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea175528-e8d1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767464872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464872, "uuid": "1b320b68-080d-47fb-8a2a-da0e1c8d0143", "comment": "Malware payload", "value": "1fd355685955387b6048bb8a58df8d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464872, "uuid": "3f217f58-9f4f-40a0-9c3b-8350a8ee4279", "comment": "Malware payload", "value": "8174e9a6f26aa75242bc7e8f6f2fd29e6cf6fbac91f70174c0ffd329ea707bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464872, "uuid": "e4ab7189-cc7b-4765-a7c2-4196a569de57", "comment": "Malware payload", "value": "ecb3f2bff6666297990c325c310bb97eb96dfd8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767464872, "uuid": "bccb3042-3723-46f7-a786-93c80f8844d4", "comment": "Malware payload", "value": "14112ed704043d8b416b241fcfeebd0d6019f93d1b009646ab6476620549f854d5ff8450fcfd250c84f440e166d632a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464872, "uuid": "6edfc502-90d3-44a4-8a32-2d16f4099e94", "value": "T1E7735236E6B3C46DC45BD634AF8394B7B8F17C1C4534651A47C1A6223B6BD386BBE280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464872, "uuid": "bc819429-c511-405c-8f2b-7394e83af816", "value": "df00652ad3e78ba777ba702462655cf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464872, "uuid": "53832df0-b306-4556-8161-2b469ae4e717", "value": "1536:l+A5Wu4q31Vnm2T9G4v0jkOeAO7GuV1xgJZ5RV8RP9OgmN37Tie:l+ajCtMmJR+N9tmxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767464872, "uuid": "8f840474-bce0-47ef-862b-77fdad936864", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767464872, "uuid": "f4984bb6-626a-43ec-a7c2-8f26b99a2c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767464872, "uuid": "41368829-5fd1-44c9-a563-d7005acd39d7", "value": "8uhqn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53462526-e8a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443573, "uuid": "9d7fc16d-b4ca-4210-87d7-21a60a83e1f7", "comment": "Malware payload (Mirai)", "value": "c64014c3f8103bd49ddf1e0036f46ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443573, "uuid": "fc06e789-6e15-48c5-a10b-cc42b24ae514", "comment": "Malware payload (Mirai)", "value": "81aa3a1cec78008abbe0506a44c20fc80efe006f5c4d84fdec6c8ed9d84521d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443573, "uuid": "346c3eb2-0816-4d34-9bfc-7c7e0b28e3f4", "comment": "Malware payload (Mirai)", "value": "0f6984b214aef7b49866d3fe709cbe26957eda4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443573, "uuid": "f8eb5ba1-6ad5-40b7-b357-5d2d977658d3", "comment": "Malware payload (Mirai)", "value": "d190d465a0f9446da92b1222b9c1af6a3f3d1703001f18a2ed6319f453b06a681c081a966cbded9d37eb49607341131c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443573, "uuid": "7b769e6f-f6f9-4880-a9ce-9ce099c44973", "value": "T18692C16451884797DA1EF13FD24F4D1E36A0DB0A864AE7AFFA4003A8F99F055627CEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443573, "uuid": "26febf58-bd30-4e79-b42d-052dde44f4c3", "value": "384:MsVFrtKI6ZBT9OIpbzDwEYrR8N66DG0Sx++I9B9AXtOJHqsYuO8+iyl029v1R/:NWBT9OiHwRR8A6DG0JBS8HqlKM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443573, "uuid": "0f98df88-4e50-4fe9-a985-887ed3f97164", "value": 20880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443573, "uuid": "a0c67bc6-494c-4656-8015-f2905fda9b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443573, "uuid": "98e90fac-9c8b-4dde-a7f2-c207d3c9af94", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ba3332-e8ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454763, "uuid": "63864def-9c7e-4def-aa52-2b993f11f427", "comment": "Malware payload", "value": "45c77d6557372b6a9e46ed9c61257279", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454763, "uuid": "1e7938ae-d937-4b5d-84cc-d3187e58e128", "comment": "Malware payload", "value": "81cb363766b77333ecd83f68a24eaa7e167cfdd2ac8826e13cfbec5d89e9144b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454763, "uuid": "eae8386c-2757-49b3-ad75-7a077c572b49", "comment": "Malware payload", "value": "4c3b0b91df09e0d1b40e88f47122843c8670654a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454763, "uuid": "10c4014b-d143-4a75-a556-fdd3bc995de4", "comment": "Malware payload", "value": "03c35b2cb115bc8ad9ed9cc0bee135e8696b13652dc7f05b1861a8938ec70855937643b56b830284ac228d32eb09fb71", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454763, "uuid": "f5c9a1af-52b5-48a5-8b83-337bc11fd9c5", "value": "T1B1E733F84D34859F3D7FABD6C5E5BB79931E89BA0183DD20DBB832CE44E55E09A62040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454763, "uuid": "6e2b9da0-9fba-4f0e-b635-91d00128619f", "value": "1572864:TpJNptDDYdegXuIQYhnQF23OAFYlmXS6rjQEFTyaVVt:TpcK7Yhna23hFYl2S6rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454763, "uuid": "f41628f3-4e61-47f6-8556-bfbe73eaff8f", "value": 69102065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454763, "uuid": "50cb156a-8c0a-4c23-b096-1b3c413b27de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454763, "uuid": "ca7f69a6-b4c3-4494-bd5a-497a23874110", "value": "launcher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc2a958-e8df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767470621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470621, "uuid": "e87c0e09-e4e5-4a03-81f3-e04970da6464", "comment": "Malware payload (Mirai)", "value": "e422e019989fc8b26a48aa110035fbc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470621, "uuid": "1361f830-2f6f-45db-ba97-a1691c0a167c", "comment": "Malware payload (Mirai)", "value": "8310cc48bbbcdc13c244c7aa8d9c825359128469d9cd2832b5c15fb687bf6278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470621, "uuid": "089c0564-7ca8-4d2b-a71a-0044bce1749d", "comment": "Malware payload (Mirai)", "value": "0b36d9043a80db82f084f76f72b1096d058e1cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470621, "uuid": "0f638713-37b3-4160-b784-1d9c15af49df", "comment": "Malware payload (Mirai)", "value": "a58dde2c639813cead5e3ab085585e8e980d4f75d9c8169689763f701a07bf6106fa39669e29d4a0117412b0b9d0d3b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470621, "uuid": "eeabfe7f-f00b-4fd7-b11d-ec0ff58af305", "value": "T1F0B2C0AEEC8C3786CEAD2DFF46D925B04E4AB0C0F3D9071C47512C84716A05AB98E978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470621, "uuid": "fac33d41-d5ff-49ac-acbf-096cc87fe533", "value": "384:XUr3ZTx0p160DO5TLGEvLvK6N0QOly/OgNUff3iezt1HERWGVCz0NvGY:kr3ZTx0hENvzK6I+OgNWfyIt1EWBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767470621, "uuid": "198ba208-6852-46dc-abdf-8f5a06157007", "value": 24100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767470621, "uuid": "bc58c215-aba5-41e3-9b94-ae90ca9064ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470621, "uuid": "1a354081-aa22-4019-bcf0-2ff56989c527", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fddb44d-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767444024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444024, "uuid": "d31e7e99-2bef-43f6-b6b8-3a38e95d68f4", "comment": "Malware payload (SalatStealer)", "value": "3d1c84c63745fe3df50e266d2dce295f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444024, "uuid": "1b9a6871-9a67-49de-91b7-0f498c83988c", "comment": "Malware payload (SalatStealer)", "value": "84071789ae6e2c523c298b87b8c2164d95b62747bc0c946a641579c3deab04c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444024, "uuid": "a3a2f920-41e5-4812-8663-af646610ab94", "comment": "Malware payload (SalatStealer)", "value": "66d8180246fbd5973553e542decc8b5b67e23916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444024, "uuid": "c1c0ac0a-4c07-464c-8761-69da9322f7c7", "comment": "Malware payload (SalatStealer)", "value": "a3b7fa69c263378ecee3d195dc480c196fa558399268780f021fe6d78d60487c549726f8581a34c6941cdceeffa19e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444024, "uuid": "975681a9-3033-48a7-a1a8-b8f882b57bdc", "value": "T1DEE533C329D48D2FF066E47D1B012F700AD6B8970AEF7EB197C525392AA27E9C150E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444024, "uuid": "23733a75-84d3-428d-875c-9ef96028c4cd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444024, "uuid": "8cf14cf6-03d4-4f60-8e3e-6e91a77c32d0", "value": "98304:P+Tz5UA6lCP+/kXwB/eGlGIsuuu3lJ6wry1x:PW5UA7P+/k6/eWGIRz3OwrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444024, "uuid": "4bd9f77f-a5a1-45a5-8cbd-74df807383e7", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444024, "uuid": "c098369d-a554-466d-996c-171f67276c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444024, "uuid": "f30424c1-dd37-4296-8490-f27ff1f59fc7", "value": "Matrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4452a6-e881-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430519, "uuid": "ff12a2c0-8789-4153-af99-a8ab16c7e737", "comment": "Malware payload (Mirai)", "value": "c299c12e4d0f124cff03ea06a4b81c06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430519, "uuid": "6a008dd9-fd89-4698-ae7c-147d4c71d814", "comment": "Malware payload (Mirai)", "value": "8525ec0bd9a185c1acfa539a2b2393a7fe06fa724be3c19ff7085c2fa745d745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430519, "uuid": "bb17e977-5248-4d68-a1f8-cec70fc06911", "comment": "Malware payload (Mirai)", "value": "62125d10bb3df253591a34c7e7c9b5a9c6235096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430519, "uuid": "d8f21c32-9b2d-4570-a2f8-5c228ccb4c44", "comment": "Malware payload (Mirai)", "value": "c049eca6a3249b793dda7000be4c93327256a177cc0b5c134d1d793f3cf84edb8db6a235fdb15a9edac2ba9b9093bb73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430519, "uuid": "a497ed0d-ebd5-4f3d-a049-8a39b15e5119", "value": "T19CF202A82057D826E65128B19A3A9AC23337CF37D1F15CFF63501B3C268564573A6B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430519, "uuid": "cd730298-3e41-43d1-9f02-ecf07ebdd3d6", "value": "768:OHzkmrmOPQdWhJe9pe/dqjH8MxKm7N8ZTJjUzB1Ic9qDps3Uozx:4zkmSO4QgpeAjcM17qZFIzMc9s0zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430519, "uuid": "190fe50f-0a40-4b0f-9324-987de9e1dd05", "value": 36776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430519, "uuid": "879449a9-6d3d-49e6-ad93-3421dcd69ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430519, "uuid": "9b8556be-7610-4741-9ee4-0841fd95f2b5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c413d7-e83e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401514, "uuid": "f13f8d76-0e44-4b26-9e79-fd9718088728", "comment": "Malware payload (Mirai)", "value": "547da44fd2a9aa9c3fd6f5f7f3f60dc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401514, "uuid": "c3b89919-b3e3-4182-8811-b6147212f415", "comment": "Malware payload (Mirai)", "value": "868efe280324f462f2ddd7932d93c4381bd693e01aeb76a2c46187d40f365531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401514, "uuid": "f7161889-2ac9-4292-acbc-db12ca7445fa", "comment": "Malware payload (Mirai)", "value": "1d5cd83fa84d9101df8458069a4e9b50f082efce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401514, "uuid": "b1f7acf0-5a62-4280-9508-dcff6f1a2921", "comment": "Malware payload (Mirai)", "value": "ed88232b5f3bc3f3a41975190ed605ba501c580838156a0f0a924cd80944b2ff171a3d297fd0b30b59c6e491d932909a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401514, "uuid": "de9a009b-04bb-4b1f-a597-675df977056b", "value": "T1167302520249BE5AE4E35C360FE04B1F9B0B5DE4D345280AB5125EBFEED220BDBB9147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401514, "uuid": "513de8d5-42e1-43a9-b22e-e40eb873b0ca", "value": "1536:+Q2iHdKoTJLwS1w0jCBTHGrONgghipFSjmGMN6H08VTFVEPlffLqlqbLm:+RQgW8odjCBrGCNuIjJnlYIqbLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401514, "uuid": "61a27cb7-20a1-4378-9781-6ee27e6255a1", "value": 76184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401514, "uuid": "5d90bfc9-9cea-4f55-8cfe-3140dd08e7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401514, "uuid": "66d5e861-522c-4110-a10d-37779a978da2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64450ea4-e8d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465936, "uuid": "d31938cc-21e7-4c7a-865d-745a7cc0ba64", "comment": "Malware payload (Mirai)", "value": "dc1d9afe311d448372c8d57861257e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465936, "uuid": "c6fb37c1-fdfc-4ff7-844b-f5c13029730b", "comment": "Malware payload (Mirai)", "value": "86d5abd5dde21acd62a1bab766359b07b8056ab5ff2fcf7fe7043500725064fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465936, "uuid": "c737a7f6-5641-46cb-99fe-cb32b81ce1c4", "comment": "Malware payload (Mirai)", "value": "b695e43c8942900c08afbd1d63620ab532dbd266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465936, "uuid": "371030b4-b15b-4205-81d9-c6884fe10327", "comment": "Malware payload (Mirai)", "value": "14ca8253bcdaa05c1482f3267956d7bfa77ede3e810f50dd5657fda39211c505a959d034229d80d1360b31fdb5817f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465936, "uuid": "f25bb358-1c83-477d-904a-50a979bada9d", "value": "T13FD3E709EF610FFBE86FCD3706AD074525CC561622B92BB67574D928F14E18B0AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465936, "uuid": "4ec61616-2cf5-4aed-be27-f6880329d39d", "value": "1536:tCSKQ0RnBld690EKVGgwlRi4EmoM3twvGbOV8Zp3KzQbXQonjRZwE7GP/dI+i2YN:bKxnZ69jK8gt/mors7bjRbGdIIYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465936, "uuid": "ecdb3360-9b61-4688-af43-d936d9c0fdee", "value": 132952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465936, "uuid": "3c7c20c1-0d33-4fd4-9135-aa0dcb5b2f49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465936, "uuid": "33e0125d-b267-4b97-8bf1-9abc4570ae7f", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7874c6e9-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443206, "uuid": "3c16cc9b-839d-4b8f-9f50-07844d93dc33", "comment": "Malware payload (Mirai)", "value": "c506f8208c3a26df524ae70a77f7c90d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443206, "uuid": "a08df04d-6f33-4052-b723-6f388318d3bf", "comment": "Malware payload (Mirai)", "value": "86e907fa6206b2d15a4eb24561236f39653c5f697e8388c5c2933e9c9da30564", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443206, "uuid": "e533ad9c-72a1-4496-9437-10621b3afdf3", "comment": "Malware payload (Mirai)", "value": "89a79d5c7377842ce746d5d40d517dd54042df0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443206, "uuid": "7a169d32-f8b0-439e-b00a-49112910d2d5", "comment": "Malware payload (Mirai)", "value": "72f60f729727e477dabcc365d2353c49856806a1618e5ecab87e84a3678ff607fea77ab7b315a22d64a4da16ef639212", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443206, "uuid": "e460e744-0d63-495d-9304-400d51ba1ccd", "value": "T1CC93074AFC819B15D5D922BEFA1E018D33535BA8E3EF72029D105F15778A82B0F7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443206, "uuid": "58caa3d6-ae86-4ac9-ad94-49609f09234a", "value": "1536:ORnJR45UWc+hTkkMrqHcrHDsILKmHwe9v/8+1S80o3bPZclxst0qOllEVijDUCg8:64iW5kkMuHczDvJHwe9M+1pz3bPZclxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443206, "uuid": "faa08b51-5362-4fb4-b90d-84b9937e7bd4", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443206, "uuid": "b01becda-61a4-4894-9795-15b674954322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443206, "uuid": "3a20bfd8-1b05-4014-9523-c58dbf2216f4", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8aa8e6-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444283, "uuid": "cedfbfd1-f521-48b2-aed9-82d42813230d", "comment": "Malware payload (Mirai)", "value": "165f7039f5fd30427e872e1b6a878a5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444283, "uuid": "c869a232-c6dc-496f-9164-15e5e7eaad45", "comment": "Malware payload (Mirai)", "value": "88f4429f883f8f937fc87fca767f1b4c447fce337349d0e4f35f938212018fff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444283, "uuid": "b6dbd898-7370-4342-940a-9a090ff33ca6", "comment": "Malware payload (Mirai)", "value": "2fb6d2036783b9439a61ba7c4d9edcb6d7a227ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444283, "uuid": "9cc578c7-2ab0-4964-b882-1dbec2a52071", "comment": "Malware payload (Mirai)", "value": "e4ee325ba1b4a986035167457da5047848c7a0b88ac448bcd979d1195f0c526271eba05f15d40df8a7858e231105c877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444283, "uuid": "bc2a87f4-f15a-4c80-af5b-fd8599c9cb96", "value": "T10C5339C5AA03DCF5ED19097520B6F7365B31E5361039FE8FE7A4E932B852602B50B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444283, "uuid": "3c0cde05-a6e5-400f-bb6b-ad37bcd6e9a6", "value": "1536:6N1/90wbJUedRoVEOoAER9wo3pqvzHalQi97NeHxXvR:6NjdbJUIRJOoAmwo3pqvz6lZ78RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444283, "uuid": "6409b350-28a1-4a74-a6d9-a34edc012a9f", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444283, "uuid": "f7d61ab3-6c38-41a5-b51f-49b3f08b8191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444283, "uuid": "79d00b73-994d-422d-be10-33dfcb7b5b85", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581ac97e-e8a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445729, "uuid": "9065b3a5-314d-4238-b97f-84c3a8a3abb2", "comment": "Malware payload (Mirai)", "value": "c0003efaabc271b337181cebe89fb847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445729, "uuid": "a6a677b0-80e7-4dff-b13c-cd0dc4852837", "comment": "Malware payload (Mirai)", "value": "8937849172db05d08b470bd11d922c3c9f018485f5c4981573af5d768c019e49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445729, "uuid": "37a79c30-1998-4e6a-bed7-126c93959683", "comment": "Malware payload (Mirai)", "value": "395800d78d1f467a8bc122688e51a8cb76d3c42f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445729, "uuid": "01c59555-229c-4d89-9cb3-8e780af50ead", "comment": "Malware payload (Mirai)", "value": "6e1cb8e8e9207bdc3117c5fc4551296ff705d23ae3f4b1479f2c534872406eb409a1a549bc7a1a7a834ade1576ec7db7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445729, "uuid": "42f95c4d-5486-4682-9696-056363f47d5d", "value": "T116F39C72C8696E98C568D5B4F0B09E3C2B53A65842175FBB68F3C6728087E8CF5093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445729, "uuid": "fc2bf67a-deaa-48d9-ae99-d78ec19efe24", "value": "3072:qpsklZuy4nCJ1v0bEA9flkl8vv+zWMPPNi5wcwbZnc:Qs24G504A9fWi+iMdiWcwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445729, "uuid": "ac346936-4428-472e-b5ae-7f584f64d333", "value": 171936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445729, "uuid": "f95fc5b2-916b-4215-b676-d27b545dbfac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445729, "uuid": "f4e17d1a-740b-4ff8-9fdf-d162d8fe6a6f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8f4c06-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400429, "uuid": "7ae37741-7420-4550-81ce-095e1e7a8eb9", "comment": "Malware payload (Mirai)", "value": "411f394ebbe7d5604f744e58822de80f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400429, "uuid": "bba74432-f29d-4a9d-8b6a-431f1e3e0266", "comment": "Malware payload (Mirai)", "value": "89644da0258864264af8ad2e92c6657f47f8525226352fbb6ecab85f4ebcd3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400429, "uuid": "775acb3f-48ad-4af1-bc9b-2d6b54ad9426", "comment": "Malware payload (Mirai)", "value": "e084f81f3b3b1653cf61cde1ffbca99d755f3ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400429, "uuid": "3225dfc0-263c-47b3-b09a-04a2d801a931", "comment": "Malware payload (Mirai)", "value": "5614d4ca1bca5d013f63c081ca1b480ddd095a436d579521280f32c66852ecc151bed554016a44de5ec45993b9d99b25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400429, "uuid": "3f900c79-8d07-410a-a0fd-9768b2ebfcd6", "value": "T1D87302F36341A8A6DEAAA0BC002667503DB549A2F4195F53CEFE8DE22CC64DB3447E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400429, "uuid": "65b44c62-790f-41ba-986a-6d2bd027412f", "value": "1536:qp7K0yqwWSqzOvzS+yZlgNos7EOtuJYkrnwd1aK/idTBl6Da58n+VMMVVJu9:qcqrSvXXFtub21Nwea58+6MVVQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400429, "uuid": "bf6fb425-52c1-4225-bd66-1d02a561bf00", "value": 77204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400429, "uuid": "c7e4a991-84fc-40fb-8d4d-3c017f2eb158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400429, "uuid": "72f8aa7c-43eb-4c71-b4b4-efc12403c678", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f650c8-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1767445349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445349, "uuid": "ad94dc24-d60a-43a3-b8ed-064638d09b40", "comment": "Malware payload (BlankGrabber)", "value": "47906c10faf0b49efcbcd96a39630d92", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445349, "uuid": "ee8f8f68-8ad3-4444-8556-8b79eec4deea", "comment": "Malware payload (BlankGrabber)", "value": "8a7bc6bc7c70d4a7921c940ba51e69ba815ed6cd59d3e01d5180c91ad7259d54", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445349, "uuid": "36a98fd3-e9f4-4e3a-9f05-eb2cdb13ef2e", "comment": "Malware payload (BlankGrabber)", "value": "ad3d984e67f855f3c6cb19112426e5c360f413ad", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445349, "uuid": "6479de8c-d95f-4625-888b-3f5dd5483f10", "comment": "Malware payload (BlankGrabber)", "value": "aba674482cc2c976dbe414f9297e321bc40ed5d8eac9474b86de2adf927fa32b7fbce9a012cf17fd1b5ba16c0547b781", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445349, "uuid": "3a277fa2-dee0-496e-9aa3-98363069c386", "value": "T165763395AA7415EAF5F7E33CC902C552E731B93953A8DAE7039082162F23AE11D7FB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445349, "uuid": "d3445ae2-63b2-40bf-a6a9-8fe999d7b816", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445349, "uuid": "d94159d0-7f04-47dd-b7c5-6c964b5ec39d", "value": "98304:RkwN+MdA5V1VV8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DofzJ1n62BLRSn+3/:RV1w4B6ylnlPzf+JiJCsmFMvEn625RXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445349, "uuid": "3f77d242-efff-4b0f-abe9-a2ae8b77c77a", "value": 7176465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445349, "uuid": "20df409a-bca2-4eb5-9d3b-a6337a099b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445349, "uuid": "6d59ceb6-3b5a-41ea-9304-30df48b0e0e9", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75003a1e-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767442771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442771, "uuid": "fe2a3497-8b28-487e-bdba-649bd8ae6208", "comment": "Malware payload", "value": "d6bd6bdedc0c0fa8ff2c00decb993129", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442771, "uuid": "026daeff-058c-4046-b129-9e80f5af6cdc", "comment": "Malware payload", "value": "8a954aaaeaa2abc16c8a562a6108f569d38fbd62ae8974f29131df0e4df4e096", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442771, "uuid": "97fcf07a-c0c8-4cff-817c-8c16a54ec64c", "comment": "Malware payload", "value": "e94f63c321d195c9331ff3e6c05db3693a8236bf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442771, "uuid": "2021b35e-3acc-4aed-bbae-454787790e34", "comment": "Malware payload", "value": "c69d5390c2fbcd8d9be070f0179deaf7f05d85686feb8043050df2b0dd03bb0e3eee2736d6d0c8267148e0c49689d2c7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442771, "uuid": "12c5bdb3-f0f5-4f2c-a7ee-1fa6a0c36981", "value": "T17EA601C5FBD49A1ED736803D88969275A2E68D52C683CF8B9814331C3877AE40E5F7D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442771, "uuid": "5e014cb5-e951-4940-b106-6b5badfa8ea3", "value": "196608:UPT5Z7i2E78miUI2iRdROtz+14WAxmHYQHddPp4Z3:UP1Z7i37hhIpbRPUmpdRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442771, "uuid": "2d13649d-60af-4c89-b49a-7557ebe0168c", "value": 10173262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442771, "uuid": "32af77e4-c8d9-4dc8-b6c9-e1536bf6392c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442771, "uuid": "32d725b9-0316-4251-b339-49d1f158a9cd", "value": "asankhodro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab094cc-e864-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1767417843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417843, "uuid": "74f99fc9-2f50-4d0c-bc05-e78365142d08", "comment": "Malware payload (SnakeKeylogger)", "value": "1ee2eb30cb489651ae15d2f96a8ff460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417843, "uuid": "445d9c6e-eac2-411a-a83b-81b3502c13fb", "comment": "Malware payload (SnakeKeylogger)", "value": "8b7bbcfba5addeb15a2212bf1b764cd4a77a0a1f4f3c801d8a32fd15057d0601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417843, "uuid": "896dd352-9ebb-477d-898e-f5001ba69644", "comment": "Malware payload (SnakeKeylogger)", "value": "597bed75b4b4a5541beb1fb7c6c3e3c216454fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417843, "uuid": "b5b1e979-d3ea-47e3-ae29-fbac6a9a21f8", "comment": "Malware payload (SnakeKeylogger)", "value": "7aceb2d311bb100c6406fcfcbbc1a469959adfcbc44c6b72d29dc1d586919e0678562ac81c409198a118cdf297bfa6bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417843, "uuid": "c4144c09-0516-4fb7-a669-8b783903a2f8", "value": "T18C75D052B7B1447FC26619754C6BD7E8182F3D302A28A54E37ED6E4C8B382123A25FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417843, "uuid": "67c6d2f3-8019-421d-9ba1-e212e78c52b3", "value": "cd7dcd607f39159e7c7473c5f1fbe0fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417843, "uuid": "734dcf2b-cb77-43f0-8d93-3d1761a5a144", "value": "24576:Az0CJh5UBcWi7cOWnEIcEJO7a7SRUhXawrSC6D1VZB:AzdUBSL+r8bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767417843, "uuid": "d35f4270-ff87-4663-b580-464a744d15d9", "value": 1699840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767417843, "uuid": "f126e85b-9a25-46d2-98ae-77163a158fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417843, "uuid": "73d39b39-bd7a-452b-958a-8905dd7b1a9c", "value": "PaymentConfirmationSwift006353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23902d30-e8ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767476994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476994, "uuid": "be9c7a13-cad3-4256-9eaf-36d83b505ab6", "comment": "Malware payload", "value": "272f64c7ced4ebb9eaaa802b909b6b02", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476994, "uuid": "cbda8770-fc4d-4fb1-a1dc-d930c3256c80", "comment": "Malware payload", "value": "8ba871fd64cfd169e45796004dc8b0cc57d7855142a20daa822a58b4b3691df4", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476994, "uuid": "25172252-ca99-4d5f-b6c9-d0dfdbc4fd12", "comment": "Malware payload", "value": "4b2a25a4adc3879066318db409f09811e0084174", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476994, "uuid": "13ff5afb-bdda-4f79-a1ff-b1384b98da76", "comment": "Malware payload", "value": "900c6a94a348ef3732207328fb9d6bd0900ee871328ae853d2ce45724acb53ac125d330cc1bcd400f2eb2d19498287bb", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476994, "uuid": "dda4a02c-6f56-4cb7-8eeb-91355462a70a", "value": "T1D7183344A8F73B26560BB321E757AA804D32543EE20FED76F6409BA177822C792D3D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476994, "uuid": "dc6f9ba8-4cef-42b2-87ea-d5380de3690d", "value": "1572864:EPExSjvM67NvJAX5ApUBDXXIVr8mkDQHLY6pPZ9sCCMUMroNwLh:Ecgh7NvJchBDXktkDyfPZ9sZ+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767476994, "uuid": "14d533fe-60df-48bd-9951-7879b0da4d20", "value": 87260132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767476994, "uuid": "f33a162b-f3c9-4642-8702-4dccee5367c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476994, "uuid": "da734ba3-50b7-4299-a569-afc008c326d9", "value": "KittyCraft-Launcher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dba929-e8ab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767448253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448253, "uuid": "1dfe778f-52c2-49d0-8739-2d946b976135", "comment": "Malware payload (Mirai)", "value": "3f596643a517dacaeb5ef199818c4508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448253, "uuid": "bdd180b8-ee68-4a2c-9f41-af59a8a19889", "comment": "Malware payload (Mirai)", "value": "8bdd39e51ab29d1976fb82bafbb5546f61e4bf4e8858a0161b4771740f7c71d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448253, "uuid": "b0b6171c-7acb-4ddc-90c3-1e23ef393532", "comment": "Malware payload (Mirai)", "value": "c3c3ce855c06af6f2c1a16a340f41def4197f1d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448253, "uuid": "2b14fdc6-b4be-4bcc-9fec-055817bb25fc", "comment": "Malware payload (Mirai)", "value": "1b68ff9bd8c95836d8302965e076fb5e5a3aff71d242d7125afdfbc59f16bc429209fb2dddf48823ea8f32d2a6839498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448253, "uuid": "87cf21ab-8d0a-42f6-834b-8ee05c373cbb", "value": "T1E0237D417308C553D29A5EF0293F2BE0A37E9AB02154E3C5B50DBB8D82B6E335547DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448253, "uuid": "d1975185-cc7a-4484-a9f8-126e0e95b8d5", "value": "768:O0LnQpGgj7B8y7Lk/bJ8RXsrsUVPxYBDHaaLVu+7R3:r6+//uKnbGD62Vu+7R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448253, "uuid": "f80eec41-2d7c-4eca-b2e2-15236448befb", "value": 46032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448253, "uuid": "8f85dd79-2466-4869-9277-df0ad235b8cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448253, "uuid": "ea41f019-1930-4438-85e1-8f722e5f20cd", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fde7442-e83d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401155, "uuid": "1012983a-3ee0-47ff-be31-8e1a059d3650", "comment": "Malware payload (Mirai)", "value": "50775c6261a2ad7eca4611a8fb96a8f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401155, "uuid": "3c70dd9e-715c-4d01-b6e2-511d264bce11", "comment": "Malware payload (Mirai)", "value": "8c413f9d5299d5e736979c6b6d07fb0259e4c963b404f094f5e1e0274e736f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401155, "uuid": "aa385660-fcda-4233-b3aa-dc5f002e60b1", "comment": "Malware payload (Mirai)", "value": "99703409b700ce83cb8f4488d7032cd7ea47b02c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401155, "uuid": "9e235ec8-f05e-4766-97a1-6220e75acc12", "comment": "Malware payload (Mirai)", "value": "22d13188e3204608dc1f4bbbebf8213969ef985f1c6285ddfde13ecbfed3a75a095e27a2dd5636d417bd09f44ce36f3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401155, "uuid": "818692e2-9f28-4d80-af6f-5a6d63123d31", "value": "T16B23F849BC91CA56CAC55577FB0E42DC372603A8E2EE73039E14AF653A5F83B0E6B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401155, "uuid": "af71704c-971b-4c5f-8bf1-8464e60f0741", "value": "768:D2nhtYlBgULID3W24mNmeHJBt6Q1nj3GoV0+4hu+7R:ahtsGULK3W2AeFzdaq0/u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401155, "uuid": "80743407-3730-4312-8549-130829f4a029", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401155, "uuid": "cf33388e-72ea-4475-9a71-21fd6c335c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401155, "uuid": "4d7037f2-4eef-42fe-b714-406aca7fcc0c", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75aabfe-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454130, "uuid": "4793a41a-545f-49e6-88be-37288a4ef526", "comment": "Malware payload", "value": "e5fe204c3741dc0ae199f0579b6310ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454130, "uuid": "bc9b3dd0-1f40-4bd0-841a-f14553af85cd", "comment": "Malware payload", "value": "8c4834ee36adc6afcdf4ae9408d7852a16dcf2df70e8e0983c95074cfcedd2e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454130, "uuid": "8b25cbae-8b24-4546-93e3-d61808041cd1", "comment": "Malware payload", "value": "71a9610ec2a7b52b546779085ff0a69b475c74ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454130, "uuid": "2dc721de-c591-4cd2-ad46-ffbcc8b6f48b", "comment": "Malware payload", "value": "0448bcfcf1feb564d997d1d593638038ecf34cce423f5e649a8387d1621e33f7d4234071bcb2c1587e921e0875a28f49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454130, "uuid": "8b6023a3-0a4f-4fb4-89ab-f4b5c627ec87", "value": "T1E514D1E304436D084B4132B82619F5E959FA5B1CA78D0DDA5BB5BB7172A0029F0BF3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454130, "uuid": "7eb30098-068c-48dd-96fc-5a369778a0a4", "value": "3072:R8nNJMTrfevKM97qqVOKd676h7PNH6UnVuMbGHCuKUeVgH4dpG3lnaYdGML:RgunmP9WKMuLp5nV9GHCuKRVk4dUnaCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454130, "uuid": "5d390180-4392-4407-9bf3-d9b7afeeae34", "value": 191250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454130, "uuid": "4bd5630e-8c56-48ad-985f-b8099e42796a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454130, "uuid": "d6e5590d-df85-4dfb-b71c-1718e23985fd", "value": "hfBCcI8ktagXNE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f814e5b-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767446278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "45c8c8aa-f963-4fae-bce9-a01fee03332b", "comment": "Malware payload", "value": "0a9dfd2cb3606ebe8c97c653b6213104", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "2d5a38b9-5aa4-447f-9c08-63313b4d0ebf", "comment": "Malware payload", "value": "8c6117d2d3c3b2836bdbc774687acccf65b6c55844f54adc98c7a12eccfe515a", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "6c805fdd-94a8-4a96-bc24-1485dd6d614e", "comment": "Malware payload", "value": "1c3e9fb4b8d347834f4890859b052b865ed10904", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "c587cbf5-78c1-4802-bfcc-daa003797358", "comment": "Malware payload", "value": "061afa8fec88892f8ff249b9a8e4a5d3d029c7d8c5bd0de9d2a396b4a7b4e22a72404a373e204a42ab41306ee92a8b24", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "5d2a0004-5450-4c8b-ba1c-7639d86cbaba", "value": "T1AB361286A7E9C422FBFE87B189F65AF35A32BC911939C61F2B41048C0972644DCF5376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "1e41b811-1a8a-4940-8996-d6b093ec5ac4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "7b32227a-8ff4-4e51-bb48-609d56194bd8", "value": "24576:xmqMH8gHZ8/ydXqNXtTwiWFVKp02Al8I29+gkrNibdlx88D0DxC:AqYSk6N956Yp0wIDgkZiXiYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446278, "uuid": "7b3833e0-a0da-4f36-be92-8863fcd5bfa9", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446278, "uuid": "7172826e-0fc7-4d90-9c41-b758b8dc4cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "5cfb0df1-7c6a-468e-8247-eb19689eb6ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773d4905-e844-11f0-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1767404120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404120, "uuid": "fa4912dc-3006-4fd0-b6fd-5316cb775156", "comment": "Malware payload (PureHVNC)", "value": "52001049610cda67960e7c14dd423dee", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404120, "uuid": "1213140f-3c0d-4784-b54c-4412df2b5941", "comment": "Malware payload (PureHVNC)", "value": "8cc33b236283ad46365f32d58943e78224dc29f26e6403837e9631e0e47d626e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404120, "uuid": "9d4539e9-f1aa-44c3-b49d-c30fefa17c9f", "comment": "Malware payload (PureHVNC)", "value": "d18105f6048fea8af9404e6464a2273890b47d5f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404120, "uuid": "ac033110-42f0-4bae-86f3-4b8c4ee03ed8", "comment": "Malware payload (PureHVNC)", "value": "416ee07d1da7112e12aab0aacaa2a9a0d8035885a5e1efae0f889c9867def01ab0da78fd2ef1abc25ff47d18a4563bee", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404120, "uuid": "c78f2386-f26d-4f80-8599-c10e2cc60da6", "value": "T164E633ACAE306376D4A943F7ECC4C006475B8D252E6612A178BF9FAD2E44B4815FDCD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404120, "uuid": "fda8b1fc-1355-47fb-9867-1f23a2a35338", "value": "393216:Ep6IrXEd2wve+2gaPTn0beuePIH5ADnq/WzjccXr4:Ep6IXLwve+2XPT0bH5uqOzjHXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404120, "uuid": "5ecb083b-8639-4949-abaf-232c64a0781f", "value": 14450688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404120, "uuid": "f69d4273-64d4-4152-a772-ce725f6320e1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404120, "uuid": "d9ddf4b8-59e4-454c-9e8b-95bfb0663eb9", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9633ca-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443025, "uuid": "57cbeb0e-1091-4fd6-9b28-a69cf3db1997", "comment": "Malware payload (Mirai)", "value": "c5da3fa5967b7266bb68a6d9c5a8f2b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443025, "uuid": "37802a90-9bdd-4730-b885-20f9d549c795", "comment": "Malware payload (Mirai)", "value": "8d2aa188083ea6557202f215c2e501a78db1cc9ac5513660da1547cb528a9e15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443025, "uuid": "8e5c8bcc-1287-49f8-b955-41619a6a4a72", "comment": "Malware payload (Mirai)", "value": "3b135d0a17ff834c460e433655780bd89abcee8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443025, "uuid": "81d25f8b-3091-43f3-b434-759f93a99cef", "comment": "Malware payload (Mirai)", "value": "d2a2c2ba29e9d5d1b874c0540fd51b12cada3b776c0676762d45f318beb4a33366a951b3377970ed823911ba95bd5294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443025, "uuid": "280786f2-04bd-48f7-99b8-950b14b35c9b", "value": "T1E0535D0233184A57D5E649B02D3F1BF093BE9AA021F4B3C9654FAB6945B5E331046FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443025, "uuid": "eb78908b-de65-4ab0-b4d4-9512f7a911e7", "value": "1536:i+uQkM26Vfvdz8LbU4qkvzLNHDFB0u+7RRa:GoF8M0HDFOu+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443025, "uuid": "5124fe30-6c47-4e3e-81ac-62260523af21", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443025, "uuid": "600a3106-2f48-4bbd-bb8e-1df906da23bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443025, "uuid": "b8b76d10-2746-473a-965a-a8131157e8a9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7810ac-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462483, "uuid": "53ec4801-d804-420c-9315-2b79f08567f4", "comment": "Malware payload (Mirai)", "value": "7bfb33021f6ef497d91bd3dba306f02a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462483, "uuid": "4e2ed23d-b8d5-4255-aa6e-5febdd4e643b", "comment": "Malware payload (Mirai)", "value": "8ee45ca2bea3acf475ead9bca39c6f5b343a26e803fe1376659c43756d232325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462483, "uuid": "cee30528-38c5-4ca9-bf77-0f0a33fc9ebe", "comment": "Malware payload (Mirai)", "value": "0f396e8e0ecce619ce96f318c913130b08290136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462483, "uuid": "30967bac-8943-4857-9850-701659af6bcc", "comment": "Malware payload (Mirai)", "value": "0b1ed3f4ca5da77a963960324a7603a8717a21fc9d019e7c83072ce6ed09968b8eef1a91cc4ab35ed9aa5c2662186c01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462483, "uuid": "f50f1e76-a15e-4c64-bbee-a4c78044774c", "value": "T137534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E334999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462483, "uuid": "dd55253c-df9f-408c-a99f-c1902394649e", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9mv6GG4TlW2c5sjgi+DDiZ/v/BbsVf:2KbpuqJlzk5aGpJgbDOZ/v/uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462483, "uuid": "42098ddd-db1e-4570-9ed8-7abcbe30a7eb", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462483, "uuid": "aae81e99-ac78-4981-b1f3-7fee6ed68996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462483, "uuid": "a518de22-edf1-45fa-a8f5-fe560bdabf71", "value": "loligang.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e85142-e8b3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767451763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451763, "uuid": "a36a8149-aaa1-42ff-916f-3f67b7ab21ae", "comment": "Malware payload", "value": "63a6295ccef6685c2ab17ab83825b161", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451763, "uuid": "b1886433-b9cd-4ce5-9af4-d1a7801b0c08", "comment": "Malware payload", "value": "8f1afc243b5eec96f137a2efb8c643574944960e5e542f5ee8ee85af4e7f214a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451763, "uuid": "d79ed73a-501b-4525-bed8-9675c0e7d198", "comment": "Malware payload", "value": "047a915fd6851f97b8825baad2d612c0f4fc0637", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451763, "uuid": "07db0a56-26b6-468f-8097-1fb372882de6", "comment": "Malware payload", "value": "1122994e51dd1aaf1bc95afb70d6ebd60390a45c62b782247b45a1872529840b9517bdc36f5030cd7724129c10be92a4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451763, "uuid": "c10aad4f-bd57-4e0a-aea6-fabe0fa0737d", "value": "T118163323A3CB0830E4D56A719D72C040AF77B53859F6E85D2CB4D60E1E796A1CE33B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451763, "uuid": "2dff6bcc-2cc4-48a8-b927-f34e7b10c3a6", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451763, "uuid": "ef781a1d-34d7-4196-877f-ce6886f0d72c", "value": "98304:2Qn837hx9TNlFtXLKT53HK++I1epZEUYLWVk7ZYPn4d:2dx5FpA3HK++I1LWaw4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767451763, "uuid": "920aa23f-febb-4c3d-870b-add5dac9253d", "value": 4085929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767451763, "uuid": "9413f88a-714b-419d-b540-df97355a150e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451763, "uuid": "8c866920-8881-488e-a422-a737319a5f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5477371-e8b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767451120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451120, "uuid": "1750e197-dac4-425f-9d1a-fe68cc6b0f96", "comment": "Malware payload", "value": "de57451ad25b0bdd8099020366404a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451120, "uuid": "ae0d6ba1-cf74-466b-8169-21ad7cee5b42", "comment": "Malware payload", "value": "90372fa579d2d4c6eb2be83df16536f6087dfdcda7031ccd18d45cb8c16e92bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451120, "uuid": "87d81708-8d92-4dad-a8a3-34076914083b", "comment": "Malware payload", "value": "3607db631e1212297c19df43002aed71a60eac67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767451120, "uuid": "c12c2a45-34ca-4b06-9255-d9065b146ccf", "comment": "Malware payload", "value": "f3fda728703b6f71685452d951191c04bb565b125f975eb3d081db479cffa35469d3425c5092a329b921262d36b83355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451120, "uuid": "dd565b6a-21b1-47cd-8441-7e405b29510d", "value": "T19A0833C74968E217DC9BA67912E05AE1C21EAE531605C8EDC36C747378DCE386B6D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451120, "uuid": "97befad7-0926-4038-930d-d12d4e3c83cc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451120, "uuid": "2718d2b8-68e5-4608-96f8-1b649c46b63a", "value": "1572864:s59IrBOSFSgE3E6qE+W2yNWIPFSQpY0XR+EzJPzTlklUFyrS+1gi6qOadgRZrT+z:soFNLEU6OW26WIPMQ3XR/QEXjOd+Zriz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767451120, "uuid": "6ef4fadc-03f2-49c5-b76f-4fd85dfe6d69", "value": 79950379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767451120, "uuid": "09ebcbd7-0c13-4904-a76d-ccb4431164a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767451120, "uuid": "7b8a96e5-b015-42ae-835c-6f97067c7a9f", "value": "Yami Launcher Setup 0.0.1-a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf48e9f-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445388, "uuid": "0b32ca58-6be5-47c7-bee0-e743c1fe9eb3", "comment": "Malware payload (Mirai)", "value": "c7d9b6a91f5840f1905c10e08fb20044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445388, "uuid": "f4da9216-e34d-4503-b1f1-8148de48a837", "comment": "Malware payload (Mirai)", "value": "9094de5be92f576714964acc02d13a91a68c814057560adf46d81866965ac872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445388, "uuid": "a3679042-1e71-4a43-95f7-4a80d02e3492", "comment": "Malware payload (Mirai)", "value": "71ec6db2ba181463d0b27beeff988889173c7716", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445388, "uuid": "d36cf3c3-3fb1-41de-8c8b-7a846ecdcc77", "comment": "Malware payload (Mirai)", "value": "46f7ae17961997e32600ae7ecf0ce3ff7bc173dd9ddf3c5fe3911e23498c2bda9e8e65fb8a2326d3d85c30828308e3ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445388, "uuid": "b54991fb-a605-4609-8a49-10761bd06ff3", "value": "T173C2E16102ABDBA0C8727732E97BCFC9F7EE4F60A0BD74725A30925825D745421F9187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445388, "uuid": "54eedf82-6160-4251-9c0c-e7c1f53329b7", "value": "768:3PE3rmWac5xDlYKYyNi7mnpdZSLK5X9q3UELzV:3PiqWt5xDO+i7mnprSFLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445388, "uuid": "bcab665e-d301-4be4-9e1f-f449fee300ef", "value": 26684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445388, "uuid": "958d3640-5fc7-4abb-b84b-71c9c5c96a23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445388, "uuid": "a2a06a3f-41ad-4865-81e0-98ea6883e835", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dcf5be-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443209, "uuid": "f36b76c5-fc24-4de4-bde7-6fdfcec4793b", "comment": "Malware payload (Mirai)", "value": "58640fb5ce7670959abebd332dbe8ff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443209, "uuid": "6f266b85-8a3e-458b-ad2f-4cb6d284533d", "comment": "Malware payload (Mirai)", "value": "90a1fddb4d204062746762ec80ddc4ef7e84d86288d34429c2a387cb58dd9067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443209, "uuid": "2a5db21d-6b5e-4714-8e00-b1a14ca054d8", "comment": "Malware payload (Mirai)", "value": "9b0fd5a78822050900e5d04ef864ebf25c8784ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443209, "uuid": "a9dfba50-ad0f-4be0-864a-d7049b38ca28", "comment": "Malware payload (Mirai)", "value": "25ae8458d770d23bf003d1e89b467a23bd83a32b4e879692f5633b4de8eb7da8fdbb4fea3c9df9aed233cd426bf872c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443209, "uuid": "2d9c6c61-b61e-404a-b94a-8537798afe89", "value": "T1F373D846BC918A56C6D512BEFA2E118D331357B8E3DF73139D106F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443209, "uuid": "9ab93528-4211-4ea7-b460-a0768b7e7189", "value": "1536:6RnOKAfNTCcUCRbr7tqKiAhos1KHwe7iWUkdDrVz73XMsiKBZwW3Du+7RT:4QNTDbr7cKiCoOKHwe7bUkdxBZwW3Due", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443209, "uuid": "56b68c8f-5247-4b41-89a2-2136a9bbd4c4", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443209, "uuid": "63ed504e-e616-4aeb-bd5f-46116f8fe97e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443209, "uuid": "8d8042aa-667c-4e42-8e15-159b0d3e1f50", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcecae1e-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454112, "uuid": "3842fee6-9e40-4985-b08b-8f10e9177cc6", "comment": "Malware payload", "value": "9088c2b0355dbb01455a1f9d8e0a9c55", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454112, "uuid": "aaa80dd5-9fd3-4348-ab95-29f54d2641d0", "comment": "Malware payload", "value": "9121cabf48e81cf194bc75950664b1750cc4a2d71d98374d8b56ce4041ad8c30", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454112, "uuid": "b75c9a09-1de2-403e-943e-30dfcdfef6e9", "comment": "Malware payload", "value": "e40531b0e824a46e681e07cd478b2e72e6058ead", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454112, "uuid": "e4c07675-40bb-4f08-b24f-848be20d6e57", "comment": "Malware payload", "value": "d743005a2ff62369f72095614214119372fa82a5e1ef25ff4c8a27a672bc3e61a8621e8d71759a106b7ad3bedf0487c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454112, "uuid": "fffd73c1-24c6-45e9-a01f-506f4149fce1", "value": "T19524F1C62AC3AF5CF3EBB49D2ADF96F951228A270F6932556909D03F6C44BF047A3015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454112, "uuid": "55bad9e7-f61c-4bcb-976b-5a22470db010", "value": "6144:sR5nYxYwb/fG61KnIUKsUiSmSBvXB7bPqfSsfuOYk7rsQOjprsQOc7rsQOgs8Jri:sR5nYxYwDh8iiqtPqfSsfuOYk7rsQOjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454112, "uuid": "5aae560d-8176-406d-a678-c7cda028333e", "value": 219252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454112, "uuid": "34905fcd-2b38-4442-baf9-b424bd6147bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454112, "uuid": "698cf73e-f7fe-43f9-8a6f-3df007833357", "value": "6VLIhATq9AZG35.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321784f9-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767442659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442659, "uuid": "9462ca3e-0dd1-47dc-92b5-2ed9bd5852e8", "comment": "Malware payload", "value": "e69c8674040fa1224762ad2791e22431", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442659, "uuid": "b7f75b7e-8a89-493a-8735-8bd4821b4796", "comment": "Malware payload", "value": "92a92f68af94dfc82046ebe54a51a639d972608d2516255250cd222ad2b8fddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442659, "uuid": "6bd33bbb-f009-4f0d-86e4-0c08f1b41e30", "comment": "Malware payload", "value": "f61b763e694ce2216cf1e2b52ba47415ea66d39f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442659, "uuid": "b0d71da0-5079-436c-96e3-91350a516bb5", "comment": "Malware payload", "value": "09bbb68c5289ee53f724ec17c55bee7195006cf79f7401b85ba2480190b46986af4f79f376e52edc4539ab0c11127328", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442659, "uuid": "1da21bdd-209f-4cb5-a4ae-9a0391498724", "value": "T18BC32B6AFD819915CAC306B7FA5E528D372713E8D3EF310B8D294F65239B82B097B450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442659, "uuid": "d56dcc4b-d0b9-4711-a4e6-9c985373ea94", "value": "3072:hpUzGdUIPVElflalHlAslc5lvflxlKlbzl0l8lullilxlhlEdlylmlplXlDlUlhM:czGd/PVEpI9+sW5tfrIJzaiQbiv/+dom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442659, "uuid": "c7d12419-0283-4536-a1c6-659949b39c2b", "value": 126360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442659, "uuid": "0e83e829-4ee4-4f1f-821e-78b9bdf056e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442659, "uuid": "0df67bf1-077f-4550-826f-03b3b1aff393", "value": "rondo.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc17c00b-e879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427106, "uuid": "fbb8a1cf-e298-4c16-93be-cf34dbbb5a83", "comment": "Malware payload (Mirai)", "value": "f5391186e9a7a4fbe8edcf1b693ea7e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427106, "uuid": "99ac8617-6f48-492c-bd24-275c6464d95a", "comment": "Malware payload (Mirai)", "value": "931e87b404a92e805a2598820dde934631616f421bfea821aa63b62bca9cb858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427106, "uuid": "94a45fdb-8777-4bcf-bd0e-e4538165d55c", "comment": "Malware payload (Mirai)", "value": "95a9f6b13cc22478ccc391d992e3197bc291077c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427106, "uuid": "7ad2da23-1efd-4e06-8f02-409e9d137c0f", "comment": "Malware payload (Mirai)", "value": "1ad55db65151a5bf3ed88ee317bbbed5a52e5cd52f0312fa1d936e8e72f5d32eac0742ecb5bae79f11f5eeefc7003f69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427106, "uuid": "7c26735e-a164-4fe1-90c5-665c90948196", "value": "T1EDB31A55BD81EA11C7C25A7BFE5F428D33166798E3EE3203DD185F64328B95B0E3A206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427106, "uuid": "e273a22e-4408-409b-9b51-7c85c119f282", "value": "3072:9vHw0VRPk4DQPQ2fP40L85BGjvTqyD/LWuLf3Hsh8TsnT4:dpVRPII2X40L85cD/LWuLf388Ts4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427106, "uuid": "93f091f7-0752-451c-aed6-03e2f922a56d", "value": 115928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427106, "uuid": "9eb67a78-c545-4a31-ba5c-e1189bbd5d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427106, "uuid": "d366d7aa-c769-4754-a16a-9e832c902597", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f42e5d-e8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767449002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449002, "uuid": "c2010c0d-6c6f-40f3-a953-8865cdd29513", "comment": "Malware payload (Mirai)", "value": "8b3d1a6668c68e7d72f0cef615b52be6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449002, "uuid": "c3489794-ce31-4d60-97e5-0506866a5b31", "comment": "Malware payload (Mirai)", "value": "933db59b06d07d61f577e0b741ac98001c28d176f8df264a41c08fae584fd888", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449002, "uuid": "bc4d5d99-d815-4a53-b2a9-f06f07af8423", "comment": "Malware payload (Mirai)", "value": "12c924836133fe5d8ccf36bb75887974e4d3dcab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449002, "uuid": "8fae54ba-aea7-434b-9361-bf0630630883", "comment": "Malware payload (Mirai)", "value": "98e23a362c826cc15ed8c45e2b30e25ce9260c9799b05c0d6b2e1c9cf1ed571812758b1a8b098c55bea82569e1d33488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449002, "uuid": "0589f1e1-2208-4d0b-9ba8-0a36b66f5ef9", "value": "T117031986BD519B03CAC11177FF1E438D7B2B0398E2EA73039E1A6F2137979660E7A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449002, "uuid": "b01e2c80-9aba-460a-a86f-20299f066679", "value": "768:WwNxq2rdFTScDr6WWk0M//FZFaiPsiniVXpWvgdIxjjj:t/rdRSy3L//PFsiiBpWve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767449002, "uuid": "030c8911-9af4-4912-b3af-ac23cf8ef5a2", "value": 40104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767449002, "uuid": "03aaa528-6cf5-4038-8c2d-c0761cc23a3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449002, "uuid": "b6d08f89-82a8-4f8b-9b1f-a1636735331e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb9eda4-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459591, "uuid": "789657d9-dd6a-4e50-91c2-927de2ee9b10", "comment": "Malware payload (Mirai)", "value": "720c442e76241386034f3b1954d23e46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459591, "uuid": "3cefe576-820b-403e-900c-07f7fbdcfed3", "comment": "Malware payload (Mirai)", "value": "93578a6398ca3e893594aa24905d31d724617a6d61904fc6caf6c4e749d4bb05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459591, "uuid": "0c4a14bf-8d63-4b3f-a9db-12ce423c34dc", "comment": "Malware payload (Mirai)", "value": "971df9c4d5a35751a00952131f01385b31a60e99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459591, "uuid": "acf58d21-88a2-4202-bfc5-a6125f4c25ac", "comment": "Malware payload (Mirai)", "value": "068ba503481688f43c65dccc2e08b3388d806e2cda1f56d1969dd01c4fcd62ed51c8b74dbfb63597d49bdfdacbec7c5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459591, "uuid": "6602a9e0-626a-447d-b7af-9c385c782793", "value": "T148F36C86E747C5F2F81902B46077F73709B1E93D102BDAD5DB75E931AC21502A62B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459591, "uuid": "187d5dd2-31cc-4697-b24f-6f0d955de9e8", "value": "3072:vNvkhLXLn+MtSYYiWa1GnHfFZM/lP/nOvEkgeoVoq+JF:VvkxXLnLYAMHfFalP/5kDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459591, "uuid": "12a3537d-b88b-4da0-9382-88e3073253ec", "value": 161652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459591, "uuid": "a9a43fbc-8ddc-4352-8680-c5a3f40a7fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459591, "uuid": "0fd911c0-764b-4379-a014-b06cce6949be", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd386287-e862-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1767417176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417176, "uuid": "4ccb9aba-4271-44be-8905-179384701a12", "comment": "Malware payload (DBatLoader)", "value": "eaebaa852712c390a7d43b93bf0ca0e8", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417176, "uuid": "31b3adb2-b0d6-48f9-bdd5-613eb0c080f8", "comment": "Malware payload (DBatLoader)", "value": "935919fcc8efe757ee49d0374b09b8708d84698c4ef72b486070769bff7f5375", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417176, "uuid": "10b87dcb-6eb5-4e0c-9251-32d253684631", "comment": "Malware payload (DBatLoader)", "value": "52847882bf51c0106bdc17676318ce7941fa8f93", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767417176, "uuid": "79012316-b893-4214-8122-d18ba66c06a4", "comment": "Malware payload (DBatLoader)", "value": "871442baee536486d8f3227d0bc9442ddbf21574ea6fb21e44445eca1d0fd13fd7e1b1aae435c8e0c9f199885bc57fbb", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417176, "uuid": "8b39d25d-13a6-4553-86bc-65560b1fda16", "value": "T18975E013B7A2443FC2760A745C6BD7E81C6F7D306A28A54A37ED5D4C8B382113A26ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417176, "uuid": "3b84e2eb-fa13-42ab-bfca-247963d251d3", "value": "cd7dcd607f39159e7c7473c5f1fbe0fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417176, "uuid": "601efe87-092d-43ee-9444-b2ffd92cd997", "value": "24576:Az0CJh5UBcWi7cOWnEIcEJO4EJqC1IOAtPHrXN1VZB:AzdUBSsEr15AZLTbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767417176, "uuid": "a9a6b6f0-f6d4-4e75-956b-22fe0901fbc8", "value": 1699840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767417176, "uuid": "8b9256dd-e462-4c34-a1ac-349549804d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767417176, "uuid": "3d3a8c3c-cf2c-4d3b-99aa-199257ac534d", "value": "MV MARTIN SPEC DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7815c3c2-e889-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767433757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433757, "uuid": "ac80c7b0-0789-44aa-80a8-9afa32373ac5", "comment": "Malware payload (Mirai)", "value": "2d999059d13df6d8161b1a6acb83da9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433757, "uuid": "e64d5fc5-8ea6-438b-b7e9-29520d76d8ed", "comment": "Malware payload (Mirai)", "value": "94eea7e0d3adc23cfafd46ff65e2fb24fbedc56ba05dc57ab7d93176c357244b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433757, "uuid": "370c3db9-ed77-4e8b-9f39-fc8121da9b43", "comment": "Malware payload (Mirai)", "value": "306763932097c0381a6e7daca166093e1ee3bb82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433757, "uuid": "146ac51d-66d1-40f3-915d-0a7c723ded05", "comment": "Malware payload (Mirai)", "value": "535feb480703b783ea786398344cd802b6703679f5e3bce6aa43a5a1b0c786ced82878602f244616e6f32d9d7d5edd1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433757, "uuid": "35755b3f-d0c7-4df7-ba09-f8f00f8f5b21", "value": "T1F9733981BC819613C6D1127BFB6E428D372613A8E2EF3203DD266F21778786B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433757, "uuid": "85ffc356-25ed-419e-b478-dd860b0ecfc0", "value": "1536:Pevz8ryii6Bb+QULDQbmh410/rDsRznvs5:PevzDE+QqDQbGKarIs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767433757, "uuid": "3557fa75-2f18-4f5b-8a7a-e7063fc472d5", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767433757, "uuid": "e64e9271-3460-4a0b-8c9a-81db4c32ea83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433757, "uuid": "82076106-90af-4337-9da3-746bbc723351", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe542cad-e838-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399193, "uuid": "d93828bd-b532-4760-a4b4-d7917ecd3424", "comment": "Malware payload (Mirai)", "value": "90b458a2c615ac19b49da0fbb7beebe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399193, "uuid": "e4f2dce1-a308-4304-beb8-acf86709bfdf", "comment": "Malware payload (Mirai)", "value": "95535daafcac9ae4b4d37aba865e6e01c2dc2546582e94a3d01bb38648d5b6e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399193, "uuid": "91a32650-0135-4f33-addc-4430058dd775", "comment": "Malware payload (Mirai)", "value": "7089b11c7cdeb2bbe51cb4fca8e3958fd2d4a580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399193, "uuid": "1bb42f66-edb9-4d1f-b513-324146b5e7b5", "comment": "Malware payload (Mirai)", "value": "0413d2c07fc0ca0368f8a3d27e63e0127be8866fabc252c04b1d93d30aaf51eb435e3665fe5bddcc2e67f5343c130d49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399193, "uuid": "b6cf2a8e-bf2f-4d3c-8948-cc974b102521", "value": "T13353F107E5DB4D4C8278003D2AEF7B8D2B6D8385EEE809E5754182BE5DD98BA3309356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399193, "uuid": "475d555c-4d5a-41bf-9f4e-f4f513655582", "value": "1536:xDtUvBfPxGw/PIzWQ+/RMghV47ZSc9v7RaUnouy8Hyy:ptUH/XL/R7T6SQv7Hout5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399193, "uuid": "c9ec5cd3-f3e3-449f-8c78-405aedcf8ffe", "value": 61184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399193, "uuid": "1345b34c-5a88-448a-9411-ddc619b1d213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399193, "uuid": "42bd928f-b80a-4ec5-9f27-ecb6ed1dfb3f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f777cf9-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (RondoDox)", "timestamp": 1767399705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399705, "uuid": "4dc40a6f-cc78-4cfa-85d3-60e4a8d08d90", "comment": "Malware payload (RondoDox)", "value": "274efc90017d2ff94185835d3028e954", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399705, "uuid": "633671bc-cfe9-4d58-a177-999b78cf3012", "comment": "Malware payload (RondoDox)", "value": "96933703182e402c7b5b4854d81ee618baa28bf8dac98c8d45fd1b8aadd576bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399705, "uuid": "acbe64f6-304b-4a36-8c95-9a271e23a872", "comment": "Malware payload (RondoDox)", "value": "afba0bcc38419ff5ba24718d5cff12fa029dd896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399705, "uuid": "7c8184c6-6d7e-44c9-8eaf-b438e85670b3", "comment": "Malware payload (RondoDox)", "value": "5216e4740ae4c9af8dac2df02d648cd74e8f1462a4b6512e37a2086da86731bc2cf382bb063b56cf990b2ba9f050af2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RondoDox", "colour": "#4E0F4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399705, "uuid": "f6cbdb7a-e372-4a48-80f6-c1682fb95731", "value": "T106D3296AEC819F51D8D526BBFA5E8549335307BCE3EE3102DE244F2527CA92B0E7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399705, "uuid": "8fb997d8-2706-4a06-a9c6-870b54acf5f9", "value": "3072:uT0G41E9kpwKUa4LnRu+KUKHanwox69khzR5P77JqUrAj:q41EupwNauAhNHanwox62h/PHJ5kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399705, "uuid": "6c32ffe6-257e-40bf-a352-2159e858bb06", "value": 142772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399705, "uuid": "04875872-c8f0-4753-8d15-20cce4db434e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399705, "uuid": "40cf4b0f-4f41-4c96-9b8e-dceaeada1bfa", "value": "rondo.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26447edf-e8cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463684, "uuid": "1ca29651-64e1-446d-9879-4cffd6dcf387", "comment": "Malware payload", "value": "42de21b221bec1e87b2e2136ffd364be", "object_relation": "md5", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463684, "uuid": "ebb58728-c8ef-4cad-b76f-32d676b511b2", "comment": "Malware payload", "value": "980d1b046f26dfdf936cf6e4eed4dad817587091eeae6db19eab1f53e31f135e", "object_relation": "sha256", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463684, "uuid": "261dc6ef-2aba-46ad-861c-7933d3cf38c3", "comment": "Malware payload", "value": "eca5ac21b344b9800b44188cd94ba73ffb9cca39", "object_relation": "sha1", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463684, "uuid": "44f7ef0b-ec94-4a80-9458-f82311c47d1c", "comment": "Malware payload", "value": "9d527c7477024271b530bbfe1d35f37dbcec97554144711e1de3b57d0ce36f55834427d7d316ae0b99eb9d4570ee812f", "object_relation": "sha3-384", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463684, "uuid": "834e0ba6-4bb7-4f9f-8d4e-acb8d3eaa045", "value": "T1E0148D5673E420F9E2B7863489A55A12EB72B8320760D7DF03A486752F233D09D3EB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463684, "uuid": "ca60de2b-59b4-4566-a3ba-cf1441bdb104", "value": "3a3048db39de92e7fb67586ae5c727f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463684, "uuid": "aae88961-1c9b-461e-a708-9a4d557fb3f3", "value": "3072:0QO6NL8RV5nFIQQXJbn78dWA3kRVbO+T2MoXjivxVVshrHLxVtj1Q72T3:0QCBFe5+3kHi+TkXcx+3U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463684, "uuid": "62f73494-5ac0-4e58-b8c0-c148d74ec688", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463684, "uuid": "516fae4d-7975-4c75-9e9f-fe270db1aec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463684, "uuid": "317a3daa-3ece-4ad8-a3f0-ed03f3c416ec", "value": "uninstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aae6e80-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767427641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427641, "uuid": "f9d55d4d-0958-4de5-b02b-905a0d13d45f", "comment": "Malware payload", "value": "7000df46e92b562016f470d6f0574b04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427641, "uuid": "33593fbe-a15a-438c-9817-c5d5d9c2df80", "comment": "Malware payload", "value": "992a69dc43bf1d5e7752e9efe220b5abb5f5efca44a4902f20c282ce7f6a79f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427641, "uuid": "efd7172e-f64b-4793-9f1b-f79e37ea620c", "comment": "Malware payload", "value": "5e316e412360b0035b86f73eefbaa97feb57baa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427641, "uuid": "06a64d19-7c78-4505-9034-a956c32cbda5", "comment": "Malware payload", "value": "62af7122eb4da24a55a5ff478f92863588d74eb87671be25db4872d2005549fc48be4c31fba4d3404eb1ede9de183433", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427641, "uuid": "23401ed5-ea44-4282-8255-40cf0c9c4a64", "value": "T126C45B55F8809FA1C6C5257AF75E829833134B79C3EBB20659245B343BDB86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427641, "uuid": "2036bd6f-5611-45e0-98f8-ac76f622fe43", "value": "12288:YKlrg0XPiTTebGF7pXKIi4BbOIA8gpZ6mUGHI:vlO+ba7pXVi4BqIAuvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427641, "uuid": "43414095-b0a2-4a99-ba87-fb9ece362021", "value": 553636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427641, "uuid": "8d38e807-7e42-46c6-9436-3745e6ceb9ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427641, "uuid": "9e483bc4-88f8-4934-9337-b1b5a8215b8c", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240246fd-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767443923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443923, "uuid": "35e321d0-524e-4a90-8486-b4a4680ab3fe", "comment": "Malware payload", "value": "bc5a59feba729afff5a8a02d9d461356", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443923, "uuid": "2ba1a112-9bee-4416-b2b6-b5b05cdf663e", "comment": "Malware payload", "value": "9a3a35f9c1113679cef089ff49b201bb5a3e75fe095c3aebc07c1a00febb06cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443923, "uuid": "e5eafe14-d568-4931-8ba4-0c62893c99f0", "comment": "Malware payload", "value": "232515dcfccc9f93766b11bb14108842a7fd0b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443923, "uuid": "0ec5d055-5570-4aa5-85eb-889f48ccfcbb", "comment": "Malware payload", "value": "1404477c46367e9ef8db7c72f4fe0b0043311bfcfecdafe7a4d3348c371c825225901665428fccbfe4bc76b9454ee389", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443923, "uuid": "2b0515d7-f879-4bbc-ac00-43b41c7ec93e", "value": "T16E53C41A2E259FACF768873587B38E319798339627E1C245E15CEA011E7074E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443923, "uuid": "821bf1a2-0faa-454b-9f0d-ea6de71d537a", "value": "1536:yNoFdXck9JU9cWcDBLKvGc9Xu02RY0LbsApjnfE7fWt7ffefLkQy7EEeu5:0OXck9JYcWcDBeXXurLbsApWLzyYEeu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443923, "uuid": "afb89c0c-aa99-40e8-b3db-6d37a8b3e8fd", "value": 63540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443923, "uuid": "940c250b-4328-4c8e-83db-f56e66f33b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443923, "uuid": "adaaf8e9-156f-4849-98de-0fab549631c5", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c9dac9-e8bd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767456035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456035, "uuid": "61c173e0-326f-4ea3-9dcd-6e020db40c50", "comment": "Malware payload", "value": "9028769392872741a93fba99e851ae51", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456035, "uuid": "7b0db48c-b5a4-47b4-987e-b62dbc1e8678", "comment": "Malware payload", "value": "9a671be441a536d6a9fd9d01af3d0e5bddd98f6237a1e8f6cb651e4da2efa0c4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456035, "uuid": "9887a45b-2f03-451a-bb78-7b27244ff121", "comment": "Malware payload", "value": "8bc262749f3161042f4e9586c184f2d23d4b705a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456035, "uuid": "2d028936-2091-4db8-80c2-7c21dd6b4f31", "comment": "Malware payload", "value": "9c628c473144c173802673be7d877ed1cd889c43c1f252e4b2f65f667f90ac9d409ed20820d846fe3e9086063df20fba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456035, "uuid": "83e04d11-4876-4035-a6f6-85888b289031", "value": "T1CF034B08B7E44651DAFEAFF059B261064271E617D813EB1E0CE495DA2F37B80CE017B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456035, "uuid": "154e1de5-62cd-4a82-8d9a-4d17d25efc87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456035, "uuid": "98ed8476-4cd5-4944-9d8d-d3ae85c81c0d", "value": "768:dSNm4UwBSzqDdxm4CtmDR7cKBCAP10FkXuzFU9oqaOph/Oj3:Spb8kSc5BCAP1YkqFU9oqaOpgj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767456035, "uuid": "3cac250f-1b9b-4fa0-b8e3-eb24c6ebdb5d", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767456035, "uuid": "e9b47cf2-59a7-46fa-bdf6-c0af5ae03c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456035, "uuid": "5bf67188-7e95-44ad-9795-e934067cf349", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0128462-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767444212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444212, "uuid": "4aabb173-7b33-44bd-a48c-ba936a9c22ca", "comment": "Malware payload (AsyncRAT)", "value": "ef599ae5daaf848612678920bb6388c5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444212, "uuid": "ad0c24bf-2c14-4580-b9ec-677fe2b58411", "comment": "Malware payload (AsyncRAT)", "value": "9a67d444bc9c174f635f90e5ab828ff9961294b0288c9fa4dbc5e1fc839fb820", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444212, "uuid": "7b88b8d0-0712-428b-8b0e-58349cabd0b1", "comment": "Malware payload (AsyncRAT)", "value": "5584294ac4a9f80d8a148071d703b900a3a7c604", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444212, "uuid": "e0ee6cdd-a052-4871-8804-ef5a11163d46", "comment": "Malware payload (AsyncRAT)", "value": "5ae25e5d255606fa3de0e5e60a538ea114c4863088c877a97b2e4498781d17b49e282f721b7c58bbf264ca1e31070c1d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444212, "uuid": "03d8f7be-d276-4831-85a5-a151e238f0de", "value": "T1FC232A003BE9812BF2BE5FB4ADF221454A7AF5633503E65E1CC4418B1613FC69A42AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444212, "uuid": "f7e904a1-56de-4b93-ac49-b5bfbe2d5b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444212, "uuid": "a5793ffe-02d6-462f-910d-4c1e29d27f65", "value": "768:5uCGNTdxtrhWU5nGLmo2qrZ07nwMUGPIYzjbkgX3isTM5Xk3nBdeIBDZjuy:5uCGNTdri2mcMvY3brXSsY5U3Bd7djuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444212, "uuid": "ab1dfa1b-7e73-4997-93d8-84dd321f7316", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444212, "uuid": "a7e94bf6-9b3f-4ea9-ad40-430d9600a2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444212, "uuid": "4042a428-e631-438b-9aee-c0926553893a", "value": "pinnacle-market-gateway.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeedbdaf-e8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767448988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448988, "uuid": "6cc2614b-6b5b-4153-abb3-819dc09d8b6a", "comment": "Malware payload (Mirai)", "value": "53d2037bbc1a98599d66f7ecc00455bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448988, "uuid": "7c6116d1-b14c-4364-833e-b567e712a5a2", "comment": "Malware payload (Mirai)", "value": "9a9f7624b0dad8817e70e72a007686c91f1a53d2dc254817f9ee6fd19eed0ce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448988, "uuid": "fb96616c-7258-42b8-96dc-63ae32be9cb0", "comment": "Malware payload (Mirai)", "value": "8ec74c4555c98b4ad6c9dd16dc40fbed29c4e922", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448988, "uuid": "c2d0f1a6-c75c-423d-8847-d6c38ab23ecd", "comment": "Malware payload (Mirai)", "value": "ab30c41aac874e8a91ae09ee422cdf4cfaf9802fbec6b8a765ca084888d01d5c90b94c289cd69c8485997f4aaa70c573", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448988, "uuid": "81d24613-676d-44db-8fd3-b2fbbd341d6a", "value": "T1CCA2D1A07556DE24D3350837EFB444892FABB6BCC787B4361B8CA055678221E95F8AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448988, "uuid": "f055948f-1e59-482e-8769-6a69e97ee74e", "value": "384:ATrgnALbC8P/QqdgRwhqtBE0nh/SMX85ZWT/ZuB1OUGvhXhymdGUop5hg:TALrPoq4wMtBE0nJfXuSZww5vls3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448988, "uuid": "2dfe5469-b16b-4b73-84d0-928d00d49c69", "value": 22624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448988, "uuid": "9208735c-67fd-41fc-a429-d9039049446d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448988, "uuid": "c95e5bf3-12b9-4af2-88c3-eae00f779b57", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5722f0-e884-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431563, "uuid": "23663739-3db1-463e-a465-6e824491dd41", "comment": "Malware payload (Mirai)", "value": "81502dd8fef403d8ec969f846e541a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431563, "uuid": "342d36d6-b280-4adf-8fa8-23355225b995", "comment": "Malware payload (Mirai)", "value": "9b7ff71855415b2eaafd3a278342eb9079e4eabf07ea31f55f87b85febf13771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431563, "uuid": "b7bce398-fe33-4bc4-9e5d-22d2b86ca3c5", "comment": "Malware payload (Mirai)", "value": "4ecdcbb5ca805853579084e161d3322ddcc13fac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431563, "uuid": "afadbd74-c638-43ff-a43b-391f44f02290", "comment": "Malware payload (Mirai)", "value": "79f56af7623d6b4a1d7bb08b52e99885a3814093383c27a5b01b6a0f587f7a8aaa8527299ed5d67efb18a0993e3d7c20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431563, "uuid": "d375f2d0-7428-4e5d-8a04-23ceb35d6aa4", "value": "T179531845BC81DA17CAD462BBFA1E42CC332653E8E1DE72079D116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431563, "uuid": "8f7f22b9-cdd6-4085-8472-67de0dbf9d26", "value": "768:gMLtf0Bd2xQMGWoIUXYphdE2eR9nwNx/WFwhBhVS8HemNsUh6BLx4ueMbZu+7R:L5fSd2CXYze9Tnwn+Wh/HHYUWxDu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431563, "uuid": "5581aed5-a98e-4554-9850-548a6ccd1e89", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431563, "uuid": "fd14f2ab-314b-4005-85d9-278a36833faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431563, "uuid": "842b5cd2-1fda-4ec8-9ccb-89a4e7ab3fd7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1765634-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430820, "uuid": "8f970f97-9213-4179-86c1-f83509a7cb1a", "comment": "Malware payload (Mirai)", "value": "e3d6f01fb9b162bce289cba10741bcaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430820, "uuid": "30b19c3b-9d6b-4fe2-8cea-e13d15e37c52", "comment": "Malware payload (Mirai)", "value": "9c26c61de6cb31dff99e8e4b3cad442561148edb5b994600e23374f7b7f4a000", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430820, "uuid": "65493501-49dd-40f8-b3e0-d6bd3ccf310e", "comment": "Malware payload (Mirai)", "value": "63623511dd91c24eb748eaefd67c57626f5a6cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430820, "uuid": "2767cff9-1e4f-49da-a5fc-60ff0cff6753", "comment": "Malware payload (Mirai)", "value": "c93890fec59714483f2b910dcd5403f9b6bfcf5e297ba501f56255f60c164cf14fa1f2908564b9c7cf121325dcb28c60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430820, "uuid": "7981e09a-69e2-4542-bd84-397d25bf5a26", "value": "T11F630232C5425D99435900F449EDFCC238F716FBE17320FC7E628CAD5AD326168EA842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430820, "uuid": "f3f083d5-2a37-408e-852b-b3b177ed2355", "value": "1536:5sj0cfsIHD+1OLISuS05vbzPndU2XfcER9qOLs:ijBnFI9/5PdvXfcER9qOLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430820, "uuid": "88a0ebdf-4288-4280-ad52-2704965cacaf", "value": 69456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430820, "uuid": "4f90ac0a-cd51-4893-9066-7348ff788c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430820, "uuid": "00290841-7e61-4c00-9301-5bc41d57a0e1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e624c9c-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431137, "uuid": "3290c648-7763-4e26-86c8-69c5557102a2", "comment": "Malware payload (Mirai)", "value": "cd3710c1026647ac3f24a473cc0488d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431137, "uuid": "95828129-2526-4995-9e8e-558f386b2fa5", "comment": "Malware payload (Mirai)", "value": "9c91af5117abd898a6bb7e464e239e6b0e204043ebba8436334c075bf3e2bf90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431137, "uuid": "e7e5c6e9-12f4-4f53-93cf-2d6ea47938b8", "comment": "Malware payload (Mirai)", "value": "fefa6ee02db8efadbb35924a14b80c79d2afa49d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431137, "uuid": "bfeeb934-b758-4410-9b1c-97d3e7825260", "comment": "Malware payload (Mirai)", "value": "1307bf9d9be61b386dcc307cd7bde1d0816121596e75760dad6ea5eb9780333fe7747b697c9638af21ecc984a8d35d17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431137, "uuid": "2cb0e96b-ea67-4d8d-afdb-765069b8ef6b", "value": "T1B8143A02771C0947D1622EF4263F27E083EFD9A124F4FA45694F9B8A9271E37158AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431137, "uuid": "f893fa0e-1a7d-4f16-a796-1dce5a4f3244", "value": "3072:x+1DRxBFKp4mGXqLix1vAWcYFd9q/CTKB7V:xKDRruix1vAWcY/9q6KBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431137, "uuid": "9ef4ec2b-4a11-4643-88a0-deafb2e92126", "value": 191612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431137, "uuid": "f68602e9-2fa5-4b4a-ab1b-48cd3ba92bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431137, "uuid": "ed52c7ef-0852-41c6-b5bf-79fd2ab80926", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dfbc75-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443381, "uuid": "06a2e5bd-b926-4c44-abf8-0705cebe9c6f", "comment": "Malware payload (Mirai)", "value": "850008b90ad0ba43b2339c1778903993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443381, "uuid": "7c32558b-0de9-43de-a666-5d14e8eba214", "comment": "Malware payload (Mirai)", "value": "9cc0f122688e3fe28e61092f402a2b256b22b6f9cbcaa2c89e5a7d7b93a02fcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443381, "uuid": "d0bb96bc-c0fd-4da1-97c7-a1df2950029f", "comment": "Malware payload (Mirai)", "value": "8ade3d4434d55dd9b97861cc036dccc3aa44e230", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443381, "uuid": "bf7ba10e-2197-4af2-a2ec-91e6fa5a77e3", "comment": "Malware payload (Mirai)", "value": "6311a4cc6797c33f538547b8b1e300af5ef78b3b0f266d3f694cdc5c2cbcc95cb85cb2637cdf1e65512ff6f36656be40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443381, "uuid": "579f0d24-6a79-4348-be1a-c853e102104e", "value": "T1135339C5AA03DCF5ED19097520B6F7365B31E5361039FE8FE7A4E932B852602B50A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443381, "uuid": "d18b301c-699a-4135-a096-6135559a9b36", "value": "1536:6N1/90wbJUedRoVEOoAER9wo3pmvMHalQi97NeHxXvR:6NjdbJUIRJOoAmwo3pmvM6lZ78RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443381, "uuid": "e46a0c29-c9b8-42a5-b947-5023367fead1", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443381, "uuid": "410af008-33ba-46bf-9d18-4928b53bcd6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443381, "uuid": "d9e1e38c-97b7-4a65-a0a9-9a952f65f71f", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d110a38a-e879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427034, "uuid": "bca50c69-53c2-4855-bb23-7493e92d9d3d", "comment": "Malware payload (Mirai)", "value": "cde24ffb18303fc50135d10bf4d5e0c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427034, "uuid": "a531cd6a-2a9d-4b9e-83ad-f20de3f6d228", "comment": "Malware payload (Mirai)", "value": "9d8fde89c19633f24fb27568ea420a90b3793777422c2017c108bb9e7de63c30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427034, "uuid": "af80ca57-ff30-4249-8bff-6673e69756d7", "comment": "Malware payload (Mirai)", "value": "5d015ea5f10230908debdcc85e3cd6997d5847ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427034, "uuid": "941d54db-5b15-489e-b185-5e0e07191376", "comment": "Malware payload (Mirai)", "value": "0497cdceb6191ba676933a22f44f985ae151356a914357bee20ebf7c322bd1c843220bd5a6307294cb3467815f7db935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427034, "uuid": "38f73ccf-1062-4ed9-8f63-8ec0f3c24b78", "value": "T1EC230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427034, "uuid": "299c840d-4053-46ec-b1ce-2d8016c14ebb", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THL:5DmKF7Gxyk8cqoHAmWurAufsG5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427034, "uuid": "dcdf0203-1f0c-49b7-afb1-ce69cfd9a2cc", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427034, "uuid": "2b5c91f7-9184-47a7-b516-52e5c65210c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427034, "uuid": "978dac67-09b4-456a-9547-89c95e60ebc2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1974350f-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427155, "uuid": "fe2ecaf3-73ed-4e4f-ad70-3f86d2b78df4", "comment": "Malware payload (Mirai)", "value": "fad1d0e686c71815bfabbfbd0a595995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427155, "uuid": "666994c6-7da6-4b85-823a-2fe99f3c1d05", "comment": "Malware payload (Mirai)", "value": "9dda3d5663e4a6fafe1d7545d2de2d019590c1dc6e2d36381e737a29f374e451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427155, "uuid": "a93fb241-6158-4e31-bc06-92e2c150e0dc", "comment": "Malware payload (Mirai)", "value": "4fad33ebbe50af965064793020846957c890c5c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427155, "uuid": "b9b46b0c-1f5c-4bc2-88ce-83416a664214", "comment": "Malware payload (Mirai)", "value": "33bd2933120391da244b96422f03c7ba465a219df2d3bf460ad43ff58d860c9613421d94ee49b83e10b8ad8c07ee7b25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427155, "uuid": "8e1a3d82-a52e-412d-9d0e-fb16613d3d46", "value": "T1CC141B46F9828F12C1C112B9FA5E418D33136B79D2EE7212DD24AFA0778A8EF0E77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427155, "uuid": "523abed4-05a8-4f43-827c-a8779ca79daf", "value": "6144:iSuCQfVEFEwWF1GKXkHwhabJe7lMDcisRP:iSuC8W2wWFMKXHhaV+lM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427155, "uuid": "179a50d5-d96d-4a1b-8f5f-b67277ef5402", "value": 209020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427155, "uuid": "20be30d8-ed72-4264-9fa8-4075c5bf95b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427155, "uuid": "3ac7c8b2-000e-4abe-8215-63a88a6b76f5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650d8d0e-e83e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401512, "uuid": "614ed4f7-7bb5-4119-9205-90c0f557dfbb", "comment": "Malware payload (Mirai)", "value": "95ec6370e329b810250b701c1e8bf161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401512, "uuid": "a1f1507a-33a1-44df-9491-a236200b23ad", "comment": "Malware payload (Mirai)", "value": "a118608668bca15e5981a323e19a6e75a6abb3fc44f6e804b84e453c6711fbd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401512, "uuid": "db22a0f3-7327-40cd-90a7-c85f5cc62ba8", "comment": "Malware payload (Mirai)", "value": "20ac2ff6162045e7882981db810bb04f364e3ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401512, "uuid": "ea9d7b20-115b-4573-b34d-1f4a00a1a69a", "comment": "Malware payload (Mirai)", "value": "e35c006cf875e24cf5b23e682b072dcd994256a58f36ee1a55e15db134ee24b596d78566f81629976a011518eeb35d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401512, "uuid": "10eba53b-e85d-4105-ac70-6a503301e946", "value": "T18E43D64AB991DB15C5D551BAFE0E528D332317B8E3EF73139E14AF246B8B42B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401512, "uuid": "c81a6938-d441-4f0a-bfbf-c20c800cd4fa", "value": "1536:ahnzwA9qwgTYs7UHwebxgzz4vfjntL36M7i8gwyJDoiu+7R:4wAswcYkUHwebxgzz45gwyJDoiu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401512, "uuid": "b88dad30-6dae-4207-851c-2a43197423e0", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401512, "uuid": "6917b50c-19dc-4826-b5b1-829bd7c9879f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401512, "uuid": "f3c69c2c-4083-4245-9cff-b32a9e372a07", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58c8b27-e899-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767440732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440732, "uuid": "d6aaaa68-b003-4c33-af7c-bf48a1365e5f", "comment": "Malware payload", "value": "ad04a97e76d889adb7527c747df6a3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440732, "uuid": "97c1ef58-43a4-4e04-ac6b-efa2107ebe59", "comment": "Malware payload", "value": "a173438c7f500cde194375ebf96ccaa34c3ba578e387796b95c00b37eb53501d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440732, "uuid": "19112f63-4a2c-47f3-88ed-80d9a8ee997c", "comment": "Malware payload", "value": "3ea5cdf4665c9ac4d8f7171638621d3f230a3212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440732, "uuid": "395c4b8f-cba0-4f3c-86e3-0bcffef3e6c6", "comment": "Malware payload", "value": "271036eb3f20eab702f014d5cade10f32422a131548f1048a000737b7b8d346686027043be9f69318e5be47e2fa57dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440732, "uuid": "b3362ae4-5c30-48bd-836b-612288558cba", "value": "T182462A343EFA9029B273EF6A5AE8749BEA6FB7633707541D1061038A4B23A41DDC153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440732, "uuid": "8dfab433-0a1a-4447-82c6-f13998c29bc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440732, "uuid": "a7eea4c3-98f4-47bc-a53f-dc46ba115b13", "value": "49152:weJrOcFKH+wSszl2NYuDDN5GCxNfyHI+3zNPaho8xwQ:o8xwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767440732, "uuid": "0da9f499-9acd-4725-93f9-435e6f086486", "value": 5820208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767440732, "uuid": "9e0a8e6a-7372-4b82-97d0-ac8866b14331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440732, "uuid": "b812c416-fcec-4d07-99cf-de276178558f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04c823c-e84a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767406873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406873, "uuid": "9e78613e-34dd-4e7f-8e24-e1c885222e87", "comment": "Malware payload", "value": "fa7c8d036d6ea27d6d2ffdf764aa0e5c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406873, "uuid": "9c0e60fe-e9ba-4bd3-b1fa-54d9b94d78c5", "comment": "Malware payload", "value": "a239e564e9e26d4e550b86e50e09c3b3e21647dfa2e7108c62b24d0345687db6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406873, "uuid": "10e02b36-814a-43e8-81b4-0e9dde62b128", "comment": "Malware payload", "value": "9a5d415a37b99996083498cc0f3494f65d0b79ef", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767406873, "uuid": "65de30a6-c0fb-4588-8a5f-de48fc351a60", "comment": "Malware payload", "value": "3a5eaa04583886df88fd217c10e5255c9b31c1708cc5c1de19dc9cc18d5604b596df9c1581759be2e8cf7e10a23ba2ee", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeUpdates", "colour": "#0FE0FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406873, "uuid": "6fa83a5b-51f0-4c73-aec5-cae794708f25", "value": "T13147EF23F605299BD9D6A230F4E7679533311E4403939279171FF02AFDF25CE8A66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406873, "uuid": "ab717ef5-0d09-4403-bb05-05c2df4437b5", "value": "393216:cRktUnRsIvkca5x+SaJ+Tyyl48KWUtjZtjIX0ei/Yv6OOths56hxBI:A2Ivk5x+DJwOWUtjrckpPOaZxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767406873, "uuid": "a3098714-bf5d-4746-a408-f327bf76f9fb", "value": 25083710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767406873, "uuid": "b420b806-d48c-48c2-b973-f85b0ca95b7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767406873, "uuid": "0110e037-0c3f-44be-9cc3-fa58501dc8aa", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665e48d0-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399367, "uuid": "0d1e1ec6-938a-4f27-9457-afe6c2bf2cf6", "comment": "Malware payload (Mirai)", "value": "72fe063658eb08f42ab02a912b5b476c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399367, "uuid": "ddd812fe-3401-4e83-8ded-f1a02aa09cbd", "comment": "Malware payload (Mirai)", "value": "a25ac05f61c1679c663955e344aa7f4aed5f6646c2a63a2b125741a52398d548", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399367, "uuid": "1d9dc492-6284-4fb7-9fb4-6dcdbf125d2e", "comment": "Malware payload (Mirai)", "value": "01994449e6eefd914e14213fd402bedf002fa99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399367, "uuid": "804968c9-410c-46a5-99d2-8e2ff34ada44", "comment": "Malware payload (Mirai)", "value": "3be7db21094f9301b12a2dc899622f0b3803fc7b475e89a0173ea88335825bd65221bf22842aeb34d3064228b9cfcb60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399367, "uuid": "e7eb6289-dc48-4485-ace7-00fcb1c4764e", "value": "T1DD43851A3E229FAEF72C87355B778B20975423D637E08284D26CF9055E7034DA45FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399367, "uuid": "55f5056b-2b35-427c-8cf4-44c6fb372543", "value": "1536:Yr3iwg+Rs7P2JK6UEexinQrh7jALjOZLjjT3n+M0gjcBu+7Rk:YphK6XeMQBn+M0xBu+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399367, "uuid": "c133a0b9-b77a-42bf-83d3-090c935ccdd9", "value": 59256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399367, "uuid": "eda69e0e-3d62-4157-a195-792c8a2241e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399367, "uuid": "c5a0a563-6b18-40aa-bcce-39877a4d1abf", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f66070-e8e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767471193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471193, "uuid": "98f25f70-6dca-4513-8d89-790e601c43e6", "comment": "Malware payload", "value": "8b871f5a085520e2620ee9ab57b8e5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471193, "uuid": "1867bafb-4113-4408-912e-26d37a82b9a9", "comment": "Malware payload", "value": "a2d70c5995f91858106c6f0db643d4eed9eafff7a8b552109421a1a328257c0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471193, "uuid": "55d33c2f-92d8-454e-8a9f-64ba03b23743", "comment": "Malware payload", "value": "c1a0b85a9dc8f1f82aea21774afd4efbb586bcca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471193, "uuid": "d3ea1014-05ae-4ddd-8884-6f416ca739c4", "comment": "Malware payload", "value": "18836313580625e8e02b20f6592458c2bcbafeb01d8351e7dcd24e19980d1cf4c0bc85ec1cd9a4c1ee01305af186e3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471193, "uuid": "9baa8f50-bd8d-4470-bfb2-70958863074b", "value": "T137C63318626044DDF8E3D13B698110D2B7F2B5241B31CADF1BA892993F5BAF29D3CA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471193, "uuid": "b48f1938-4793-49e3-b70c-06bbd589bac1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471193, "uuid": "ccfb8d61-30a4-418d-a080-a1f74007a365", "value": "196608:zhQgTSJIeRo+jFgaIAjNyMzEltbW897GGr1LDsBTG9WdSWQta/R6:lauSfdjcMo1N3sB1sWQ4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767471193, "uuid": "ef8d9516-8b8e-419a-94c0-7fbaf5d5ed8e", "value": 12101050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767471193, "uuid": "aeae5b40-b9e8-4b1e-b8f9-75ff2ae7965e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471193, "uuid": "0752c6c3-64d9-43dd-9f7c-45dbfd8f9857", "value": "Externall2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf415981-e8ab-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767448506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448506, "uuid": "9b9e12ff-b9ca-4faa-a288-8c30bfd8982c", "comment": "Malware payload (SalatStealer)", "value": "892dd83726145c538ef16ef6f953b23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448506, "uuid": "3e212bd4-c4dc-4064-83f3-bcfb033b41ed", "comment": "Malware payload (SalatStealer)", "value": "a461634019c317276d5a8f1befccd10cc3f3b11de009157b7305d26b10b53f3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448506, "uuid": "a38df582-45fd-43dd-821f-dad8653a7099", "comment": "Malware payload (SalatStealer)", "value": "666d939f2d02ba6e4607745b2f1a39cd699eb27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448506, "uuid": "4df63896-6af0-4acc-acca-c5c07e589420", "comment": "Malware payload (SalatStealer)", "value": "61d37b58cd43131e676b36a58bb057642a46c7dfeaa02e91cdd8448a9580b6e392dc92a426fefc34fdbb95dac6483ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448506, "uuid": "04e378ba-0ea4-40c0-9c2b-0770981ae3e0", "value": "T1A8E53349C082D1E1D6BAA7793413BE5424E3DC8B235883D834FB47BD7C1E17A699387A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448506, "uuid": "355075bf-0cac-43dc-b7f6-d3140254b135", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448506, "uuid": "a0b4d74b-6282-4cd1-836f-99a936f01adc", "value": "49152:0gMJ3TKMP3ObbugraWTbYVbi/bDB2PlpAisPWI3TpB6clvR6IKgnTQ7Is0:0gA3TKDbbfTjVqEPj3FB6c2sTQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448506, "uuid": "fd381335-9322-41d9-ba23-f3e521e4d9a7", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448506, "uuid": "39186a9f-303e-4bcb-88d4-2de87c902c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448506, "uuid": "35c22b31-c940-425e-b221-5b251ba3e92a", "value": "LunacyPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb06622b-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463531, "uuid": "f6c08867-35ae-4040-99d1-cc4884f52fe7", "comment": "Malware payload", "value": "643a79a6e3601c7c90d7d1255ee1a7c3", "object_relation": "md5", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463531, "uuid": "e4338495-8c4c-4c3f-a4b3-ca989fbcc4e3", "comment": "Malware payload", "value": "a53ff922447a49b67a3d48ccd23444da3f1fac047b18dc85c732a25ec14e364b", "object_relation": "sha256", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463531, "uuid": "16a9e1ae-d1d3-4268-ab6a-b79a845ac409", "comment": "Malware payload", "value": "9b78e31d09247ca525f3202e40d0534994a3cdb6", "object_relation": "sha1", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463531, "uuid": "a591d23c-6e9c-487e-8d28-e300cbc462aa", "comment": "Malware payload", "value": "e69ed32380acbf93a4d235e7cdd5a31e089151f440b3c8d8f276c492e91035454c0c14375ec775f4c6f493552a92c124", "object_relation": "sha3-384", "Tag": [ { "name": "162-19-205-62:8081", "colour": "#B4046B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463531, "uuid": "d2ea7bb2-4003-4d0b-b54d-3fd2390f262e", "value": "T12BB4B573E952547BE47495309EE343667276B8908771824F2B88613A3F97BA02F36FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463531, "uuid": "e3130d28-a233-4d8c-9d0d-0e5e3ec5ba01", "value": "6144:sOLRgtg83PoKqnGGuzjCkZkbrHT9lGh0/KPD6MmJq9tmXeL:UPARuz2TplGigmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463531, "uuid": "0f1694af-cc26-4ad9-90c7-a28d91187a7e", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463531, "uuid": "70912701-7b15-4d6a-b12b-7504e8cf465b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463531, "uuid": "5f5bac80-db88-4fdd-80c7-c985ed475df7", "value": "EfiGuardDxe.efi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef2a636-e895-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767438922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438922, "uuid": "bb8246e4-466f-4298-af36-c45d15fffd0e", "comment": "Malware payload", "value": "82fd989b9188d1d3ed9e585aa07931f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438922, "uuid": "d5dd7348-1aee-43c2-8b74-0d6cf79cfdc9", "comment": "Malware payload", "value": "a64f9579bc097a06ea319427ae2a87a4e42f80105da338addaad45feeb23a9ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438922, "uuid": "b3157b48-0773-414b-8e37-b1cd4699571a", "comment": "Malware payload", "value": "b8b1d457ef0baacd9e9309f5308842a8cc2aa977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438922, "uuid": "be51d18d-df7d-43f8-8d0c-cc0bd622bb05", "comment": "Malware payload", "value": "282a0b6d631ab8b07fcbf2fb9d2f57ed7758768ce50633ee2afd52937bad0229b62ff84928649540e69a33598ea33c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438922, "uuid": "d7b90818-769b-45fe-9d11-83b40649456f", "value": "T1AFF623D23ED59298C0E75A305987179A61E1B78DC1FF8A0F3BC75C0639B0E138D1A9B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438922, "uuid": "eaea187d-96c2-4208-bcf0-7a74cb2d2d1b", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438922, "uuid": "ea149868-0c5e-4cf3-a2e4-f2030bc55e12", "value": "196608:fsKcIziynRjwhmM8wLEzEJ0WKLI/EwO4AfTbm8hinNpgQnxHNlbM+dXQgVzolKBw:fsK/z/OhUIbNcTbmNNLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767438922, "uuid": "3908a899-872d-4274-bdf4-249d4e91c609", "value": 15552000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767438922, "uuid": "595c3520-24e4-491a-acf1-442766aa8020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438922, "uuid": "a0ca6402-8c54-45e5-93fa-1accae63c12b", "value": "oblex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96a4b90-e880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430108, "uuid": "8ac10dfe-7cd6-49fa-89f8-55da55708391", "comment": "Malware payload (Mirai)", "value": "495f422bdfdb8883c15e4d024aba627f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430108, "uuid": "c3d60a92-3751-4741-80c9-a797628fe044", "comment": "Malware payload (Mirai)", "value": "a7333504eb436cae3fb13cad4899a8b62b90b700c52b2f9a601e8d58c43ddbd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430108, "uuid": "a5ef1318-e8f8-44ab-9644-48de308778df", "comment": "Malware payload (Mirai)", "value": "c5ea267b23222ae47747cf4957d1b377ff8abdc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430108, "uuid": "17919182-3f32-4940-b7ce-800dbee65cda", "comment": "Malware payload (Mirai)", "value": "846a029e8612a2fe60616c14975b772107726ecc93b6b85a45d3dd6ca085e691263ea67c9e5b6929dc299193ac7a81a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430108, "uuid": "de2509f1-14a1-4202-b82a-9dc5ffdb66d7", "value": "T13A23F849BC91CA56CAC55577FB0E42DC372603A8E2EE73039E14AF653A5F83B0E6B440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430108, "uuid": "5c0e9782-d980-4840-9bbe-8987ca807f7e", "value": "768:D2nhtYlBgWLID3W24mNmeHJBt6Q1nj3GoV0+4hu+7R:ahtsGWLK3W2AeFzdaq0/u+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430108, "uuid": "bec48ed7-db51-4838-a203-87a707a7bc6a", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430108, "uuid": "36e8a9ec-8325-4a2c-acd8-23db287921bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430108, "uuid": "0bb0bcfe-0abb-456e-a918-d3ac37528a77", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b300bcee-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446311, "uuid": "e47403ba-0195-4054-a6fb-f9aba56a839b", "comment": "Malware payload (Mirai)", "value": "93045a55c17444e594df58c4a3193ab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446311, "uuid": "552cba1e-e7bd-4380-81fb-bc475981f417", "comment": "Malware payload (Mirai)", "value": "a7de8da38e69a5b7573f499b6f2ab586b9dd91530f6fe66fcdd327315a101aea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446311, "uuid": "85cebed7-3a46-438b-8464-ddbcf538ed0e", "comment": "Malware payload (Mirai)", "value": "b98015eb80f1aa92649058a7bc4aa094e18d3893", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446311, "uuid": "7ef49f81-5243-4175-aebf-5811059d291c", "comment": "Malware payload (Mirai)", "value": "5ad499b3fe6657a164e3c380e0733e321891c342257b768b749b341e211acc9ec1cf3d087a49546ed5ce0270b6f262b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446311, "uuid": "70178e80-26f6-4453-800a-d0ec0e2f01fc", "value": "T11A931941BD81CA5ACAD4237AB6BE128D3361B3E5D2DE3227CC115F15B78A61F0D27B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446311, "uuid": "96f7b257-071c-4dee-87d9-31bb52386b94", "value": "1536:56DSxsDXfZh1XOQtJipTVpFwCqVF+b18QGHuILQjgFPVh+J3M2NpwZXbwbZn0j:5gSubXOQzyT1JS+JFKrwbZn0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446311, "uuid": "685dfa98-5c4d-4aa9-bcd5-3b6f0e1cf6d3", "value": 92504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446311, "uuid": "6e1f9f2e-a458-4fbd-9a1a-09819dc102a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446311, "uuid": "0bfcd9af-546d-427d-b5cc-4f3f42763ad1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365abc23-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445243, "uuid": "7b20eabf-79aa-4e8a-ab6e-cb1f1630e06d", "comment": "Malware payload (Mirai)", "value": "8a4285965240ffc8edbc87d8ea6227b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445243, "uuid": "90bca255-462f-4400-96c1-d90239f17405", "comment": "Malware payload (Mirai)", "value": "a82733b2e18d370f41e4dabb375d47234b4baa6c69db1d3b72d346cad1a58387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445243, "uuid": "ff2e313a-cda5-489f-a1bd-a1e9c7f488dd", "comment": "Malware payload (Mirai)", "value": "acdd65c519b3fa9b18dd85a143b63d31b9d42a26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445243, "uuid": "90849614-8fb8-43f5-bb28-9eced40d1503", "comment": "Malware payload (Mirai)", "value": "5c9415a5646b2e9a193ba66dd51fc6dfede3c81409039c131dd8ece577d3e618ca847bc3b70c0b296bf7c2b5836e5200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445243, "uuid": "fc9f2f2a-e07f-4b7b-93a9-6096edd78a09", "value": "T16633C60AEB508EFBDCAFDD3346EC071274CC551B22B82B363574D928B15A54B4AD3DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445243, "uuid": "164c530b-142c-4d39-8d98-3ff613d303f1", "value": "1536:Kv7/WeBAV328pAJHwi8/xAUQLxKgO127xpyzz:KvjWeFn8xAUQLxKgOS4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445243, "uuid": "43fbe8e7-45b1-4931-b0de-91a7d0a55a73", "value": 52260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445243, "uuid": "a935e76c-5348-4c7a-9422-a28ff3f93636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445243, "uuid": "08c29496-9349-4b0b-ac2f-5deb499b3f0c", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bbb4c3-e8a9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767447715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447715, "uuid": "cf1fba2a-1446-46aa-919f-f742e1703b31", "comment": "Malware payload (Mirai)", "value": "1a046c4021f637e57cfcc7962b8e199c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447715, "uuid": "dc308d8b-0bd2-493b-94b8-42c97935e144", "comment": "Malware payload (Mirai)", "value": "a84d607654413ae7ee2c6970e7b199aeaa7f2bd7b4fc833f44a2fc8ce7729963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447715, "uuid": "653c946c-0ce6-44ff-9891-2f8952bea2eb", "comment": "Malware payload (Mirai)", "value": "1cee9a56b17c3b02cad0272d18b93367b71e0b3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767447715, "uuid": "a6032fe7-3393-4b11-baad-bba7d016bc86", "comment": "Malware payload (Mirai)", "value": "241de42608acda17b22b81d2a5e6e6557c8fa4e23caa70a2ae1ef111b87c8b23f58dfca0c30151e4ed9c2464e3625e22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447715, "uuid": "20fdea5d-7f1c-4b86-9a98-6cfd1d0e7e9b", "value": "T192532945BC91D626CAD462BBFA1E42CC332653E8E1DE7203CD11AF157B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447715, "uuid": "c2145237-a153-4eff-8818-ad089d0a4d2f", "value": "768:ihVXTCbJsk+BL0Xs5tDVI/KPHsLBHzAUxwRA/geB7zKQmNdxkBBiEo69iogu+7R:0XTqJetDG/KaBH0mO3et27xNcIu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767447715, "uuid": "6fcdd45f-0493-4af6-91b4-1ba00c707174", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767447715, "uuid": "be2203cb-358e-425f-abbd-05a7ea260470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767447715, "uuid": "21be8337-e961-45e8-bfb9-72e647030881", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce2d078-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446274, "uuid": "0dd894aa-f537-45a5-95d8-1a6e918b9c48", "comment": "Malware payload (Mirai)", "value": "b5cf24fa50d87f9b2e2cb820b7ba70ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446274, "uuid": "6cbbbd1b-ab3d-4465-a991-8c2bab6acda4", "comment": "Malware payload (Mirai)", "value": "a94d7cbe81a0cbd11fb01bd07ecaeac53841be51de978edcbcd45d38ab37b6d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446274, "uuid": "d162634a-1669-4232-8ed6-62db7d9100d2", "comment": "Malware payload (Mirai)", "value": "ecfbc5da072e5a4e2d230ee5d1753908ffe0da1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446274, "uuid": "29a48853-da1c-4d7a-85ef-c58ee5dd0edb", "comment": "Malware payload (Mirai)", "value": "f2a3f9ec41d73e9062f52c846e2fe33669f33035f29b80f93f8dd41009e56ff99e1ec33c622af3ecfaafb539a6fc105c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446274, "uuid": "e1de5608-eabb-487c-b98e-444cf782bb4b", "value": "T11022BF9C1A73298DEA654CB264CC23C11E85DB6740B7C1B76C7B5E84B2360C73F4AC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446274, "uuid": "ca71930b-e284-4b54-a12b-c32272f4f166", "value": "192:X710UzAmKnmCQfmm2SdXkQMMay2pqH6z9YslKeMrkZ+HhTpWOltZZEaBHKE6K/:XqmTmmXkBdy2pqH6z9/M6ShTp/ftBj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446274, "uuid": "6b01ec00-ea5f-4fc3-922e-0ea114c8e4e1", "value": 10284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446274, "uuid": "5a69bd7c-f041-425f-8d9f-ecfe790c6621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446274, "uuid": "99e19f16-1076-4ce7-86e6-55ca81ed41b1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d39710f-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399889, "uuid": "e241f566-3d4c-4862-a6aa-224302351595", "comment": "Malware payload (Mirai)", "value": "32322f8c85391b0be887fc2743da5215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399889, "uuid": "bb26d9e3-a4db-4d9f-a230-aa662d41bf42", "comment": "Malware payload (Mirai)", "value": "a99a4639c0125c93b294a8094ee7c2ab172d2001f634f15ff3d7db19613974d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399889, "uuid": "85f1c9fa-3923-4a26-a1f5-558f45f46bf3", "comment": "Malware payload (Mirai)", "value": "9c7fadb080f2afb2c38ea1e237d4b7190c7019a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399889, "uuid": "ab09b73d-73fa-4a7f-b440-330999c9d854", "comment": "Malware payload (Mirai)", "value": "0bbe1258a848027dc9c4ef148db5bb3307a2b63479f708050183b3add2683d4bc80786734f293c7eb5ca8f111ccccb5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399889, "uuid": "f7911ebd-87b6-4449-8218-148c0163d96f", "value": "T154538D37C87EED94C18885B4B9B1CABD1B93B201D6532EBB1985C5694043EBCF60D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399889, "uuid": "c8f32c8f-c3c4-4a1b-8762-8c7602b11494", "value": "1536:IaLwtKDtzbe2rQnukodaaUTiXU/g5a9M9C+c0u+7R:IQLt2OkMZUTV/Ga9M9s0u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399889, "uuid": "0d16c186-f025-4362-9189-9a1c8e7ea5aa", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399889, "uuid": "ae143ab0-8a66-44d8-ace0-2fa2342b1bfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399889, "uuid": "295188a8-bfba-46b9-950b-c8e4f0a20032", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926722f2-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463436, "uuid": "7668d074-6249-4db4-b09a-f8c89f0a7ab1", "comment": "Malware payload (Mirai)", "value": "fb58e0690fb50fa323eac500a1bbe232", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463436, "uuid": "dff09823-5756-499d-bde8-47749b65c29f", "comment": "Malware payload (Mirai)", "value": "aac64283ab259d76744a2ee8174d3cc9bae3c033c1220db463c4fb6a79abc21d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463436, "uuid": "00c4be11-4c7e-4d48-bf56-134f8ccab817", "comment": "Malware payload (Mirai)", "value": "c78e2b10d1ad898898309995f0810284b25b91df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463436, "uuid": "9b90fc35-5ab3-41b4-bfdf-f152057ae027", "comment": "Malware payload (Mirai)", "value": "25c19d32e46ded5809fe332a6599332d61f5deb33302156ae9a6553c2e01ef70547f14a2f331573fb379f5715bff2608", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463436, "uuid": "0e76c154-eae9-4571-8daa-f5b03a462862", "value": "T1484128CB238124346CA69873FBB9059435C498C514F06F4A9BFD39F4458CD64F9D0A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463436, "uuid": "f4ac3c2d-71e8-422b-bf01-3162099bcdc6", "value": "24:vZyd/sF/scL/szld/sPnM/sNG/sX/shWHZ/stxN/sLh/se/s0/sPueH:vMGuRRGPbNRkwHKtx2GpD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463436, "uuid": "5a32ac1c-1642-4964-8e60-3b1143b7865e", "value": 2002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463436, "uuid": "526f8c00-e60b-4503-8b77-942826ba452d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463436, "uuid": "2b8c9516-4b72-4e3e-9370-46669d392983", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f1e850-e8a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443571, "uuid": "04c78e2b-2d41-49ff-9885-ad2cf222e825", "comment": "Malware payload (Mirai)", "value": "16e791c8aef68bd5ca5ac4cd725060e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443571, "uuid": "22fcb232-d8b7-43e0-8c87-ae87f2eb56d7", "comment": "Malware payload (Mirai)", "value": "ab7d1bee03ce6d9aa13e9ea3d1d1ac1312754c73d2586a7bededb9321ae9bf26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443571, "uuid": "34bcb4b5-167d-49b1-8794-bfe3e6813be5", "comment": "Malware payload (Mirai)", "value": "e2a6872d4091e8f76802d7758fd81113705b4330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443571, "uuid": "1e8dbf0e-2eb1-444a-80a5-f70a99e763be", "comment": "Malware payload (Mirai)", "value": "30ebbcae809e8b2779153d8ef58d291c4fec55e4599f6814c2082c352b195ef5a39fea9134907103e3d3bb5117e6c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443571, "uuid": "a70845c8-a9c7-4fc3-98e0-dbb06d460e4b", "value": "T1CA335CC59943E8F4DC1A057E2572F3325BB6F13A013DFAE7E798A926AC52740A5063CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443571, "uuid": "2ffdfb53-65dc-43f3-b29c-dd983e8acc89", "value": "1536:HqHhYIAm2xdYY+zbjam1RvUiZMFG6t7RwfHKb2rXKZRO:HqBY1m2xqrjamnvUiZM46t7RiHIE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443571, "uuid": "badd5830-f409-47a8-8c13-83324ed695e3", "value": 53904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443571, "uuid": "73a8937b-3b67-41da-8a3e-49d26c965b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443571, "uuid": "82a75456-b592-4bdd-b245-e6254e13e0c6", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec7ae4b-e8ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767477093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477093, "uuid": "c72465d3-1feb-411d-b671-2297eda80bba", "comment": "Malware payload", "value": "88327f1fd9a840b5e03ace05e44d2dbe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477093, "uuid": "e7c1d8ba-ba62-4d46-977d-0f37c4a13d40", "comment": "Malware payload", "value": "ab976b5230c202d4d61fa56312d409b999197e511bfa240a1b9ff335e7174678", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477093, "uuid": "8f36b769-86d6-4085-85ca-f2b6f33a743d", "comment": "Malware payload", "value": "39447349fb1ead7c863e48a3256092566ffb1345", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767477093, "uuid": "23f1f21f-4f9b-46df-8cc2-bb8f9bade61a", "comment": "Malware payload", "value": "95173ead3fcf178569ec64e3fe4c2e6d9905b3854a8f5f3977b3e475f202820d9beaa8ac99db70f7df906d2ced88fd2f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477093, "uuid": "58037cf5-8060-40d8-8d84-2055a0f9ff30", "value": "T1DB072313D66FC834CA3B88F361C70344A92326559D0AD27F13F46D958E62A5B0BF1B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477093, "uuid": "4590f738-89a6-422e-b693-be4983fa5ecd", "value": "393216:xod9DlXMKANhwzfQ5xxOaxQn5f0Ed3Udqx8mbdvwgm4:WTDtcuzfS/5Q5sEdgqx8OjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767477093, "uuid": "ce61bbf3-b716-493b-a265-d863f4c7b797", "value": 18131402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767477093, "uuid": "b5f9c9d1-49cd-4627-ba1b-abe2be1fdc8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767477093, "uuid": "7b35d528-4544-44f9-9063-00844da71873", "value": "updater.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975bb79e-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445406, "uuid": "d58b273c-448d-4cb2-b7d2-bec81499ee20", "comment": "Malware payload (Mirai)", "value": "bc665b1d68ff124fc335f8958eb6bb36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445406, "uuid": "0009f954-9b1e-4f3b-8862-b18bd554b57d", "comment": "Malware payload (Mirai)", "value": "abb34270409fbefe84d37f23a584e2fbb12f53dc65be2420ce5ace6ae6e457bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445406, "uuid": "9a72a3f6-57f2-4642-96b1-c9862e030f1d", "comment": "Malware payload (Mirai)", "value": "a1245473aeee70a2abdb030d8e661edb11927a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445406, "uuid": "5461a0cf-8730-42d7-98a1-883f5598b2c6", "comment": "Malware payload (Mirai)", "value": "b7acd463cc86fb1f08e3076a4f48ed4f65bcd815027b00ac384216dad972ba57bee3b3cd0d8dae6d4bff876d8cea078c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445406, "uuid": "a6ba689e-499c-46cd-8f87-d88ab6536c9a", "value": "T1C234C61E6E328F7DF7A8873447B78E24A75923D626E1D585D1BCD2001E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445406, "uuid": "a1a3f9a3-1bc8-463d-853e-e2c7a9ff50b9", "value": "6144:lKZxwEDInmgwG/ddYCB3/5AAzMoynbp/E0RbwRNIYx:AjwnJzMopIYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445406, "uuid": "cb813855-cfc6-4e4a-ad71-33e862cccb2e", "value": 252264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445406, "uuid": "23dd6fa8-5252-4777-b34d-fa026b04de39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445406, "uuid": "9c4f2aa9-10eb-416b-b4bd-8ba4576a7b73", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a40995b-e87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428177, "uuid": "c962c333-adf9-4024-8f17-23022b9c380a", "comment": "Malware payload (Mirai)", "value": "d684522d137374b8dff22dea74c174dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428177, "uuid": "11590ef7-d5e6-48ca-bdd0-67cd97fbd965", "comment": "Malware payload (Mirai)", "value": "ad130780723e131d21876368e0da5e93ec4fb50d94899d1145ec7c9c3e80bfe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428177, "uuid": "ee3edc63-b5e3-494c-968c-0317fc0d07bf", "comment": "Malware payload (Mirai)", "value": "9be5a9c0131a6d5c09e1f5872da00ab48382ef4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428177, "uuid": "2f5bd8e7-e49c-4f1f-8dd8-0f4929650005", "comment": "Malware payload (Mirai)", "value": "862decef4d41bbe2d867e94e84a559de0ff403ccd6dcd617a21872b69c01d98885054fbe9d3b92d75fbb7847fd146e16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428177, "uuid": "664f8b71-0b78-47bf-a49b-10ac4c8e2aef", "value": "T168144AC7F800DDBDF80BE77B44130919B530B7A210931B37625BBD67AD3A1A90967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428177, "uuid": "7494cfe5-5ee0-4a0b-8f03-b28812b24923", "value": "3072:5ux+C3AkAZ/vllY033Chi20BybLl3O32spVrg/TamVWDVwjbi9LV8UtyyZ/i:DwAkdYybZ3O32SVwDVWxLV1T/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428177, "uuid": "b107c028-9088-4d71-b92f-73629239f721", "value": 208096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428177, "uuid": "8a95469a-df63-4659-aab3-d6da1eca0f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428177, "uuid": "1dab6725-5976-4d20-97d2-6b5f6646484d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7108bb3d-e838-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767398956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398956, "uuid": "1564d907-56a5-4e4b-aa37-3f9409704105", "comment": "Malware payload (Mirai)", "value": "e88f9dbc49c0745792025d3cc188bf54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398956, "uuid": "addc2f57-5595-430c-91b4-56b331656694", "comment": "Malware payload (Mirai)", "value": "adc4b2d4eb4f192cfaedf9d508c0fbeff884f8b6283f8cafbf040e521edd873e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398956, "uuid": "69677053-d00b-4756-8c95-4f4a58654a32", "comment": "Malware payload (Mirai)", "value": "7f364553f15511bc826600d1e86e9c24f762ddf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398956, "uuid": "b246a916-2b2e-4f5d-a02a-809c78fa04db", "comment": "Malware payload (Mirai)", "value": "bb46745dd19e119fc62d2578467b9b10813803570cfc4092d53843d22e426a8e35c17eb68d86f3001d60a3c703b3d5bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398956, "uuid": "dfbd77f8-5d4c-438f-91cb-6e3e15f9babc", "value": "T138931982BC82CA6BCAD423B9B66E528D3362A3A5D2DF3617CC104B1577C955F0D27A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398956, "uuid": "0bcf10a1-6b27-48bd-bfd1-c4e9fb70f73b", "value": "1536:wKtnAvS5LzwSQ5P9QaVr2Eo37VDi8j2/8MFtFCImvTW80frOHrSwv2mBXPj:wCnAvSt0SQJuaOPfa8yWrffj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767398956, "uuid": "3e701a4a-e7d3-46b4-8c94-780f3bb4e4a2", "value": 90136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767398956, "uuid": "ba2e6483-6555-4682-873e-c98291e91293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398956, "uuid": "f0dba5c9-dfb0-41fc-8bcf-ba05e5c4c0bc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb61d988-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462673, "uuid": "4ec4a9ea-5d6c-4b67-bc89-d59da4fe7ebf", "comment": "Malware payload (Mirai)", "value": "54b6df8c4676a8a6fd37edff71db3cc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462673, "uuid": "3919be4f-9d3f-4ef6-979e-d9012b3eee24", "comment": "Malware payload (Mirai)", "value": "aec94ad751dd7663765756137c74bb35f8b3b8d2c9093b4012d4923480d86ed6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462673, "uuid": "6f5e76e1-de41-42ee-ae9d-5e050027c652", "comment": "Malware payload (Mirai)", "value": "883bb75c0a5dbd5de40a56a0ae04e24cabf3de57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462673, "uuid": "2faa7712-4360-4ea8-8e72-5c7690dc16c9", "comment": "Malware payload (Mirai)", "value": "212f53e942422725d1f66c4913a8f9fcf7d5a7e1adb14f18d5a42d90d7a1e9b6c43834fc19a2abc654d407a134b6ee64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462673, "uuid": "ca3be1a0-9277-464e-a1e1-3fd740454906", "value": "T12E539EA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656845FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462673, "uuid": "7dbaf93e-1352-4939-8698-1b13f754b70e", "value": "1536:K/ue90IlCalyZyuhx+vACs2z/SO/Sfs3zO/QSwtPlCXNi:KGejAGyZyuhxaz/Sjf+iYdtPlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462673, "uuid": "6de093f6-22f5-46db-92dc-134bb1335a04", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462673, "uuid": "30ffee7a-4b0a-4ba8-8576-393253f88117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462673, "uuid": "6f39b68b-6443-4e4a-98dd-5e67ce978d29", "value": "loligang.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c913842-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399888, "uuid": "837f559c-8a2c-4622-af0e-108cf8a38efb", "comment": "Malware payload (Mirai)", "value": "bc37d5f6ebd205dd06a8ff4c04513cca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399888, "uuid": "c20725c1-8bb0-48d2-b1bb-08c2c42e82a8", "comment": "Malware payload (Mirai)", "value": "b04b88e28648d7ebc942f342b89f3a7176bf8b2d0b02e66a3bf66d7cff5f9b40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399888, "uuid": "3ad656ab-9cb6-4a2d-861c-59284f1cdfdf", "comment": "Malware payload (Mirai)", "value": "97363f8048a8bda9733324243a4b2234fd0e895f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399888, "uuid": "0bbbb553-034b-4008-9fed-4db1ae176e9d", "comment": "Malware payload (Mirai)", "value": "c1694c1824321a4affeb9e44e33fe94a2536590f481cc1b138c88fbd12b07ca18fa21641afb4435b525e81c1d66aee0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399888, "uuid": "948aa252-647b-46dc-9f73-33829d5debca", "value": "T14B53B416BF260FB7EC5BCD3706B95B0524CDA50A21E93B393934D918B24B25B49F38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399888, "uuid": "38702d08-b33a-44a4-a7c4-402e63b45a3b", "value": "1536:wYTau8wLyQ7HdPvE58m4ZEkSYyxsWwKu:wtoyQT9U5IKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399888, "uuid": "6b2918bd-8aac-4200-b178-60383c39ace8", "value": 65008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399888, "uuid": "4aadc0ac-267e-4caa-92dc-bd4d72af567c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399888, "uuid": "de1afe0a-95b7-4d52-9d5b-d5e9255128b1", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720e2b77-e8ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767476696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476696, "uuid": "e31317a8-5330-42df-8145-893b10d20d96", "comment": "Malware payload", "value": "af2540b10556b3e33dfbdbe4ab79cb8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476696, "uuid": "ee741c02-fd34-4c54-a0ef-3f7922849f57", "comment": "Malware payload", "value": "b0578d86f48702830656f5aca8b9f868a0c06d0a797770368fe0e52a018524a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476696, "uuid": "6aece184-c343-4923-916b-cfd5d50cfba8", "comment": "Malware payload", "value": "70caad02fb65a12c7ebe91f228f8a9f79aad42d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767476696, "uuid": "d1ba045d-75ff-4a19-92c8-9b1d204a07a1", "comment": "Malware payload", "value": "cbb1acc7cf295aba9e772256e728b559fddf3742c0e67ac55bee61c1b5413384c994bb188fd60d7ea8206848d4f5d218", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476696, "uuid": "2e8868f8-178d-4ca2-8d74-b70fbbc10aa5", "value": "T1AFC119222FC138112BD757EBB46B79EADDA61E7128C054CAE754FDE0E259134CBD0138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476696, "uuid": "e8350c79-78dc-490a-827c-e54a8a8dd3c5", "value": "96:wW2GrBUIKp7qg+46rfqVV75UzTHTeYN/zsOo3Pu8ulmWRfFVH5GIlMMXsYidzJRw:z2iUIWezhrfqvizTHTeE/wOo3PysWRfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767476696, "uuid": "96cdcb04-b206-43a7-a901-65e558bfbeb2", "value": 5918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767476696, "uuid": "1d6b477e-c83d-4ebb-bf6f-8e5848701b15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767476696, "uuid": "a763ee83-8a34-43f1-96b5-d5b1003f0176", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b2482b-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399363, "uuid": "95a97547-fbcf-447f-b836-928334dc5e34", "comment": "Malware payload (Mirai)", "value": "d6cb59e0fbcdd333f85313a9cbdd2d50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399363, "uuid": "1bba94e9-46e2-49da-bd8a-bbaa8aa93acb", "comment": "Malware payload (Mirai)", "value": "b0ca202694f34d34fa70ed566256e9bd9c7fa65147f6063eec0e48d0c2821a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399363, "uuid": "1b9da43e-fe2b-4acd-8aec-e4602e70fba5", "comment": "Malware payload (Mirai)", "value": "4640d44689b341d6c78ad979e6921a3169f49c9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399363, "uuid": "72ae9fd9-ab97-48c8-bcde-6885e23ce726", "comment": "Malware payload (Mirai)", "value": "4fa82582e2905d13e6fe3d8618843146532cbef483c932932cf270c64164883be02735cba7dc3e2c8b2e3057574e0dee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399363, "uuid": "d91f4ea8-9172-4ee6-8500-3460bf7cc46d", "value": "T131836C13563D2B0AD0E4A47712B793A2B1E62B4D0194D65FFD720E5FEF223801E5B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399363, "uuid": "ceac88f2-2ea7-44be-a4b5-485588ddb41d", "value": "1536:QKXA6CsmAZZpGL4XEsHIIWExReHUHxZIzV5HOX4DKT+tmWmea+P8:QKXA6CVCxD9DIZJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399363, "uuid": "9b15c33a-f9d3-4cc2-bbd6-f069c336df5f", "value": 84516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399363, "uuid": "167f94d5-83af-4c75-9000-40746ef6ea77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399363, "uuid": "c17c0294-c840-4374-86e8-017ada74151b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda4d4e5-e838-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399191, "uuid": "e201f314-8a9c-4ada-a02b-44553f64bbaf", "comment": "Malware payload (Mirai)", "value": "fdf88bd38955364cc8d8ad3afe584fbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399191, "uuid": "777dad4b-77c7-41a4-bc62-798ffb84ba77", "comment": "Malware payload (Mirai)", "value": "b14e67b382db2f2c2b9dbc17b65cb6b8884e3aff39116da2c74a0029b2e0320d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399191, "uuid": "e2604485-4d6e-455f-bf48-e7031cb815ca", "comment": "Malware payload (Mirai)", "value": "e8cd2326e04afb3f0d5429ec654b174161006fc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399191, "uuid": "36771126-4bc2-47ce-aaca-f90020814469", "comment": "Malware payload (Mirai)", "value": "ad08562b24db535ee48c8184328013ebf6b91906ad13c6a5d1670f1983a07b56e1d27ebc498952aeaa6ba7202b31f338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399191, "uuid": "aa6fb150-e001-40f0-98a6-7d61cdf1899f", "value": "T152144AC7F800DDBDF80BE77A44130905F530B7A250924B37625BB967ED3A0A94977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399191, "uuid": "15516078-226f-48e5-bc32-37bd7429e134", "value": "3072:qEKsa0AH1kMIJMl/q4ebJwtd6v5nyWCw3TNqPIZpVrr/TVhVWwVwjbiYLD8DOyz9:MBH1foZyWv3TNqPI3VDbVWBLDWZvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399191, "uuid": "320d6a6f-78e9-4629-83c6-bdddc26e39c3", "value": 207968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399191, "uuid": "b99b5403-e35d-4a54-ba30-f89c7ea802db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399191, "uuid": "f1cee484-5bad-4771-a7ba-7a8f0860327a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d13e6f7-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400613, "uuid": "67603a02-b89a-4e21-a2cb-ac136bf5a71f", "comment": "Malware payload (Mirai)", "value": "34db37bbeaf731706e73ada214c8b80a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400613, "uuid": "63aca4c1-253d-496d-b611-3eb7cf17a780", "comment": "Malware payload (Mirai)", "value": "b1e8fdcb2699812ec5790767dbee11f3def6c6be26269e042cb6fbd9052463f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400613, "uuid": "f88bed87-92f4-47e7-9c43-6de5bca1301d", "comment": "Malware payload (Mirai)", "value": "3e10fc04a23002604c350266e1e7f229a3966b5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400613, "uuid": "0255ea2d-ec7d-4851-bd35-78ab413231db", "comment": "Malware payload (Mirai)", "value": "3e27dc41e5e831e2d624124c1f471ec62e3e2fc6e2a03f29db2a21f22f0c7db78bba87af52a2bfc71b13d81e6a8d6eb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400613, "uuid": "635b31bb-371e-4a8a-8ef9-51b94dcbf857", "value": "T16F43A409BF618EBBD85FCD3745AD4B4528DC820722A83B757974E428F25A14F4DD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400613, "uuid": "ad6f1df0-7b3e-487b-83c3-34d99b6708d3", "value": "1536:rW/CDnD5vlDLEtJso/qQ3oduyg9u4Vu+7RK:rW6DlvJEeuNVu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400613, "uuid": "e38c5226-0a83-45d0-85b1-56db9efd8ad8", "value": 59640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400613, "uuid": "f00f3ab9-e4a6-4f5c-b34b-4fb16b5d5cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400613, "uuid": "d49e06dc-a16d-41d3-acb3-990b49732207", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcd7fa2-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463432, "uuid": "2301de0e-a342-40b5-acfd-8a1ed0accc4a", "comment": "Malware payload (Mirai)", "value": "557bb910e73bf2a17f2ee47fd7b141f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463432, "uuid": "a2b3c7f7-9c26-489f-8094-e47428e3550e", "comment": "Malware payload (Mirai)", "value": "b2030dea9a18c2727fc87f25658c52e6157a49ff41ec3f1ba8efaaac745ab3c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463432, "uuid": "2b7eff78-cf45-43a1-ab69-ca830455eed9", "comment": "Malware payload (Mirai)", "value": "cc440d5f19dbdeedaf5a1773ba03ec16573146d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463432, "uuid": "d32da154-2705-4bce-9613-47955a27402b", "comment": "Malware payload (Mirai)", "value": "5fb25846d96ce19f7784137969a00663fa1c4521729af2f4e13f67f2fcd535030f1676ef1f7eb948e2154b4fb2cd2650", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463432, "uuid": "86347393-2dc3-409c-ad2f-65ada8302154", "value": "T15D730856B8814B12C5D5127AFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463432, "uuid": "0a2c6dfa-8311-4d39-92b0-27b5fb550cc9", "value": "1536:2ln25xPBXk1wnnkL7+KE007sXdEya6t0bIeiNNfsvHTGcV5GYIWQ3:7xpXCMkM/Yza4NfsvHqcVERh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463432, "uuid": "f44348b7-d04f-4a45-bdc7-9fe976ef4058", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463432, "uuid": "f4a452f4-c3ed-4dec-9800-06103aae3f7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463432, "uuid": "622b46fc-ff45-4b34-84b6-2562fa2b7220", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681048f1-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444467, "uuid": "4937f405-e140-4e7e-8bb0-d7bded4291af", "comment": "Malware payload (Mirai)", "value": "2743c95665e32e46f147c8dd3d5b43d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444467, "uuid": "821a51b6-3530-421d-a9bd-8d1edfcf70f9", "comment": "Malware payload (Mirai)", "value": "b213cc139e92292506c155aadc66cf0f18fa681c9a8390fe95c95527c4e05787", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444467, "uuid": "423dbc5f-9c11-4f66-9da9-dfd1e7cd624e", "comment": "Malware payload (Mirai)", "value": "5193887877f6ba07cc444ee7fb2e183648815f42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444467, "uuid": "46544eaa-f6be-47ee-b48b-44dd0c66e9df", "comment": "Malware payload (Mirai)", "value": "740cd9ea7709cb923c620183701d98089f5e4d0dd2ee4729b132e9fde57d928efc390461e12457813059ce5e27077a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444467, "uuid": "75ff110a-d33c-4508-9ac9-50fcf2a91f90", "value": "T132438C37D43AADA4D18885B8A9B18AB91F53B200D6571FBB5E85C4654043EBCFA0D3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444467, "uuid": "b81c01a9-7ad2-4f02-950f-d10c39936b4e", "value": "1536:qaxwtGSPHQ+gHJhhdORiJHUAaCenCY3uM7R:qC+PPCJhLORieAaCenluM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444467, "uuid": "be6e32ec-a27e-45c7-a3c5-bf08163f1f35", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444467, "uuid": "06279c06-cfb5-4061-9d70-59a8dc16c9b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444467, "uuid": "8b35d19b-7fce-4fd2-9b02-f16de5b398b3", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730ede81-e845-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1767404542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404542, "uuid": "24269fc6-8ec3-404f-8b57-391b07ecfb20", "comment": "Malware payload (Efimer)", "value": "6949f60e93d53d0460e9a75088bc2ce4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404542, "uuid": "c388bce6-9323-403e-8463-b24bc16fc282", "comment": "Malware payload (Efimer)", "value": "b221a7457713d1275725559d0681310433bdc40d94258e4fa75907fb9dbcfa27", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404542, "uuid": "f74128b0-d374-404c-8065-769b13a51dee", "comment": "Malware payload (Efimer)", "value": "5c6da6ad7054e97ca9a2eeb0c79085c45bc5996e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404542, "uuid": "696eb988-dbdb-40a1-842d-6ca5363c9385", "comment": "Malware payload (Efimer)", "value": "a175cd8abe15c581ae5bb1af1a41a14c16fce95b7160aa847acaca7bdcef03195521e191f89a1bdf486a50739834ec60", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404542, "uuid": "30269da5-6a42-46a0-946f-87fb30ef4f65", "value": "T114D6334C65E012FAF9B3817CEAA27681E1E4B87B1376C7EB4B5803965D531D04E3A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404542, "uuid": "1eaf0238-2112-44cc-9386-862034b055cd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404542, "uuid": "182a06e4-71a2-4f9f-8b2f-db70de341600", "value": "393216:Wa5zyXx62MVgTbLDWIjbXMCHWUj1cuI3/PkuUS:W+WX6VgPLDWSbXMb8CH/sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404542, "uuid": "ba942cae-f57d-49aa-aa9b-c2489c0fa6fb", "value": 12751959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404542, "uuid": "0fc837f3-5a65-4f0e-a675-3355aa633c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404542, "uuid": "2f8afd9c-2448-49c1-9eee-2b909c51b03a", "value": "zinfoz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e05a9f-e87d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428430, "uuid": "7ce54f8c-6733-4332-a7ce-d3569b834158", "comment": "Malware payload (Mirai)", "value": "3ed5a763ac666131083720f37fa14b32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428430, "uuid": "ba8c9186-ae50-44a1-af4b-bd951801ba63", "comment": "Malware payload (Mirai)", "value": "b27713a96c97823d643992baf752da7799b4d10634b3c7521371c0d80194157f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428430, "uuid": "22cfa465-2215-431b-870d-13e25a32456d", "comment": "Malware payload (Mirai)", "value": "2cef31d0bc48a7c98dfc582b26ff6aad459ab3c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428430, "uuid": "126636f8-5c15-4cac-ba67-386425588af9", "comment": "Malware payload (Mirai)", "value": "5827d77465339516226daeabf04628e7925e90d1c218b0219760a1dec74e968fa0a42a23522682a160199c7304ac6313", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428430, "uuid": "a4598e3f-eae9-48a5-83a6-45a651ec7250", "value": "T185519FCA12524F316CEFD92F77B988887084A5FBB4C6DF24D9DE78AE448DE0DB041646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428430, "uuid": "82175f9b-aafd-45bf-8413-fb240bea8543", "value": "48:iDO8DviDtitGD8wD/qDpmDR7qDaMD5+lLD2uXJDbaD0QDIMxDEIDjl3:ifOB9+McDyLr61Hxdd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428430, "uuid": "e60aaa0a-068f-4108-84f7-befdc167b0a8", "value": 2584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428430, "uuid": "f2f9347b-adcd-4979-be8b-a3a5b74a8d63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428430, "uuid": "4c50d52b-fec3-41bf-ac4c-a62879fca115", "value": "syslogs.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7b8314-e8df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767470622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470622, "uuid": "20e9d156-faa8-4fd6-88f7-8926825bbc22", "comment": "Malware payload", "value": "b7668c3fe777172746265034d06e514e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470622, "uuid": "53807f82-c0d6-4106-8419-44e77c6963a3", "comment": "Malware payload", "value": "b335b5eeaf8ea4f275a66c22322e2f35a36707979aa430ea3dadc29564f3ba09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470622, "uuid": "2ddd338f-096a-4a03-9dac-724e01fcac9b", "comment": "Malware payload", "value": "e70590b847cf7794cf3bec171b39e0cab875028e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470622, "uuid": "cbd9005d-f1c3-418d-9db5-bbbb0401c8ee", "comment": "Malware payload", "value": "be5e58717454d1707d8b1320e6ab0d8fa4ade3d2f3d56101a0ed51a494360640e68dac60d815ec03b70c0837dae913ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470622, "uuid": "6f1289d5-0743-4db3-bf39-8e019f70e455", "value": "T1CB94CF12F3103AA7E10A9135588143046B84AE7573E2D302FF97B6B9656F1B58F387BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470622, "uuid": "330a3e67-780f-41ae-8286-68cb7bcd0af3", "value": "12288:pmuaTRyn8yMqGE0Ct3ZnZ54ow3XL2yrjsSyZem0zAjQC:pMyM9stpP4LN+ev8jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767470622, "uuid": "57802ccd-5940-4a2c-8aab-58c6ccf06359", "value": 432288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767470622, "uuid": "c237c38e-8d94-4f88-85ae-6dc48bfc730b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470622, "uuid": "24305ae8-73d9-4b71-a62c-b74aff3c14d1", "value": "rondo.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6136a6e4-e8b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767453475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453475, "uuid": "305b4525-27d5-40bb-8507-1a3cdf6d064b", "comment": "Malware payload (Mirai)", "value": "7ab44619f1e24947cd34816a102d3177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453475, "uuid": "2fb434c3-7340-4363-a60c-fe911260bbe3", "comment": "Malware payload (Mirai)", "value": "b3e1dda9c5d56b080583d7322cfa3cbe06398d6732300411f3431c8b68cc32d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453475, "uuid": "02f04ee9-8109-418e-92a8-d9b318af3fcd", "comment": "Malware payload (Mirai)", "value": "277f6405160e4b8735bce65b96e3fdaeba0d28b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453475, "uuid": "79d4b95e-1064-4c97-b769-b32cf8209d71", "comment": "Malware payload (Mirai)", "value": "a5ff8e91a1d69ce60fa25cf279762b6fc36117b58d03aae4b7342c70547375659fe924d172157e8947ac6a50efeca482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453475, "uuid": "8e80cb35-3824-403c-ad20-50a41167b45f", "value": "T1E8633951BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453475, "uuid": "03fc668b-cbdd-46c0-8379-88db58a6d2c8", "value": "1536:iNSlxAmiik110lOO//kWUjioisI3AA8PNRu5AvbWl:iN/Cbkd2oisI3/+VbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767453475, "uuid": "f114eaa6-233d-4091-ba37-435069e46fae", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767453475, "uuid": "9d97e324-682a-4d06-867c-50caff913869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453475, "uuid": "f3a516e9-3954-4b04-ae40-86221ff0e5bc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef3891d-e881-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430520, "uuid": "41a0ac68-eb39-41e8-b6a0-fd5022b74255", "comment": "Malware payload (Mirai)", "value": "c090732cfd9e953c0e1d3a3c2ae31685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430520, "uuid": "2c634ce7-f4b8-4c18-8df2-cadc09277b96", "comment": "Malware payload (Mirai)", "value": "b658c18a86c127cd5b79feef1ce9e0d0f50ad0e39221d4b3937b581eeb681685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430520, "uuid": "dfd21d3e-fe92-45dd-82c4-9547aca3b968", "comment": "Malware payload (Mirai)", "value": "57c236062fdb0c36b808ffde1f358af069f8c31c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430520, "uuid": "1c42a060-993b-486a-9640-1f842598cfd7", "comment": "Malware payload (Mirai)", "value": "bc2485a30c922b50ca0fa4cee33c96eb5b5a23af17f542f3c6719fe1b024404f04b3b92aca8e2efc3788aaa5b90361b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430520, "uuid": "06f5d7b5-1dd4-4c07-92d8-504e958e5342", "value": "T10D536D4272184A57D2A60AB02D3F1BF193BEA9A021F4B3C9750FAB5D8571E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430520, "uuid": "e191f885-d898-4c1f-94b3-bc64d2a79601", "value": "1536:1YYbbwRexDZFn8mbFk8k05O5kFmFqMu+7R0h:vNDT8E65kFsu+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430520, "uuid": "0d83161e-7673-40ff-98fe-36c6e54cab43", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430520, "uuid": "543070b4-692c-4de4-beb5-39e088049d40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430520, "uuid": "17effd1e-c873-41c2-80c8-84a478804a00", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db992f59-e8e3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767472578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472578, "uuid": "5a679b6c-e080-4750-b091-c6cdb52aeac0", "comment": "Malware payload", "value": "6029f3b9fabfcad4a4dc26389c0a61ed", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472578, "uuid": "89ec7274-028e-4e7e-b1a1-4b2e15dc5f86", "comment": "Malware payload", "value": "b65f1d036ca6102748cfb25a1aed8a80eb7ed7e4a262d9dabbb0ec3979d3768c", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472578, "uuid": "d445fd6a-c004-434c-b9a0-4943d9f6c787", "comment": "Malware payload", "value": "1e489539039345ec36e7f1d65be1327a37e0d7c4", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472578, "uuid": "fab9da53-d546-4e4f-9d3b-ba2ee38c5e7d", "comment": "Malware payload", "value": "6ed99da4d905fdada2586337b9dd72fc44be73dda2ed33da85d6197a8fe9e79ec0a0b66d56c3187e7e6874ae24ae174a", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472578, "uuid": "1920d1c8-841f-4cf0-ad1d-2a979f7b8313", "value": "T1BA3729017B79D0EAE9A386FD5D950DE0E1B27B64173E2CAF283452498F429620F6CD37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472578, "uuid": "4d273aa9-8c17-4004-92b8-5980256f9549", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472578, "uuid": "08fd52fa-7fc0-41a7-9f9f-4072895a1256", "value": "393216:+/bxfNdtCpTs9YnEDuMmgk/cPu0CjpQbNZH05TeI4t9ftg9KUcaNafijr4/zZk3N:+/bxfNdtCpTs9YnEDuMmgk/cPu0CjpQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767472578, "uuid": "de2aba43-9cf4-4405-890f-be671e57b303", "value": 23609344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767472578, "uuid": "e88e6cf1-b9be-451d-a3a3-bd34b26ad34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472578, "uuid": "3a619963-e171-4c46-9ae9-eee1f8aeb6d7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d518661-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462488, "uuid": "2baada50-2049-4297-a775-6aafb19e906d", "comment": "Malware payload (Mirai)", "value": "2dcd74c493469dba2031f71162b371ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462488, "uuid": "c5d99a8f-1a23-42e5-9a7f-9150c65897ab", "comment": "Malware payload (Mirai)", "value": "b70b8f1842c9d82d4d388a548b7d30dee160d2beaf3a0db6269023260048aa71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462488, "uuid": "8519d89b-95fc-44ad-a5e8-10a32862387f", "comment": "Malware payload (Mirai)", "value": "5a10f10c18b9dd2da9cf5647c0a5353b14531cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462488, "uuid": "636324a4-8498-4245-a0e9-97dbdd428e74", "comment": "Malware payload (Mirai)", "value": "ed8fccdb6b33eea72a4e4a678f31234882ca58d026a8f37064e51e4d86a9420064aea206474f71f2e4a953eb3529e0bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462488, "uuid": "cb5a066a-45dd-4e3d-9fa7-a0ac2ae13a19", "value": "T173831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462488, "uuid": "2b54c933-3aca-490e-9d9e-9b6f47213c06", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8Jyi:gJTyHknWt/+L4qjmugd9mrsplDKZUlQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462488, "uuid": "9b95b985-c0b5-4d1b-a7db-7fc3b52a6736", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462488, "uuid": "70657e64-7c07-40ec-8fce-436960cf1af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462488, "uuid": "fa354b46-c087-43a9-a9b6-288bedbb9129", "value": "loligang.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40432073-e8c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458574, "uuid": "d5631d7c-6e73-4471-81b3-900fac184281", "comment": "Malware payload", "value": "a4824ec034c2e576a9fcc7d1e1ee129e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458574, "uuid": "f93319bc-786f-4430-a9d3-2b2fbbb20556", "comment": "Malware payload", "value": "b7998b50d1dbd772b8cfc787175ed8bdb94abff53429799d87a682a1ecf3b5b1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458574, "uuid": "16930a0f-4b9f-4803-84e3-57f481186bf3", "comment": "Malware payload", "value": "d01c5265efad76c5e213269ff841aaf4688b98eb", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458574, "uuid": "4b6a1870-f93e-42d3-9f09-180baff93b55", "comment": "Malware payload", "value": "7e06ff7465b0d504194312fde25031855f9d596bcbd3f2934383fa7195ff9bc035907b1ed35d68bbdeffc38e875e78f6", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458574, "uuid": "b76b55c0-3efd-475f-9c9f-aa110d1b515e", "value": "T10DC08C318024013CEE5DEA4AE1A0F99EC4AA6098E3B729A1A8208A9C0A102218305024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458574, "uuid": "b4bc7dcc-e60d-41c1-8329-05714f854490", "value": "3:VSJJFIGFGMF17Nf/sWvER6fXKZ4XQRwJAFBALTZHpAUFIjyOGGiTZHpAUYE:s8GFGMFn3sl6faZ4ARwrLTFpAcKzqpA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458574, "uuid": "f60f7eaf-7198-4cd6-b308-815cde086596", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458574, "uuid": "1c4b25c7-d415-45f1-a380-0d645c6b4076", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458574, "uuid": "d3173182-a9be-47e2-9cce-3a66ed5153e3", "value": "file01.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fa95b0-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443204, "uuid": "b35d8754-1f97-4d50-8680-2f3fee3cf3ca", "comment": "Malware payload (Mirai)", "value": "1da515c8c24161b44cdfe86b28136fc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443204, "uuid": "7cfad1e4-3ef9-4175-b474-85663a86e3e7", "comment": "Malware payload (Mirai)", "value": "b7b97417bdd37c5781d6d71f0664539714869085611b4747691ada9213b54206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443204, "uuid": "b49d74e4-0fdd-433e-883f-119a1d49d6dc", "comment": "Malware payload (Mirai)", "value": "a33c4dbda89cc424c3de9ba8a98687308f28ec6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443204, "uuid": "f618c641-8ba6-4dfa-9fa7-8541e87af386", "comment": "Malware payload (Mirai)", "value": "a109ea10b335c436b5dd2e84f87321f5ea076c21a7aa9ad5cea366fdcf3401395a828bdc3a14c4bfd75247dbb0dae17d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443204, "uuid": "4d98f2d9-8f51-466b-af09-e42ab563611f", "value": "T182338D66D5BADD98C18846B5E8308EB82F63B205C2531FBF1A9595695043EECFA0C3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443204, "uuid": "b1f9b08b-ed90-46fc-bc46-24f894ab1fda", "value": "1536:LauwtlnxmS/kpDisFdhKJ8jDU6SwMC6nuM7R:LBSxL0isvhKJ8M6SwMPuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443204, "uuid": "56027120-5560-48c3-95a4-0761a29c72a8", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443204, "uuid": "86057999-52ef-4845-9c8f-0ce7c1472acc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443204, "uuid": "2a7126da-af76-40b2-a4dd-14317cfb63ec", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d63f7f4-e894-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767438302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438302, "uuid": "0fbd2c2c-2b1a-48e5-9458-50abc8a47486", "comment": "Malware payload", "value": "62f3f886066983c809f36da066b369d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438302, "uuid": "dc23a9ed-c420-4bb4-b3fd-12d343002ecd", "comment": "Malware payload", "value": "b80696214ba426d7359e7cc237cec93923b1bc01bc9fef7f52a6311d871ebda2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438302, "uuid": "da6c1e79-de2f-4c4c-a4aa-acc69fafc6fa", "comment": "Malware payload", "value": "a91ba7f33d5773b7e5dbe726b8eb021007e58656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438302, "uuid": "d6e468b0-45fe-400c-8954-16b5cb0b0390", "comment": "Malware payload", "value": "6008324659c23f08cb0484f9e3a7de17aa6728c550e45cb2c7d24073e25e059e0e478039fe0f01c72129ff697c3cd099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438302, "uuid": "1a672e0f-147d-4fca-9e59-18cc1375a38a", "value": "T1670723C75EAE4399C0870E30688603DD34C4B1D988EF896D39CF9C0A7A56D5E89CD7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438302, "uuid": "673ab5ff-777b-4c77-8389-05cd9ea44c4d", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438302, "uuid": "6bf8dc15-b96d-4876-be75-be916143f345", "value": "393216:XNN8i6zbceZiwmCUlJj9OkrnCnjCRjMBxf2z:XIDzbPHilJ5dnCORYBd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767438302, "uuid": "d35ee623-bded-49ad-9be4-6bf79c79937e", "value": 17619968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767438302, "uuid": "37405f66-6da1-44fd-b836-12d5bfccec2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438302, "uuid": "d038ba6e-72c7-4882-a57e-edf057e1307d", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bc527c-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444685, "uuid": "40a89bcb-21a9-4fff-a284-d11441d88ac4", "comment": "Malware payload (Mirai)", "value": "8137158ec8bb92b832ea03a94ac463b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444685, "uuid": "2565d235-f136-46da-ac06-ef1409421154", "comment": "Malware payload (Mirai)", "value": "b8a196da57dbd7e5310c4e6206438207c2011559456da3624d1f8bbec839f3c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444685, "uuid": "75b95ed3-4f99-416f-838f-1157cf22e0f3", "comment": "Malware payload (Mirai)", "value": "21837e6cbff43c25c4059c4da8fc54ad6d0591ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444685, "uuid": "fda1f5de-c801-424f-bf36-3f6cba7826d0", "comment": "Malware payload (Mirai)", "value": "dba36f2f5b2fecdfd2587a7afee1ccda3dafc70094f96e82e3b3f16ab54fb900384da34df3cc88b435067ce7967090e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444685, "uuid": "7f8a834c-5f01-4a61-adf7-792b2a2acc87", "value": "T1CFE37EC5F743E4F5E91601712177AB36AB72E03E203ADA83C7B96E33EC52941C54A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444685, "uuid": "7376d6d2-cf18-4fa1-af92-81a8fef695f0", "value": "3072:Zii3IxIjqHMBZLo97k/xpGGtSMrODCNVjzbt3/VxZn6NfxY7BwbZnuv:Yi3IxIjqHYu97+jt1rOs3dP69wBwRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444685, "uuid": "23ea0b02-14d2-445f-ad71-97f14d1ecb14", "value": 150152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444685, "uuid": "2644a816-39fc-4f29-8622-31953bd95056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444685, "uuid": "8096cb77-c55d-45f0-ae08-c8fb73ee3f42", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c9ed71-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429560, "uuid": "0c45c596-38b6-4059-9bd7-5c20bdd1a498", "comment": "Malware payload (Mirai)", "value": "c067b78061233704dae27379db6f913e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429560, "uuid": "86475620-d1d0-4549-87d6-5b478fb7d92a", "comment": "Malware payload (Mirai)", "value": "b9da8de25acea0a37a905d664cefd554cf858adb8204f4f904d2df7650df3700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429560, "uuid": "c6b76858-b378-4849-bac0-2068fb9f9bb8", "comment": "Malware payload (Mirai)", "value": "72eb2024cc3f3fe3b4e31c102e2a66c40aa6a27d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429560, "uuid": "1d551777-0c3b-4bd0-98a0-3699552d908d", "comment": "Malware payload (Mirai)", "value": "789f050082010ae97bd9f7fb858408db101f329d7ee9b104c10471abcd76739f9ca62b3167040f641ec88d10449601a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429560, "uuid": "0464ab56-7fe5-4ae2-87b5-5469ca2800a9", "value": "T162533B86D401CF7DFD8AE67AC4130F04F534635166821F27A6A6FC936D731A9492AF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429560, "uuid": "97aa96ba-0d02-4e9e-b85e-beacc4cd911a", "value": "1536:EMFmpnsYNbTXLyrY7tNNB9Eb7lmI4f9zPLfq8WEDP2:EImp3fyrYjNcbJmVzzfJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429560, "uuid": "6c132ac8-f4ec-40e5-9510-0d81b772d967", "value": 66364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429560, "uuid": "19031a2e-b65a-4fab-abee-71a951a24a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429560, "uuid": "6b10e65f-ac7c-4315-91c7-2cb3c9aed108", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9563ea1f-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465159, "uuid": "4e0627d8-ad1b-46a4-9b6d-6fd8baf35ac4", "comment": "Malware payload (Mirai)", "value": "eca8184d3ba98e8988e4c381bc362197", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465159, "uuid": "98ca6339-5580-49f6-8b37-f27e74f47e09", "comment": "Malware payload (Mirai)", "value": "ba4e4c7e3d58a7315e2a9c92713157371a0b0ae776201f7d8e09c104114c88d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465159, "uuid": "2bc1241e-459d-4082-be2c-48f1fd9860e7", "comment": "Malware payload (Mirai)", "value": "b29ac50cc6c64ecb400e4063f3956580af632542", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465159, "uuid": "6f2d5165-d9dd-49d2-b9a5-50c2bd534371", "comment": "Malware payload (Mirai)", "value": "dcb96811ac019d4b91f3cb5265fe13cca1b93f57b8872cfecf8b1d24d8654be6f7c46049a9c8fe9a18592db8dd17f03f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465159, "uuid": "bf6bfa05-0ce7-4635-9974-972b69fb947f", "value": "T10EB33966F8819A11C5C356BBFA1E418D73130BB8D3EB72169E146F31238B96B0F7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465159, "uuid": "fd6f007b-2b7d-4b58-b5c0-f8b9a4686f34", "value": "1536:sNnorAcLpIc1DA3f7NOX3PoE/I5MdBaWdqaFxhd+iAGEEwb79WYZZ5M:hAsVu3fSACIudBaWOGEEwbBW0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465159, "uuid": "cd7f6a6c-64c3-4c91-81ba-abba45127d24", "value": 111824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465159, "uuid": "efd0aedb-813a-4b8b-9709-06c8e1e1f351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465159, "uuid": "d333b50a-bee0-4a6b-a0a1-7ad3ef2de121", "value": "arm6.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53536ae-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431255, "uuid": "a0b07eae-ad91-4d5f-984b-4180e760832c", "comment": "Malware payload (Mirai)", "value": "aea2319b88bd9ab3c588db1e6296ee7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431255, "uuid": "ba196bde-6228-4f11-b186-c8883185446a", "comment": "Malware payload (Mirai)", "value": "bb05419198786c13bb8f9ce9f061bf8b88c72156d142707ed9547f6658e66535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431255, "uuid": "1f984e5e-90f6-4f63-addd-61021c700f78", "comment": "Malware payload (Mirai)", "value": "51cd1b739ed02cab7992f6e924c07089e123da5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431255, "uuid": "ca8a5a23-500f-4ebc-a92f-52a2539aca33", "comment": "Malware payload (Mirai)", "value": "081e58c5302606f56516e0877a0d01cdc6781ed2d68c233cf562e365c2e426052d9acb2bc6e4989e9bb2b7cc5f422a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431255, "uuid": "aa7b9018-a1ee-4ebb-85f3-f7c1ef644b90", "value": "T11C131AC9AE83C8F5DC0A09751577E73157F5D93A1078FA9BEB98D935AC12702B20A34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431255, "uuid": "1c2ec4c6-d21e-40da-a24d-126e1ccf7b96", "value": "768:ez+l/Cpi/uWC+DBV3e91goGX6GdI5dirWDtl0nxR:ezO/9/hVDru91xpGdI5dmytl6xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431255, "uuid": "14fbe397-f916-41c1-a4dd-731f09a20727", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431255, "uuid": "206db003-14e8-4461-be0a-fb415aceb574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431255, "uuid": "521409e2-b7e7-4e42-97ec-a20e3d5190e7", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ecd2f2-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431257, "uuid": "28c0ad58-ea7d-411b-a899-8a34ce0dc82e", "comment": "Malware payload (Mirai)", "value": "3201d0f2135e6ef7bffa880e7fd895df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431257, "uuid": "bf68198c-5510-483c-af9a-159c8401a38c", "comment": "Malware payload (Mirai)", "value": "bb4665fa85799e9df24ebdb6d4579eaf9156d5fe6f86df9b1141112cd3742e2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431257, "uuid": "b913caaa-f0ee-4f08-afff-7228f9b72e2a", "comment": "Malware payload (Mirai)", "value": "86bf5c5451878b8b5fe921a181973184585429fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431257, "uuid": "b10715f5-a150-4422-b6fb-7a84bd31ab7a", "comment": "Malware payload (Mirai)", "value": "a31afe42ef28b51091587392570a80eb60bc4c3a2c10be107eaab42aa0f414c77c27abade668ff1c9be9c128de0a8739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431257, "uuid": "04c9dfd3-27fe-472a-84b8-fe448c6329fd", "value": "T19D531845BC81DA17CAD462BBFA1E42CC332653E8E1DE72079D116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431257, "uuid": "1f0ce5ad-6d9f-4e91-b9d3-42a6591bfcf2", "value": "768:gMLtf0Bd2xQMGWoIUXYphdE2eR9nwNx/WFxeIhVS8KemNsUh6BLx4ueMbZu+7R:L5fSd2CXYze9Tnwn+neIHKYUWxDu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431257, "uuid": "71e13f21-fbeb-4a56-9cc5-d3cf835e7856", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431257, "uuid": "754b334f-a94a-46b4-a1db-1010a392a278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431257, "uuid": "f77ef4f3-5e54-401f-af80-86dce4ccd0c3", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30104c24-e887-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432777, "uuid": "4a781d12-8f4d-41c9-a757-ad0f91157762", "comment": "Malware payload (Mirai)", "value": "7610074f47b21d105432f9debf551496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432777, "uuid": "2ce9d1de-92f2-402a-85d1-db907d284271", "comment": "Malware payload (Mirai)", "value": "bb9c63186545479af020fd4463c45e0c3b5904632901ac36a1ade6ccef678fc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432777, "uuid": "86cb0de8-d0ce-4fb8-82e9-2fdb4f1ad8ef", "comment": "Malware payload (Mirai)", "value": "5abd1467aee68d7cd96707124443587556b2a943", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432777, "uuid": "56f3dab3-ea99-42af-b855-2b39816154eb", "comment": "Malware payload (Mirai)", "value": "4f7696b46b0217a9358cd68c5279319bac29ed30b9d17f82658e25172e84f7710dbcc6d7837ba9f0412f7f54c3e15e8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432777, "uuid": "3ac1b6e2-73e3-46b2-b036-d581611c7df4", "value": "T1F873B505BF654FBBEC5FCD3749B94B04288D560A31A83B7A7930E418F25B24F59E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432777, "uuid": "12e89fe2-d8c6-4cb8-b170-6e9d4d8636da", "value": "1536:t4Tj0v0bsGSpH9YZ7f5EFq7FyhHR+iip3jblFuM7R:tQ0QsGSNGZFE6flFuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432777, "uuid": "f941b16b-477a-4e8b-b9e4-019a40f27f63", "value": 77940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432777, "uuid": "8926b1c2-9858-4a4f-aba1-152978866ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432777, "uuid": "64b5fb46-295a-4550-b9d5-9805ab09a607", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21528917-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432323, "uuid": "a9b2eeec-c19b-4f86-bbd8-6a5f2fbbe653", "comment": "Malware payload (Mirai)", "value": "56b75e524a02a1dd2bf344a105c4c82b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432323, "uuid": "f03565ef-2f6a-43d5-86f0-50e5e1d7b0d5", "comment": "Malware payload (Mirai)", "value": "bd1aa1fbf4c942da27cfd4ed2b70b960dd18668c690675c43747b332d21d1252", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432323, "uuid": "fce8cf81-073f-4c88-87d8-92a6cf5ca8fc", "comment": "Malware payload (Mirai)", "value": "bad477739ed0898db25864f5c1a0b1a05f44f349", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432323, "uuid": "31514dcf-75c9-471c-83d5-845eda7137b9", "comment": "Malware payload (Mirai)", "value": "8682489e66aa66acff99ba93dfb048c9c2fca701f29513a6fdf9421250f8a2981d4c8fdcda41c7cb38dd3ab4a3008eb0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432323, "uuid": "2eca096a-cad4-4fe1-a48f-9092ac94c0df", "value": "T1CE61A9F7A2C247306EA95972A3A8D544BC85E1F3B9962E345CF924FFE48CE043344957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432323, "uuid": "9f26f46b-3d95-452b-bab3-45c6c016aa7e", "value": "96:ih0Thzghahh1uhpmhOvhgbhZULh8xhboh3IhGR3hODhD/:a09zoa71mp+OpgFZe8rbQ3wGRROND/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432323, "uuid": "5c15d898-badc-49a9-851e-f77a99f139bc", "value": 3197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432323, "uuid": "68388693-527b-4d72-9364-70344c07caa8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432323, "uuid": "87888d89-facc-4923-b883-1152e673a3d7", "value": "newreaxe.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8af679-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443210, "uuid": "bc5a659c-39a7-4da3-89b7-b4aaea9fe4be", "comment": "Malware payload (Mirai)", "value": "ff1786eeeaa95e21aaed3c4eee73cf43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443210, "uuid": "59996d2c-ac02-4466-baf2-89dd3016bb81", "comment": "Malware payload (Mirai)", "value": "bd4cec3184bc623d3971e46b054535a8619e39ba40c0d78ef0e98b68c993db05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443210, "uuid": "c2779494-f1cd-4762-94bd-b6a3633404e5", "comment": "Malware payload (Mirai)", "value": "b1f397f4fd312bba3b060474e23d90f57bc3a4c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443210, "uuid": "4eabd252-dd6c-4c1e-8a97-3fbfe7838000", "comment": "Malware payload (Mirai)", "value": "2287a664ba52e7f0d7fb7a5e34446f160c0b7a8108bea89329ce6c7bd19a650ed4237a7fdd7ae5eec12d8f7f7540b41c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443210, "uuid": "547f9ffe-d7d3-45aa-9b46-e7cf15b4e03f", "value": "T118530845BC91DA16CAD462BBFA1E42CC332653E8E1DE7203DD11AF15778A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443210, "uuid": "aab7922c-2d7e-451a-8f54-a3e12e134603", "value": "768:Msgv1xy/gBgCUfa3rRBObPBELcWwYxsEvRh29BJDmN7VMBBwjQcupoceu+7R:MvnyxErRUFScfKs+hujQVXjoku+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443210, "uuid": "643a9e15-711c-46ab-bc88-af33627fe6ab", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443210, "uuid": "6d50da51-0584-481e-bdfd-e0d118f5787b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443210, "uuid": "ad9af88c-1d34-4632-b745-c7fc798cbb53", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e47375c-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446276, "uuid": "16a61737-ee87-4faf-bbe1-ee96be2fe909", "comment": "Malware payload (Mirai)", "value": "29c26650e23945c7e76dbf02377772e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446276, "uuid": "bb19c7a3-36f1-4ab2-bf83-6b49cb9b7ccf", "comment": "Malware payload (Mirai)", "value": "bd6fee094950726984ee573166dccc669bd8639849967d12e288622fe4a63ba2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446276, "uuid": "b631614a-ea2e-4c18-8c14-d77bd1b5fbd1", "comment": "Malware payload (Mirai)", "value": "f17ad9e29d9e15a7e5fe9e3073eac42b8d06f111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446276, "uuid": "567fc95c-a64e-4033-bcb7-9263816aa6ec", "comment": "Malware payload (Mirai)", "value": "8368421de0b7eba699cd7cc8c0ea40e71196fee69a0506b4476aa00b085902bf75fe585e984ae0876181afecdd6bb7b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446276, "uuid": "2a28947e-7e48-4d4b-a762-5a7f65207d3c", "value": "T19063E846B9818A26C5D512BFFA2E51CD33276778E3DF73129D106F147B8A82B0E3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446276, "uuid": "fd823fcd-98fe-44da-bcd5-de52b7b8fb8f", "value": "1536:aRnoLB6viUByuPqgHhSsoEeHwe6L6nRiVhEmPyIAiOTpd/LK6uM7RI:FoimSuhSjEeHwe6enRiVATpd/LK6uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446276, "uuid": "f75a0563-0a01-4a68-b746-4ff337e5716a", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446276, "uuid": "47949948-5275-4ff0-b80b-d2d2be52620d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446276, "uuid": "c59c6cd9-4c50-4188-86a7-4a1f907119d9", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72587d23-e8a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767446632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446632, "uuid": "ab193fc6-0016-4558-a100-693fa5211aea", "comment": "Malware payload", "value": "b98514510a290c93782850bd4d04d35b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446632, "uuid": "eec30cf2-cc64-41a7-bb14-852ccf4b058f", "comment": "Malware payload", "value": "bda2f5dd37709aa74776e822e0349c6988f0c8135f296d060298c9cd9e235ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446632, "uuid": "93e70a94-3aec-46ca-a29c-d36709f380ec", "comment": "Malware payload", "value": "d72234c60d968bc5f00fe727a717f382a1dc7e42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446632, "uuid": "0b313122-b7bd-4f74-adf7-6cc2c6705e31", "comment": "Malware payload", "value": "59c2f3921fce5ed5a47af103c6d929bc6973cc3ee1b9f23137814097dffb54a6ae6863b597371e86b509b80b54045985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446632, "uuid": "941fa239-521d-46f1-a3fc-96e1b832a125", "value": "T17D53C416BF240FBBEC5BCD3709B51B0524CDA50A21E93B393934D918F65B25B89E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446632, "uuid": "0dd780fc-2cc9-4413-a45b-74eea9ad64a2", "value": "1536:yxt+sQMQeTD3dJ4wVHc5yWcFMAq8bJ0a46u:ybQeTbJEa86u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446632, "uuid": "e9a26e74-ff66-4489-88cd-c85620868b20", "value": 64980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446632, "uuid": "f6dc352d-032a-40df-8853-e2dd6b8a8ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446632, "uuid": "dfefa8d6-fe88-454d-8dbe-42b9a8d4f2f1", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087fe952-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400069, "uuid": "37940c9e-4266-4b18-b6ba-9f124489ff13", "comment": "Malware payload (Mirai)", "value": "6ca7679879cb41a20451a948e752a4c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400069, "uuid": "c8361126-4691-4ccc-b9d1-6b965ae8fa4d", "comment": "Malware payload (Mirai)", "value": "be73be3f7d5cf799b090def087ad8f0fcbc81c7e0054c3670c245eb0e5145e90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400069, "uuid": "9d8c17cd-eb7f-4733-abf1-0dbaf7a87f01", "comment": "Malware payload (Mirai)", "value": "2877c6d220516a3b3cae4ec86a22bb25587b775c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400069, "uuid": "41ad148f-a7ae-4809-b6ad-f2ddf8a516d8", "comment": "Malware payload (Mirai)", "value": "1c35faf11792bf2a75b0f4fdd3ada718924694c472c21fa588232456f1fc92d1a68b7a3b5fe168312be6b42fd21c769f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400069, "uuid": "c37d329a-6f6a-4ed8-a456-d0b1a1b1a974", "value": "T1E3530845BC82D616CAD462BBFA1E42CC332653E8E2DE7207DD116F15778A82F0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400069, "uuid": "af7d63b9-7145-4800-9793-06fd4f69c2de", "value": "1536:vHxnCpy88n9Rc257b+hg/EaauUP6Zu+7R:vHxnvCd95Pgu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400069, "uuid": "f27b9a37-8a9f-40b4-96bd-7a1e88d659ed", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400069, "uuid": "7f84513a-cdfb-47d9-9621-02361e199afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400069, "uuid": "d306f4a2-f776-4cc4-ae8d-7dead3ba0727", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f81b11-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427639, "uuid": "7959177b-f19e-49da-967e-8ac86a7eca2d", "comment": "Malware payload (Mirai)", "value": "3c5df8504fada4b4c21241a2dd02ffe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427639, "uuid": "e9c62bde-111f-4cef-b8b1-357be2b7d146", "comment": "Malware payload (Mirai)", "value": "be75c260aeccf547b86153c51e6bf463f941f77e459da41992660e2e6de3a467", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427639, "uuid": "91ce7db8-a1ca-4206-99a9-620870e86eb3", "comment": "Malware payload (Mirai)", "value": "8dbe79ad7810cd4d02ae3cf1781090fa3dd897ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427639, "uuid": "7e9be7de-4622-4a87-b2f4-8563d4428c08", "comment": "Malware payload (Mirai)", "value": "2d4d5645316ee53104d77a18f2ad50fb4f34d7dae7bca6b47ea4a044ce76083a9ac115d23e2a2e276ac6a42bb3e33dd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427639, "uuid": "d55f64c8-cf68-4a24-948a-6fad144f92ad", "value": "T13E534BC5BA53D8F4EC1905B52477FB335731F5311028FA8FDBA5E936AC52602B60A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427639, "uuid": "46959898-6bf4-4f54-b9d9-584b41616b41", "value": "1536:laco7oJyLAh3hQei6+b+8JxtSX4TMPvXaNUTQv7eHy2xRD:lacqoyLApho6+i0HSX4TMPvqN1vaS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427639, "uuid": "940ddd9d-829c-407c-b69e-ea36de28aa5f", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427639, "uuid": "f695bf79-d49b-4dcf-94cd-08795f60715c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427639, "uuid": "50a49ed8-a1ac-46df-b6dc-2834c4e34f9d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22521b6-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459597, "uuid": "96938a7b-ea46-4d75-ae6a-5916c5ad6812", "comment": "Malware payload (Mirai)", "value": "0cd061f2d4dc486e53a1ba6eb880cde7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459597, "uuid": "1e80d367-cd97-4570-9c6e-a10d98250016", "comment": "Malware payload (Mirai)", "value": "bfdd21011b1a1a458d61d2fa9080c0292e888d1b5da2c9be96b8476d3fe2863e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459597, "uuid": "733e5916-f395-4dcd-ba80-1dea53233c33", "comment": "Malware payload (Mirai)", "value": "303e192ca98dd6ed67e19150a6c6a865abb59274", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459597, "uuid": "69c2fe98-693e-4fa7-9ce2-4629df87c131", "comment": "Malware payload (Mirai)", "value": "cd963b4eb483a389f8069aa72566a139f14d576ef56f1409a4528ac4d21465395a15b12a0c788880f12adf1f16c314e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459597, "uuid": "433ab09d-c2b5-4045-8a14-f007dde1e17b", "value": "T182936C02B7180E43E1636DB47E3F27C1D3EADD9112F4A648240EBB49D072A326697E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459597, "uuid": "f3d2e198-f0c0-43ac-a780-dbe38f04f180", "value": "1536:GszBf5GiNk+bvD7knVnf5s0PSSJBL2AyaRleyHZIq2KoCK12:PjGiNlvPkn5f5s06SLRcyRy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459597, "uuid": "7b13ea81-5c1b-490d-a87d-317f549d9688", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459597, "uuid": "60848d13-37ed-4329-b531-478bb1bc5e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459597, "uuid": "dc499bde-1ad0-47d1-9725-a8e1007a4d51", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7156e5-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444337, "uuid": "e8487771-8b4d-4a2a-972b-fe26cdcd72f6", "comment": "Malware payload (Mirai)", "value": "d93438c6942a6400f7059e307610a52e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444337, "uuid": "fca619c5-acfd-42c4-be73-f51c813482cf", "comment": "Malware payload (Mirai)", "value": "c032e9f56b5d29ee163ed7d38192ea934d577d5c0dc991ca6392ae6c0af0f667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444337, "uuid": "d5342d55-0dd3-48c6-ac27-3f09672556be", "comment": "Malware payload (Mirai)", "value": "b74a46881aef4943c9464631d6ea26fbc7ef2398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444337, "uuid": "58be8552-eb10-4f0e-8fd5-cf9afc0499e7", "comment": "Malware payload (Mirai)", "value": "d434d61f16c724c89fe7a17e90000bba5b4fa6547098c7b79ffaa2e19150fccb5c2790e6b1f29c2cc927770520057c6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444337, "uuid": "55072cb1-7d6e-441c-8fb3-dd96c7f92660", "value": "T181144B02B5C084FEC4DAC1744BFFB13AE971B05E1238B19B67C4AF226E4DE605B6D694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444337, "uuid": "52bf3900-fba9-42d0-8f8f-4fd6a4b40ef2", "value": "6144:nmmMLPfkl797IG+yAn3BKR2XASuMBZNwR5:VCHlK2AsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444337, "uuid": "be19f6d2-f8e7-493b-97a7-69f65e6554d2", "value": 197832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444337, "uuid": "51999297-ede2-47cb-b893-3644dd60fdf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444337, "uuid": "1656a02b-8685-4364-9c97-de3e39194e14", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab67283f-e880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429977, "uuid": "7a39c884-87ac-49c3-9a61-63a6c1d94dd1", "comment": "Malware payload (Mirai)", "value": "bb2cdf69b1b44596fe9e522a7932d9c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429977, "uuid": "83d38a76-4a1a-41c8-9f85-384ea2deded5", "comment": "Malware payload (Mirai)", "value": "c06d5157addc4b6ac89cae001486a6f52f25476b9deaaca9048fb376aec295cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429977, "uuid": "e646f453-6df1-4636-8eea-b97a5e0f7565", "comment": "Malware payload (Mirai)", "value": "a48fcbbe4fb76b96cc52eebc3ed931edae8058f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429977, "uuid": "036d41e2-790e-4270-9740-cdeb68beea0e", "comment": "Malware payload (Mirai)", "value": "949d9a53cda5b2f0271c8c1f724500e316464becc3cfffe624ca109c2f49e7c73de8cd6205b5f5aa4507c992384bd5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429977, "uuid": "ba4979e2-0d8a-4f90-bf1f-bf34cdd15903", "value": "T13B7302ACAD8222CED93C4DBB53E914804C747A911C416EEE67525CC2D69C52BF31E4FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429977, "uuid": "3be69488-4870-4502-9bbd-10a7963adbff", "value": "1536:M4gG6KJ5TvBUkYYapZmN71p7v6Nz4pMi5n5DvBv+nGAatSmX6D:37X5NpYjZmN71p7v6NIMiJRBztPXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429977, "uuid": "fb38c6ad-409a-4a79-91dd-dd5288232635", "value": 80028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429977, "uuid": "36d7523a-7c8d-4866-a59c-34df317713cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429977, "uuid": "8281f496-97ac-43c7-b163-06fa384ff8ee", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabd03de-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462672, "uuid": "b427527a-96d6-45d3-8175-3f42440aa5db", "comment": "Malware payload (Mirai)", "value": "60b270d50f76c67078691e4048648484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462672, "uuid": "7b9f3d4c-45eb-408e-b008-eb4a3134296e", "comment": "Malware payload (Mirai)", "value": "c084b05d689f3d6f308e32da040436b565f244c1a1d01b93b3c131aba8c45e35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462672, "uuid": "3def5b97-858f-4929-8e33-b21b3bdbb084", "comment": "Malware payload (Mirai)", "value": "44c518327d80baa3540bda385ee234c3c29101a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462672, "uuid": "ed380a40-dee6-442e-9c52-c701caee7038", "comment": "Malware payload (Mirai)", "value": "4bdea44f31e4444c4e9a82ae3b5b4cf3d7c39d1503fc1454b3120c5cd694cef2daad7d2c99eca453e39eb0a583ab7f8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462672, "uuid": "a6c980b7-3819-40ad-80f3-485c015a3504", "value": "T1035329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462672, "uuid": "af24c59f-1be2-4ad7-8490-f0fe9a791f4a", "value": "1536:IEX9170vwHbQXZ5+qXDEuXH95TSW7V/DjObeFt6PuQ4Z2:d917iwHbQXZ5+qXAA99SWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462672, "uuid": "1e5ebde5-b4de-42e7-a95c-55de89483df0", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462672, "uuid": "370a8e0e-148f-46b4-804b-56bb92f05235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462672, "uuid": "037974d4-82d4-41c0-9808-4acf2b2c79e5", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3bbeb8-e87d-11f0-a129-42010a9c0007", "comment": "Malware payload (DattoRMM)", "timestamp": 1767428714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428714, "uuid": "854de0b5-86f9-48d3-8054-49d1e1ac669a", "comment": "Malware payload (DattoRMM)", "value": "29315275ab0a9a394292c358c7ff552b", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428714, "uuid": "f4a64485-06c1-46dd-b2b7-61bd09cf28dc", "comment": "Malware payload (DattoRMM)", "value": "c0b00a225a122bdf4b95b7b5962233aef5db67c570f7c39626f35b6ca16170b0", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428714, "uuid": "e2eae08c-2364-4b3d-b51f-4b7a4e26aae4", "comment": "Malware payload (DattoRMM)", "value": "efc33b39cf027164e4e263cedb1ee8f271afe416", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428714, "uuid": "15500d73-cf83-434e-92d6-c95397ce098a", "comment": "Malware payload (DattoRMM)", "value": "fd11c9acce475e931be9fccf571d382b71fa1594b4e537c962fe2778aea3f2528d8ce6fe6a86da25b9a7ab931632d53a", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428714, "uuid": "d17ab39b-0fc4-4dd5-ae1d-be2cdc35a4b0", "value": "T10FB63313D57BCCF0CB234678D6E10A46BB4A058A9C5AB8D4E584633E55D34ADEF38B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428714, "uuid": "172166af-fb20-464f-b3c0-0b5504eeee67", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428714, "uuid": "0be97b22-47bc-453e-9b58-60475eb903eb", "value": "196608:4aZk+wC0rsRTjTtR43PG8PZHj2BPFOsti7A95R8jsFp29XaIT030Hy05s6r8Ar8t:SnC04RT9R4PkE7Ap84p29qIT0Z6rXr8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428714, "uuid": "73dfdb07-c7ae-4a56-9f67-82e8127b0f6d", "value": 11055728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428714, "uuid": "c3c68e09-be6a-48e4-b9aa-4b881cfbda7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428714, "uuid": "66d97eed-72a0-4c29-8a2c-beb786e58059", "value": "DHL420964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfce28b-e88a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767434329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434329, "uuid": "335be63a-d62c-45e0-b9bd-31008353b08b", "comment": "Malware payload (Mirai)", "value": "1abf48b8e947f3224ed9c408ed262b2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434329, "uuid": "f879fd0a-94cb-418e-9d8c-8215805309e7", "comment": "Malware payload (Mirai)", "value": "c16f2c82c7b9de64f004ef3b2f2a53060de48dbee3b72f0e0af5f6b81184a2ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434329, "uuid": "414d18cd-7083-41a8-aeb9-6492e1f3d831", "comment": "Malware payload (Mirai)", "value": "729f97caf875310ea1f7a27cf341ea77cc7ad1c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434329, "uuid": "32654d2b-b340-49bf-9e79-e5732c937b8e", "comment": "Malware payload (Mirai)", "value": "35984dbe264af31e19ef77c5bc73ab55f5adfaa92acc178dd9fadd4a920b52f94fb3a3bada779b3c18e4c1f8b5be92e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434329, "uuid": "ec5d3fd2-33c4-4c87-90c2-5d50ef979bea", "value": "T1AD056C1AB2E3B4FCD157C53043ABCAA3A935B43502216E7B65C4D6313E1BE701B1EB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434329, "uuid": "1be98dfe-1c9c-41f7-88c0-b619a4ba9173", "value": "12288:n5xk/iD0004sm+D/VkH9VOMoU6yv5/vQWLi8ALjmk1/tYQedzuFlHiJywj7IfpHX:n5aqW4sFkH90ah/YWub1/t0z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767434329, "uuid": "a7479389-8d9d-41ad-8a65-26a83c34ea69", "value": 835920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767434329, "uuid": "b79e2d01-93e9-4280-8b0b-017b21f5ab7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434329, "uuid": "7dfd61d5-e76c-4976-a919-d17dde51b46e", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c856f2-e8d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767467064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467064, "uuid": "cf4065f6-e8be-4107-b000-fc62a65592de", "comment": "Malware payload (Gafgyt)", "value": "c22b41c19c51cc0495eb19ea78c7a5a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467064, "uuid": "1ed57e0f-adfa-403d-bf54-bf665028b668", "comment": "Malware payload (Gafgyt)", "value": "c1c4f1c5aac0226e55dc5a531b7a5072a387ddcb0366278f719aa44701e22435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467064, "uuid": "7d92e7ed-010c-4494-a383-6ecd63a4561e", "comment": "Malware payload (Gafgyt)", "value": "d5b0aeaa32e00432dbebc6e67649b48f71068755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467064, "uuid": "736010a5-8206-4858-9e9a-8dcfa7e8ff01", "comment": "Malware payload (Gafgyt)", "value": "9f721eed864d2ecf13074cbfbf81fe448fd4e5b5445eb31f4d919102d928f50689fd0b814af0194dd1a6a2349fea6542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467064, "uuid": "32137906-1312-4e25-9f03-574ebdb75fdb", "value": "T18EE32A56E7808B13C4D22B75B7DB824533239B64E3DB33099628BBF43F8279A4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467064, "uuid": "7910cf77-86be-45a2-a779-9ca4f644ca63", "value": "3072:PsLB0aFWjAXuZycVlkuIuMjvPMM/90SoNm3wMcN/mnn:0t0aFWjAeZVkulMjvkM/9om3wMcZmnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767467064, "uuid": "42e45c3a-5caa-4701-9ef5-8c7104bbe562", "value": 149380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767467064, "uuid": "d0293f6d-817b-4a7c-9b01-64148b5fa85e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467064, "uuid": "68f04585-3613-4f42-b2ea-8f491eb49528", "value": "frost.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb6a259-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400428, "uuid": "59e8b3b3-62a7-4103-a7bb-c996519e1090", "comment": "Malware payload (Mirai)", "value": "c3620c6018060d8e47a26a88292d3df2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400428, "uuid": "434d8b16-c747-41a2-80e9-c7111a7a8aee", "comment": "Malware payload (Mirai)", "value": "c1dbd18aee8f94b0b34a8caf7cc1fd246b06c3a2e81c31b22c4b4aa3467d335f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400428, "uuid": "5278f471-21ed-4e5c-8213-bbe39b4cdc86", "comment": "Malware payload (Mirai)", "value": "7524e0e92e53fd76fc6d65d534d103cbfff5ae1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400428, "uuid": "f47d8b9d-38e9-4f4a-bf4b-e514f9769617", "comment": "Malware payload (Mirai)", "value": "fb3efd430d286501110128206cad249a9627ebba8e8827c9632c13244500e39e6a693dc40d0570ceb27ac3db966278e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400428, "uuid": "5fa57977-afc6-4e72-8b14-838c7b0a5ab5", "value": "T11283C6097F614FB7EC5FDD3709B95B0428CC950A22A83B357974E818F28B64F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400428, "uuid": "a900d535-495a-4966-b83b-43f6ec8cce11", "value": "1536:LsFh89HG2QU4I7UUei5q1kJdbZi6Iga+07jqQqSu+7R:Lshkm2QA7LTqMq8Su+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400428, "uuid": "5e91f4b0-57e4-4afe-a0aa-388031df9fef", "value": 87864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400428, "uuid": "f5895889-fcb3-471f-9ba0-cb0072bef9b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400428, "uuid": "8890f17b-b070-42b9-a3d3-f699d2ccfc9e", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9fb949-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427694, "uuid": "d202574c-43bd-4f43-8674-8b1f606b00c7", "comment": "Malware payload (Mirai)", "value": "7f66c2cf452863d63d55f130180555b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427694, "uuid": "2993d731-0b1e-40b4-b15e-c17aa555d89d", "comment": "Malware payload (Mirai)", "value": "c1f0af45ab5a9737c7297aa6fbcc4150073871479c6a86cf1fd431f56e60372a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427694, "uuid": "56b7f43b-d3ad-4f8b-8536-95062e03de8f", "comment": "Malware payload (Mirai)", "value": "8bfaf139fedbda372623c7b9eed4e3e6f109ced6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427694, "uuid": "5b5bc659-62be-40af-b01c-9302157598ee", "comment": "Malware payload (Mirai)", "value": "a12b0b38a0f3e23d1964d5899f4d5e6b892d2cb0d8478368035aea11bd2b302d74b6db986d4057f8befee21bb96f5378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427694, "uuid": "18a29312-d418-4cc0-878e-040773f1a80a", "value": "T198F35C81FA8BC0F6D8174D306167F33FCA32A5258077DA5DEF999F36CA23542961628C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427694, "uuid": "ac0691b4-bb17-4c40-bda4-f4bd555feb4b", "value": "3072:svYdOtJXyJI9585HI07eDDMYpFPHPBrj9UXhW1rLog9TOgp:iZyC95MHI0aDDMYpF9kSrLpDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427694, "uuid": "fe59f7a2-c82a-4b44-909c-328ca957def3", "value": 159400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427694, "uuid": "e6004180-8a40-4510-81cd-f30e09d0a820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427694, "uuid": "19178de3-5147-4d82-96b6-615c1e387162", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b492fc0-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429279, "uuid": "347f8bcb-d877-4c0d-b426-a8554ffd76df", "comment": "Malware payload (Mirai)", "value": "679ba31aafab4a0560d94c95d15b4e11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429279, "uuid": "95f4c07d-7eb9-47c3-900a-84b31eec2109", "comment": "Malware payload (Mirai)", "value": "c28d0b54399ba2d3c615d71db6fd072aef323a1071d81a4b7281a94a18dde340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429279, "uuid": "93332496-d687-44c0-a5d8-bc4ba5ffdb47", "comment": "Malware payload (Mirai)", "value": "b1efe299063a44b777db118fb8ca99bfc9399db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429279, "uuid": "e47dc3c5-37fb-4c68-969c-59dacd3a589b", "comment": "Malware payload (Mirai)", "value": "83fc9c670ade8abc2394b5ee88308d164e459ee195e00958d7c368b65686d309e1fbdda80b1b417dc3e0031d757e5f44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429279, "uuid": "89f72c24-2ef6-4428-840c-e9d175e3a5cb", "value": "T1577302BECEAF6EACCB1191B40C0569A5C152BB3B9C425FBE4BE1E1E824D15631702736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429279, "uuid": "8c183831-28ac-405f-b1b3-6e37a2ac19cc", "value": "1536:w31t6Kt1CMmIwxG4cgw7fQoFR1DEZZveQyrKUmyTXed:wSKkxZhw7fvDEZxeshgOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429279, "uuid": "acae1e35-559f-4916-bded-1d9291cd5e2b", "value": 74284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429279, "uuid": "c9ffd2a2-0e99-490e-9dbd-6016803f1122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429279, "uuid": "d70546ff-7af0-4c86-890e-1546c69a0dc3", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a6c491-e83d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401156, "uuid": "50652ef2-7bcc-4fe2-8166-4060e88d0377", "comment": "Malware payload (Mirai)", "value": "6de2a4398c83f5a60a8a261e14d5f4f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401156, "uuid": "3690a140-59ef-4632-84e6-cad44b5533cc", "comment": "Malware payload (Mirai)", "value": "c2bde30bd9c006356ffe98004652b3646c5854790e9caa0dca64aecf04a3d040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401156, "uuid": "f3b32c07-b594-476c-a052-4203bae5bc9c", "comment": "Malware payload (Mirai)", "value": "283a029e85774b34d076a806380f707e526cc5e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401156, "uuid": "09a3bd69-169c-4940-ba7d-2b25bd697a4d", "comment": "Malware payload (Mirai)", "value": "c259fbcd591d599881b89f31f97af6a9f084c0736c0f93b4ee2e0154f85eda2fef3ab2a68243da33cb4c129495b42e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401156, "uuid": "b4e72988-d679-42ef-ab93-6c9b86c2816e", "value": "T16CF36D06B7C080FFD489C37C82DEA636E8B1B81D1235B65E6790EF157D99E20372D685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401156, "uuid": "f471723e-c937-4774-8cb0-a09872fb7296", "value": "3072:Oyl+CKa76Kvs3GpZ0psfKi1yacIO2YR3Y222222222222222M2D22222226222YY:OywkNpv0oNkIWY222222222222222M2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401156, "uuid": "f8d070a2-bdd7-42c5-a813-023e07163098", "value": 165680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401156, "uuid": "27e15351-6b93-459b-aacd-b8a73bd9e485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401156, "uuid": "5a629f36-f46d-4ab2-bcf7-fca0ca7bcc6f", "value": "x86_64.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a55eedd-e89a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767441116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767441116, "uuid": "a408d037-653c-4796-9fbb-ac17204902bb", "comment": "Malware payload", "value": "512e76d8416a587bda3ca4f9b45d2c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767441116, "uuid": "845a8575-ee56-49d9-9fa8-0f5bf1665f45", "comment": "Malware payload", "value": "c35ae65953d751abb1946b7dacd6c399b643cc83d6005df2b90bd12592341feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767441116, "uuid": "b551e16d-5ab6-4f28-9bf0-85665ad8b2f2", "comment": "Malware payload", "value": "9d74907350e086027fcca91e44a5e595a71ba26e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767441116, "uuid": "ea944c85-0040-4324-b160-017677eff898", "comment": "Malware payload", "value": "75b660a2249a2127a12238a424ed10015553fd0eb502ceb2e39c4539d07bc02779cee79eabb92142d8daf6b1b89b778f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767441116, "uuid": "5b418eeb-8094-4424-bec8-7961257cdb63", "value": "T1C106B0BC76047DE6A66F577BDA96ADDC03B626239ACBA4CD4064B7C30563335FE02804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767441116, "uuid": "d51ac55f-90e4-43a6-800d-0824d12e95ad", "value": "b0054bd918e7b591ccdca9561e30028b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767441116, "uuid": "b121684c-40f0-4ecf-bf46-8540d8f16c10", "value": "24576:Ldf5vftG/biemZ7Zta+w1Eu1c5oy1FEx1YgC7CBv9eWBlSKL9BV6MFwwUBu/HjJW:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767441116, "uuid": "652fb994-44c6-49df-a236-f2f10553b38e", "value": 3914752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767441116, "uuid": "9cfb629c-d805-4936-907c-f1ee233510be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767441116, "uuid": "d07d7c7e-1912-4fb6-84bb-8873dcc467a6", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790d308b-e83b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400258, "uuid": "55aeba60-045a-4bdb-bfe4-76edbd063873", "comment": "Malware payload (Mirai)", "value": "e140fd20da46ec6e89de06e98b458f00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400258, "uuid": "7e45320c-2628-47ed-8003-7d856cea8bbf", "comment": "Malware payload (Mirai)", "value": "c39e7d9cf0455384ecbf374c103ef19b583913f956dc5b8e76dc8a825ef59aad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400258, "uuid": "139fd74c-328e-425a-95ac-a4c8365e7d57", "comment": "Malware payload (Mirai)", "value": "b40c629224679b9fcd761ca67d097cf80a8483bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400258, "uuid": "0d3ccd35-28d8-4736-9d1f-9a229abe87e4", "comment": "Malware payload (Mirai)", "value": "5196bfd20904e9071a6cb1a2b23d1930d75599ae275207b6da134b57451de8fa8c082821335759b0ab339184c91b6605", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400258, "uuid": "3ec47546-e3b7-45cd-9a32-672ca8bb02ea", "value": "T104D35C22B97E5A2BC4C0507751F74736E1F2634960B84A0F3D731E8CBF6569022B77AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400258, "uuid": "dca1041d-9882-4c0f-b8da-b28bc470f561", "value": "3072:BNZMO5WPjScDjhXkcmiJ1a1ClhMU4DkwWz+NtFX2ss/Mrk:jZMBQDl34hUrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400258, "uuid": "e7b3a7f7-fe48-4f6f-9cff-8ba9f8fe3f5c", "value": 132248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400258, "uuid": "8f2b15de-20e0-4905-83e1-5b49b63b1d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400258, "uuid": "6e06db41-6f72-4d87-b8e2-0f248f1e142e", "value": "rondo.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b6d3d9-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444106, "uuid": "5dd84361-fa5e-4db5-b55a-fb29fcfdd206", "comment": "Malware payload (Mirai)", "value": "f177c53edd2a01c5caa8af240aacae6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444106, "uuid": "6603bc76-c249-4b3d-b14f-1aa9c9ddb663", "comment": "Malware payload (Mirai)", "value": "c3bb7d9d57087b7bbc6b6d7fe9b6d0fbb827209f5cb3d4e8f75363e69dda8cfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444106, "uuid": "c2c11acb-c186-4778-b494-b796dfe91bca", "comment": "Malware payload (Mirai)", "value": "d126bf430d3c8aa46540154b57985bcf0c1e2798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444106, "uuid": "56ffec31-4ab2-40e3-8eb6-601a99835184", "comment": "Malware payload (Mirai)", "value": "a8fe761f0a35ca689abbdef70b03048e47d9d2ad47fb84f68af7aec083c3c14872ce8de069c81b5cf2de7acd07997dc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444106, "uuid": "fe1b3310-60cc-48e2-9548-dcd2f762d74e", "value": "T1BA63E64AFD819F15D5D565BAFF0E528D33135BA8E3FA72029E146F2467CA82B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444106, "uuid": "35fdce14-2820-43bf-92af-256d77f53dbc", "value": "1536:Z9nz+KVquo3wrQsX4/xHwemoCWidQixK0Mm73sglF9lLoicLNt5HX9u+7Rz:H+KkuoEQEYHwemoCWi+KK0Mm73s4Kt59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444106, "uuid": "bc199fc5-ba69-4f11-a3f8-22f74126f949", "value": 67552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444106, "uuid": "fd93ad70-9c75-4f58-8fa6-1d3c4779f04f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444106, "uuid": "40d3b40b-d2dd-4bff-9e4a-9163065d6d95", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c09a9f8-e8d5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767466459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466459, "uuid": "cd9f7fbc-70b0-4923-8613-d0b4cdbcc21c", "comment": "Malware payload", "value": "b7219857e8e1305def7a814ad27f5fb5", "object_relation": "md5", "Tag": [ { "name": "Conspiracy", "colour": "#244559", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466459, "uuid": "074fa2e6-9b8f-41bc-a571-3fff6e8d9d97", "comment": "Malware payload", "value": "c3d568da2c0055824bfc629de90970014fe15164693f7acc478dc7e06891516f", "object_relation": "sha256", "Tag": [ { "name": "Conspiracy", "colour": "#244559", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466459, "uuid": "7416a28c-ece3-4945-80c7-0b1248802a6b", "comment": "Malware payload", "value": "b41ee7cf66e7cfbc19764c1ca5bbddcc6141e0bb", "object_relation": "sha1", "Tag": [ { "name": "Conspiracy", "colour": "#244559", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466459, "uuid": "72df7766-1009-449e-a0f4-cd16745d68b0", "comment": "Malware payload", "value": "62c796abc5a8492e3bf8fb364045b94b93afcd418586d4ddf970095e9d6cbe6ee85773a7ba273e404694d856d41c7147", "object_relation": "sha3-384", "Tag": [ { "name": "Conspiracy", "colour": "#244559", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "linked", "colour": "#0DEA95", "exportable": true, "hide_tag": false }, { "name": "unknow", "colour": "#03E3FD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466459, "uuid": "a17bb835-cba8-45a4-b0e7-f23d0f214291", "value": "T1963612AD6184379CC01EC0309927FC48A3B6591E17FAB5EEF1DBBB84679B421D602F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466459, "uuid": "d7d99c9a-ebcd-43f9-9f7e-9809bf642541", "value": "0fc5c1d21aadbda444db1620a3f6dbff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466459, "uuid": "ac0141a6-e27d-4245-ac21-a0b0b0c00fb2", "value": "98304:sns9/Q1iGYfrDmf3lDe6s+ZDJeea1TPj5TicSaONd7pPka0gR:CcMVCvIl5DJennSF/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767466459, "uuid": "f4227f2a-fbfe-40e6-aaa8-3ea0ba2d6f93", "value": 5093376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767466459, "uuid": "2d30a718-b8dd-4a77-886b-4be36356f9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466459, "uuid": "19fa24f3-9263-4c57-bdc7-6ec04d3f78d7", "value": "conspiracy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a1affe-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454118, "uuid": "41fdf5ed-97fb-4346-bed9-d137d3039264", "comment": "Malware payload", "value": "48534fe7d5e9672aca363ea1440be724", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454118, "uuid": "7e63f142-6803-4850-acc8-08969f3a91d7", "comment": "Malware payload", "value": "c428e77e96b9de385e31bb580906220283f70087542ea8561095aa1a656d8f17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454118, "uuid": "acbcd9c6-d3c5-40ec-a64f-7cd377cd298f", "comment": "Malware payload", "value": "e8b0c23fefa81bd81b3d1df79d8d21ce78313777", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454118, "uuid": "3ea25b6f-2043-46c4-9d86-67796184d3f6", "comment": "Malware payload", "value": "b7a9ea5ea3288fc4855db0396bc8a2e6419d36c27d9b164f898979e8a2bcfb57b78a3ff9bb511168cf12b1dfc2303e7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454118, "uuid": "52232087-e6ee-4f9a-b565-7833694f449a", "value": "T13E04E04C6892DB04C23A68CA02E6EAD224DBEB511F5E58D7D21F13653BE9D50F3E710C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454118, "uuid": "46d68ee3-eca6-4482-9935-00bc18c8ab47", "value": "3072:Hg9JRTRrmbAS9SOqQ8tuAMusnK5M0QVcrGH853x5TVkWRJCVC4tFK:A9vTQAS9SOqQ8t/MueK5WusyiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454118, "uuid": "c92a7a61-6040-43f7-bd6d-c5d98a9b7b57", "value": 180316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454118, "uuid": "20280b03-073f-4a8e-9d0b-f09ef8edfeb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454118, "uuid": "9af58c9a-6957-4631-9c37-f9bc3201826b", "value": "Bhd3k6VKNF6m8E.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca04f83a-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462670, "uuid": "9e1373cd-df0f-4bd7-bd2b-e2c91562569e", "comment": "Malware payload (Mirai)", "value": "1fd4a6833733aea7a907f5781150a854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462670, "uuid": "e746bf86-0f78-46a8-91ee-a657d8ce2f58", "comment": "Malware payload (Mirai)", "value": "c43de02f680718741ad14dc19938c26b571dfff2b331728b4cc31687c8584e9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462670, "uuid": "46c772ad-23e5-4353-9be2-0ace9f6d80d0", "comment": "Malware payload (Mirai)", "value": "6779defeb0f46d4ece9bc717b26edb3b0a68c281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462670, "uuid": "5fcdc0e4-ca64-4a9b-9f4d-675719aab5ed", "comment": "Malware payload (Mirai)", "value": "45b00392775bf58b92f5c958187c1e491305ac9930acbf473815c8434e4948a26a61e1be2c2d0ba4deafea12d042a871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462670, "uuid": "aa4ff6ab-778b-496d-bb48-6e28d691e84a", "value": "T159530A817C91AA29C7D0177BEAAF108E3354ABD9D0DB7347CC044B917ACA90B0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462670, "uuid": "61244694-abce-496d-8028-a18c439ef5cb", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yv7k6YceZWGzDjMH:dOxkyRWiPkjX0Q7kVcwLcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462670, "uuid": "86b1991a-f364-4ced-9247-1a1c0b7d25a1", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462670, "uuid": "03bc9cb7-277a-4cf8-9ab0-f208888899a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462670, "uuid": "1dc86633-10da-4037-a9f1-542a3bee6491", "value": "loligang.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dd31a0-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430822, "uuid": "6821aa47-f0b5-4f38-9483-a8411431d746", "comment": "Malware payload (Mirai)", "value": "1c30f428184ed88460bf7aecf870691d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430822, "uuid": "2e11a623-6566-4327-85cb-c759f02dddcc", "comment": "Malware payload (Mirai)", "value": "c482728d1bdd26395a34ea6374c25d8aea1ea62541a4080ef63e30035ca1a58e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430822, "uuid": "bf0fdff6-2564-4099-9ebf-d41dc5cac352", "comment": "Malware payload (Mirai)", "value": "a6040e1db07c6da1745d8ae11da0e76c81819fab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430822, "uuid": "63a1429b-6c4d-4a34-a77d-63101dc8e4b1", "comment": "Malware payload (Mirai)", "value": "8a30740c1f714d961b2861dd30a349cd6d51c6772ca32efa9093796c022b93671444ae85b82e5dfe11511c8626e34246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430822, "uuid": "b80b71f5-2f20-4081-83ee-f6bab9f21a3c", "value": "T164533B86D401CF7DFD8AE67AC4130F04F534635166821F27A6A6FC936D731A9492AF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430822, "uuid": "80ffc0fa-843e-43e5-b934-2207b5fa7e32", "value": "1536:EMFmpnsYNbTXLyVY7tNNB9Eb7lmI4f9zPLfq8WEDP2:EImp3fyVYjNcbJmVzzfJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430822, "uuid": "b4a060f8-aedf-4662-a176-8a994a203621", "value": 66364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430822, "uuid": "f1c855ef-40ac-44ca-a697-1ed3deb08482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430822, "uuid": "ae1c9643-cb7b-4cd3-b57a-6e96a85685af", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bea81c5-e84d-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1767407913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767407913, "uuid": "34bd3f26-c175-4907-8c97-64ee1a1f6139", "comment": "Malware payload (ValleyRAT)", "value": "850574c080e8b1aaf2a25c253351166f", "object_relation": "md5", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767407913, "uuid": "9c9fd12f-5e23-4a23-a95b-496b206016de", "comment": "Malware payload (ValleyRAT)", "value": "c4b2356d0c8a5aa5814f40d04dc0052b759c58604e64d2fb04376b17858425ad", "object_relation": "sha256", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767407913, "uuid": "f6c196fe-7654-43d4-a9d4-516a8a78ac3c", "comment": "Malware payload (ValleyRAT)", "value": "d17ed7f0f12a6473c3ce2e5d5bacd007bdfa7b7f", "object_relation": "sha1", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767407913, "uuid": "5ab1c147-7ae6-4e46-b8f5-5a84934e6a87", "comment": "Malware payload (ValleyRAT)", "value": "80317cae6ff1fd341db9b8f890e08237276dd1e8d2a91beb48db31bb36d9288a0759d5f7dd79d6c25ebd5a60ed4817e4", "object_relation": "sha3-384", "Tag": [ { "name": "23-133-4-6", "colour": "#CEED3E", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767407913, "uuid": "23e3d291-c0aa-4f2d-8b3d-e72b3157de4d", "value": "T12EB48E16B7E102F5E077D139CA568E86FAB2B8194720E74B03E4D6B52F23360567F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767407913, "uuid": "7a8fd2e0-cb0b-46b9-801d-6661516115bf", "value": "b0b04c61d6f1a51f45164f313f9a5e7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767407913, "uuid": "0b992b80-2318-4d3e-b05b-29202a3c3ddd", "value": "6144:I6uufpyzyj6unWguzOMjaxJSj3NHP5ytmhZ8IVkgvoX9YySADc:I1ufpx6BNqM2xIj3x5P8CkFX9Y8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767407913, "uuid": "8c875066-38d6-428b-8b51-c492481bfbc2", "value": 493728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767407913, "uuid": "65046854-0eea-4428-985b-aab0678e165c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767407913, "uuid": "7f8fa6bf-7840-425a-8be9-2134eb2f491e", "value": "hallclientBase.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946b9bfd-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463439, "uuid": "e567697a-81a7-49c5-8a69-05dcd56effaa", "comment": "Malware payload (Mirai)", "value": "7da9379d0cdba5012147f5a56ae766b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463439, "uuid": "66d98de9-2cdc-4c17-9da9-4497ab5bf874", "comment": "Malware payload (Mirai)", "value": "c4e650dc25eb7308e4e77499f4b5ad0904bde42fd763216f92e4ad739d5bb55f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463439, "uuid": "501acb77-ee4f-49d3-8a4f-be4741d789fa", "comment": "Malware payload (Mirai)", "value": "96f45a52e755d9db5da1cbbe9d331c80256b4005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463439, "uuid": "b08ecef6-8873-4a0b-ba70-db4b9363a6ba", "comment": "Malware payload (Mirai)", "value": "a58ec1f834449f33513929e384a6d8dd9b1e423141d30f647a607697f368d7582144ee7e85b25f01dd8758b16ee93517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463439, "uuid": "a4ee0bc8-b783-4ab7-bbee-27482ebaa3d1", "value": "T1A2632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463439, "uuid": "8c30d0c7-543c-43b3-b729-d0245c4d3a60", "value": "1536:lGBVg7AOotXhGIAsQXt3AYQrQm75YH/tatpV:lSCzxBoQmVNnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463439, "uuid": "a8687f16-7f83-4567-9077-68d4a3604165", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463439, "uuid": "7cb5cc6a-0cd2-4106-9557-078daff00b46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463439, "uuid": "982d7361-b964-46b0-83cf-d6782a7ae203", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875c388d-e837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767398564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398564, "uuid": "1d54d31b-26cd-429f-8300-f6eb4c942f1d", "comment": "Malware payload (Mirai)", "value": "fd57953f5ecc1d313bd03addcf3325f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398564, "uuid": "1d586563-68d0-4b39-8a6e-f3aae929a01a", "comment": "Malware payload (Mirai)", "value": "c4f3a13388fa08a51011be2c531e71e36e597daa60c447f18528c99fc249b89e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398564, "uuid": "ae496b86-4b10-466d-bff2-b1f3b16b93bb", "comment": "Malware payload (Mirai)", "value": "6a5230b93f87544632e7f4d6902a41fbbc55117d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398564, "uuid": "14a2e9dc-c868-4dc2-8974-e930feb574b6", "comment": "Malware payload (Mirai)", "value": "d9800cec9e31f833f8a486dd3fd8cc81c5419c9411d63ddf1409b4df8cf707912310b40f3d6692aeea83c400d04a755a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398564, "uuid": "25a09b5d-dadf-4b29-8f07-c91d16255e23", "value": "T144534BC5BA53D8F4EC1905B52477FB335731F5311028FA8FDBA5E936AC52602B60A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398564, "uuid": "efa3f3bc-a8ec-4305-a273-6edea84a8764", "value": "1536:laco7oJyLAh3hQei6+b+8JxtSX4TQPYXaNUTQv7eHy2xRD:lacqoyLApho6+i0HSX4TQPYqN1vaS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767398564, "uuid": "9700edcd-1124-44cc-8d79-bce0f2c89cd8", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767398564, "uuid": "1e683c99-f956-447c-9389-207dd1b01763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398564, "uuid": "2117d265-0f84-46a1-9aa5-c4bace689d64", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b817fd2b-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400793, "uuid": "6c665b4a-f0f9-41a4-a6c1-87e109a46dd5", "comment": "Malware payload (Mirai)", "value": "9cc404ac46926f504ad21f966a163e6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400793, "uuid": "f6d6304b-54c5-4db8-8ffe-74d8624aa493", "comment": "Malware payload (Mirai)", "value": "c56db0a145eec2b9b3d40d9af80907cfd27665b5b31793e3c53913da2aecc646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400793, "uuid": "739b89ac-e7cf-439a-b411-8a7089971744", "comment": "Malware payload (Mirai)", "value": "a11f8e058a9d396b630253028119e2c20cb1685a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400793, "uuid": "86b758b2-4ef1-4eb1-8b14-f9e42321e367", "comment": "Malware payload (Mirai)", "value": "3029098905b6e34ff625e689bc9691f9ac06e45afe595b2c7a518b4322719ee45eac119c1603ce7078e0ab1499ac720f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400793, "uuid": "71d452e1-8c1f-48e6-8649-5cf1bf38504a", "value": "T134635C22797D6D1BD4C4B47A11F74339B1F2270A26A8C61E7E720E8EFF207502257AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400793, "uuid": "301d94bf-0646-4f7d-b387-593f9c8f6378", "value": "1536:1ajLSCNTCq1Pjs408VZeYuBBy+6X74Q3fFouhiHge+chNg:8juCLhjXReBXjyiAe+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400793, "uuid": "28cfe0c2-2376-4a2b-928e-59e10fb6f3a8", "value": 69792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400793, "uuid": "d023138d-8707-44ee-9e57-03e6190e91d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400793, "uuid": "29894bff-8462-4158-8e16-33bb233f8211", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124ca31a-e8c2-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1767458067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458067, "uuid": "ab8b6eaf-0af9-4c9d-8f57-15be608f5b98", "comment": "Malware payload (AsyncRAT)", "value": "50f4c42bf621e59d5ea05a3f16059ded", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "azure-ad-masquerade", "colour": "#C1008F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458067, "uuid": "d632d4fb-e53f-4c43-a1a4-c1bc38dc20b9", "comment": "Malware payload (AsyncRAT)", "value": "c5ed92bd459abb4fd92b3de50b9b60e38622a40e014faaec617c5de9d9e7cc60", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "azure-ad-masquerade", "colour": "#C1008F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458067, "uuid": "7ba04369-f384-43e3-b306-fba9e99f9a0b", "comment": "Malware payload (AsyncRAT)", "value": "b52b0026d866c1c1e8c13427b955c3a56e909621", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "azure-ad-masquerade", "colour": "#C1008F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458067, "uuid": "6e89931a-6a07-40ce-b0a1-c3e33fac5dd8", "comment": "Malware payload (AsyncRAT)", "value": "72543028562fc13403b459159f49c60e3bcdc1064980e36d0647961198c43e0c38d0eae856da569f159846ee1c09373b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "azure-ad-masquerade", "colour": "#C1008F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "credential-stealer", "colour": "#7B6F8D", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remote-access-trojan", "colour": "#13F17F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458067, "uuid": "5785b0fa-c5b6-4aac-8ef2-3a69b2eb1f90", "value": "T101536B0027D8C925E2ED4AF8ADF2450146B6D9372102DA5EBCC414DB6B9FFC64A127FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458067, "uuid": "10c0c8ee-f4f8-4432-bbe9-07726ff49ba8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458067, "uuid": "77d67c85-a1fd-41db-b14c-e2493ce955f2", "value": "768:xpgJZ6KTI5QdKFjiPBG9i89JJriG7ZGNd4FZEhIQeG1+3SCv7mqb2nnpwH1oeqay:kUFoevZGL4vGRGbbIwgapGX6VclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458067, "uuid": "468165a0-c5fe-4ca4-a6ce-72be0aebd2b1", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458067, "uuid": "dac23289-b606-40c1-955e-3366b4fda015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458067, "uuid": "826446af-c5ac-4094-8274-6c8b8fe2cc16", "value": "MSPAAzureADAgent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69df332b-e8da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767468522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468522, "uuid": "0c8b7cfb-362c-414f-9cf8-684cdbf381d5", "comment": "Malware payload (Mirai)", "value": "b9ee48761c8d7f9433e91b122e90af01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468522, "uuid": "a88a0ebb-276a-40d7-9152-9bf3671d08d7", "comment": "Malware payload (Mirai)", "value": "c63e2e1a9eef2b72e1e8c92d66cf65f27fb34966a09376b4d4ded55a176a90ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468522, "uuid": "aa486f74-b38c-4d5d-8ef0-2fd1476304cb", "comment": "Malware payload (Mirai)", "value": "9d96316e4d1d4d56e07cfe5952c164e7a2aba8b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767468522, "uuid": "b8f5fa23-c9de-4a10-ab17-d25385be92db", "comment": "Malware payload (Mirai)", "value": "c2a265d70a5cea502d60e48b47ba0380fa3dd24de694585fbb62e3ed54055d9c04730f265bed50f7aa447e02bb076bbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468522, "uuid": "2cf4b893-af52-4350-b98e-a1d29ad3556d", "value": "T13A83F846EF654EBBCC2FDE33069D0B0635CC960623A63B7A3574C92DF60A50B09D3968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468522, "uuid": "0abeaa13-5327-49c3-a8fa-3b773438ec12", "value": "1536:5rg7vukbhful6vY4S4MTcZf1poQENRPQomB0Bznj:5U7Pb1S4kcLG1QLMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767468522, "uuid": "052edd7e-1ab4-4ccc-a786-b85ae05460df", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767468522, "uuid": "b53c500b-fcd1-4ff7-a5e8-1c3ca4ce13d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767468522, "uuid": "6571a5bf-7729-4f5b-a3db-673a581dc11a", "value": "frost.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b8ecbb-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465158, "uuid": "67788fdd-ba34-44f0-9c76-f94d8e8e84df", "comment": "Malware payload (Mirai)", "value": "31c633010210a22b2d5cf99649a056d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465158, "uuid": "394f156a-9a9f-48c6-b08f-c663bdba7510", "comment": "Malware payload (Mirai)", "value": "c6acc6b8b1a257ed0487001ae9347fd97de10a2ffa47a9941b56e93f4da58705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465158, "uuid": "658a6bc4-8def-4e6e-bb63-c2e47d4b929b", "comment": "Malware payload (Mirai)", "value": "af138a99cf8973ede7d0c9a5a4d9f9a00a2ad108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465158, "uuid": "1d1b78e8-a93d-4a43-9ed8-7a8326018031", "comment": "Malware payload (Mirai)", "value": "5800940cec51cf6f3641b8078e35856342af9d477f7a48711ad9c4bd0d644227141f62ff0d96563b872ad14a7e87615b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465158, "uuid": "76631af0-76fe-489e-8e99-2c59ab102a68", "value": "T158F36C1AB78080FFC48AC37C42EEB636D9B1781D1279B65D5790FF253C99E20362E685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465158, "uuid": "694fb887-a708-437c-9a19-e336ba3c6134", "value": "3072:W0IiyQnRmyxDC59LwnI2V4cKJ1kB/29Kpf/y:W0IiBRXxDwqIWqk2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465158, "uuid": "2b750457-011d-4bd6-abcf-0bcf2147146b", "value": 169776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465158, "uuid": "95fe7307-c65e-4e1f-894c-1dd98b28045b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465158, "uuid": "5adfcb66-b55e-4ccb-a5e0-ad01cec32ae0", "value": "x86_64.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6516587-e8a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445914, "uuid": "4ba62e88-10b8-4ac9-982b-b92faaa1bdaa", "comment": "Malware payload (Mirai)", "value": "5ed21a2cfc358ea61676b93d149214a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445914, "uuid": "eb282538-7808-4144-8697-5f46b8f99580", "comment": "Malware payload (Mirai)", "value": "c6e36fa1fd909101ace1f6f8ce5889b71249c7ab11288870892cfa12ee5f1ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445914, "uuid": "957659e2-667b-4be5-838f-2675264cfdac", "comment": "Malware payload (Mirai)", "value": "36156fd1f6ddb269f3976c8f88a6ca7e6f414451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445914, "uuid": "df536072-2a35-4de5-9a57-2db96c7e4f66", "comment": "Malware payload (Mirai)", "value": "4d7916688161a886d27604b94163203be751309eaa8864d2f09f4ef14b70c16aceb6299c863c2ac13baf95c929d1e34e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445914, "uuid": "089d6ccb-1a43-4d96-a75f-4e2641db5e3e", "value": "T1D61309C99D43C8F5DC0A157614B7E7315AF5E53A107CFA9BDB98EA326853302B20A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445914, "uuid": "c9e26f5d-7b19-4f2f-8e7e-cc06dddee66d", "value": "768:8g+9F4tvP1h6w46d9U6dK6GdIf81eq9oP5NvR:8gyiv9hUA9jDGdIf8sIoPDvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445914, "uuid": "9206694d-7409-4783-8b87-82b22dffcd6c", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445914, "uuid": "304ad4a9-7eb4-40c1-af6a-e77a4f9de89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445914, "uuid": "3a41eaf9-db21-4cb3-9907-562d52c27fe6", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e2d2b7-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431116, "uuid": "934311ab-29dc-4f62-8188-c29844eeef13", "comment": "Malware payload (Mirai)", "value": "89ba8294b4337e024445d67a38b10a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431116, "uuid": "01cf9fc6-f5f0-4f5c-bab9-178d313b82ce", "comment": "Malware payload (Mirai)", "value": "c742e7f781b12e5191021e6916ac945e4bcc430fe54f075d7b7d9862d1b2aa45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431116, "uuid": "3183803e-a9f7-420d-82ce-0b7f83f26333", "comment": "Malware payload (Mirai)", "value": "7cc50527c3c9abbd6c420bbeb4e74519b35769f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431116, "uuid": "b1d09c04-015e-472d-a1f7-5bdea2355f33", "comment": "Malware payload (Mirai)", "value": "1ed58691f4085079917853f3105234459ffac857567e85cc6a76a5a45f86a9e621f5143deac14c87078c5d39b0dce061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431116, "uuid": "6ff53863-d606-41c0-b848-d52bac1c61c0", "value": "T13B534BC5BA53D8F4EC1905B52477FB335731F5311028FA8FDBA5E936AC52602B60A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431116, "uuid": "65ee69c3-61bb-4b29-91df-e356b5da0537", "value": "1536:laco7oJyLAh3hQei6+b+8JxtSX4T2PvXaNUTQv7eHy2xRD:lacqoyLApho6+i0HSX4T2PvqN1vaS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431116, "uuid": "9b955d78-d22f-4342-abf5-a4266150823a", "value": 62096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431116, "uuid": "2337ae52-fd57-414b-96ce-fdf299e98fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431116, "uuid": "b28ac02e-5445-476a-80d1-e02c8600d5e2", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cfd622-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445183, "uuid": "25efee08-fb24-4490-8422-9755f7788913", "comment": "Malware payload (Mirai)", "value": "9d451917de6d896dd3d7d181475bbcbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445183, "uuid": "e3627edc-dbd0-4c36-acda-ffb925145bb6", "comment": "Malware payload (Mirai)", "value": "c7602cfcf85f7b3e77c5c9d3be948dc108e6032d2829e20a0f78df5c92f01301", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445183, "uuid": "db2b82a1-9ac4-421e-984b-74beb8cc6fa0", "comment": "Malware payload (Mirai)", "value": "c2631f0d61fe5768f3e8341d23139b918080d038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445183, "uuid": "1a905d47-7c15-4578-ba5d-ece990bd8e92", "comment": "Malware payload (Mirai)", "value": "4b8fca18a97aa7e6edf8a0e10a86253c2565a509d3c7189e0a6139447247fb2a9ffc0de016dbadc36a89ac619d0cbfb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445183, "uuid": "2fe0dace-4c44-44df-8553-90790c22b313", "value": "T17373C415BF614FF7EC5FDC3749B95B04298C950A21A83B367930E818F64B25F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445183, "uuid": "6ff14c20-b5f6-457d-a315-024961e7fb6c", "value": "1536:cmI709LSFp3axN7f5cz+TXyVbhaauF/rHdguM7R:czg9SFVaNFcMFBguM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445183, "uuid": "9df2ccdb-b634-4fb9-9db3-2a2267c2d328", "value": 77912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445183, "uuid": "7839eca8-568b-4a28-8a4b-c8bfe1da263a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445183, "uuid": "c4c13582-bb95-4e85-917c-14fea4b90f9c", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d68a4b-e890-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767436680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436680, "uuid": "312f1919-489d-4466-ad68-3ec415a639c4", "comment": "Malware payload (SalatStealer)", "value": "3678bbbc0b176e0fda49d00d4549f3aa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436680, "uuid": "68e0d828-34b9-418d-8b22-c8c9dfefb396", "comment": "Malware payload (SalatStealer)", "value": "c7cfacb766d390c08f457b155211e20e6ec2ebd61e0eeb54d2af49f6d6625fb8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436680, "uuid": "568b5247-4543-4214-84e8-8ef9cb909f64", "comment": "Malware payload (SalatStealer)", "value": "55b83a5643265352bd5334549e553c4c714d6647", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767436680, "uuid": "76d414b3-8b0d-434f-b978-b869fab0b18c", "comment": "Malware payload (SalatStealer)", "value": "0f7f8dc3b90b1bf9a4c9f5da6644ebd27d6a5517bdb2d547de389a3f14fdaf02063b10d4a03f9019467d19d912927df4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436680, "uuid": "08f52c85-1c56-444f-9147-d6aa4bc869c0", "value": "T176E5331F937384BCF1C28DBC6688ADCA22F9C4F851977E52D572B75104E822CBC95AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436680, "uuid": "f40a8100-5b13-46ae-aaf8-8046d16d98b7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436680, "uuid": "fa85a299-0cf3-4c0f-9c7a-423ad997b752", "value": "98304:XNVDbzLdEFaPIlFRptbTMT/YXDv4ihQr/X4g:XN5XaFblVtbScDAiM/XP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767436680, "uuid": "c9374305-e24b-42da-85e0-0bdcf243ea27", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767436680, "uuid": "ba27b08a-883a-40b9-b422-397f5256f677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767436680, "uuid": "570260d5-69a3-4b3e-adca-e3478d5f3f26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc769576-e8ab-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767448528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448528, "uuid": "f9c9dd68-c369-4e22-ac8d-e053404e7a45", "comment": "Malware payload (SalatStealer)", "value": "8818e78535fc71f5d6d40e72fff426f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448528, "uuid": "e331a837-a014-4b06-9a4d-7c5938374415", "comment": "Malware payload (SalatStealer)", "value": "c870be3e6eedbfe3c18bdbf0d6919b19108602ec84884bc959cb28e47588c8d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448528, "uuid": "52f09e28-9c43-4405-83ba-ae3680bbcea8", "comment": "Malware payload (SalatStealer)", "value": "5a31cd48032e25365c5689100fa2770eaa4072f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448528, "uuid": "3b3f3f35-2c45-4f9d-b3f9-8034ea9c38a1", "comment": "Malware payload (SalatStealer)", "value": "e6beceeb89df62e5dab9fc00ec803b4ec3bfff00c0552263b0bddd02337061e1b8b96283e27780c3ae055558ad295b85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448528, "uuid": "3e5f664a-53cd-471e-b17c-a7432dc5a9b9", "value": "T15AC65B51FA8B54F6E9031831809BB23F23315E048B28DBDBFB547B6EFC77681196A245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448528, "uuid": "b55f1a02-331d-458b-a5b1-82a2634c7661", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448528, "uuid": "9ffbca8d-faa5-471d-aab4-d357c14fad6a", "value": "49152:mDkePcyH2Cu+rejYdYAH9LE9d9EwWqHDyzCK+mn1KVP0NVo3liURxjiT66bQhpiV:MhPTWQYa0DV/rFcOOY0ZJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448528, "uuid": "fab12caa-6f80-4671-a352-b2ceed931bb7", "value": 11656192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448528, "uuid": "1e4524c8-9567-412c-8f06-cc3491e50814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448528, "uuid": "33fc710c-5150-49d2-b102-87d3b9045cae", "value": "LunacyPC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c360798d-e8e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767472967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472967, "uuid": "2ae8ef7e-6c64-4a40-a76f-40ab9cebbd90", "comment": "Malware payload", "value": "d8eba7478fc3b8bdebe3c84e5c28e767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472967, "uuid": "e596c7a3-d4cc-4fa5-b9a3-d7a16dd33e7f", "comment": "Malware payload", "value": "c87aaaf0d29500532edd49bf7d3b54ff4b89e58c9232f70f5e5c51a6385aa058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472967, "uuid": "529d1b08-b6b3-4060-92f6-6cda873e0375", "comment": "Malware payload", "value": "6caa33167407abb5ea5bafe47ec0d320f5efa14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767472967, "uuid": "f29a2cf6-ce14-4d5d-970b-ac33a4dfa0ba", "comment": "Malware payload", "value": "2614af52cd8ac4b840d76dfd2355f9498be5eeafc0f49d0dff8a765bcccac122b29acc970efe138bb13889123e40461a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472967, "uuid": "8a09cc62-4e9d-4012-bd88-ddc927b6f6bc", "value": "T1090723C25EEB529CC0974A300AC667CD39C4359EC0FF8D6E39CB6C067995E1A48CA5B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472967, "uuid": "bfb16ebf-4178-418c-8f61-b29cd757cf07", "value": "33184a7fc9a88c88d19cc798ba17c5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472967, "uuid": "6318882e-9a7a-4bec-a1cb-2bdc00b36d00", "value": "196608:CWTxnTPckqSs9Ptj0+iP5KGd3bMrBnzpDcUAPP8hinNDm3sb9L5/otmXEoytPlbt:CITPtqSePtw+ixaBlDJeNND9YBp7407", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767472967, "uuid": "ac435193-67d8-4df9-9805-bc9250dcf0fa", "value": 17228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767472967, "uuid": "e3e5fdba-31e0-49f2-9e8b-7d227dc0d615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767472967, "uuid": "86f2159e-f124-4bb8-ab7d-2a2e942ac134", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164bea3a-e8e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767471818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471818, "uuid": "9ec5e4ff-047e-41cd-929d-a9b82f4b74a1", "comment": "Malware payload", "value": "73c619493a242f76ec12023f0efcbf65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471818, "uuid": "85862f91-3870-4ae3-8f43-8703e528e6bd", "comment": "Malware payload", "value": "ca5b464bc06c04dfd9f095e3288d8916c63ebddb964e5bef8ea8d31b884f3329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471818, "uuid": "6d90cea9-7476-4ed7-b922-ceada015307d", "comment": "Malware payload", "value": "04a6039aef155c5453c6c5e5419b1fcfcfeb87a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767471818, "uuid": "3eb2da28-cb2e-4a6d-a01d-b529909b8763", "comment": "Malware payload", "value": "b4e90441d716449a5cb390a373e15a21974cb335aebcd18944bd55ccb1e3ba66c7f58dec3ddc9cb6e55a4bd0085124fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471818, "uuid": "52c642a6-39e6-48a6-b62a-ea9093833e55", "value": "T1EC86335872A005DAF9F7923F5A555082A3F3B0264761C9EF0BB843993F0B6F15E79B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471818, "uuid": "05ba067d-dc54-42f1-800b-9515c0ee8fe7", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471818, "uuid": "6f283415-6c99-433d-b18a-4a8055256a99", "value": "196608:1h9chtbW897GJr1LDsBTG9Wd6WQGa/R6:3ah1S3sB1QWQhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767471818, "uuid": "c86dac1f-ca54-416c-9633-0b9b8e700731", "value": 8328776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767471818, "uuid": "486a7acd-68c5-4a5b-8d58-42f75f6ea118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767471818, "uuid": "10df9b95-8cb2-4680-920b-8dec85af15c7", "value": "Kagi Is Cool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72188897-e8d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767467247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467247, "uuid": "d9a6f9a9-6320-4a6d-85cc-5991e6ad8459", "comment": "Malware payload (Mirai)", "value": "324182f96dad72359e0a4894fe896430", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467247, "uuid": "0625d9d5-2fa4-4e46-af23-9715bc2f4bdf", "comment": "Malware payload (Mirai)", "value": "cab3818fdb17a560cf6710cd46c18fa8c35d67611897c03df48282ce573da6d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467247, "uuid": "78e9b427-40b6-4651-9b07-a0889bb27c8e", "comment": "Malware payload (Mirai)", "value": "0c207dec7c24403141efb71e6636e8d7c02fed68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767467247, "uuid": "2c0ce176-f228-44a7-8e46-72011338e72e", "comment": "Malware payload (Mirai)", "value": "ffed1442d1b95b3edf81328111c975cba105c3326db3f2ade7b8bbb0fe08435cc0d4c2bee579410f322be80d1498253c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467247, "uuid": "8ea2b841-2ad5-456b-8586-01c3dae4a640", "value": "T1E5536C02BB1C0953D2671FF03A3F27E1D36AA65021E9E6453A0EEE09C172E3255D7ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467247, "uuid": "aecbf50d-6412-4f06-a5d4-8460a59346d7", "value": "768:O5iw8d8IycrwdjpjabdBr9Z3UQksF4kb0xLYnFa3tAlwPzq8+XPzjogia0IO:g8d86rwdjpjABZEaFnb05Yo3qwrzav0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767467247, "uuid": "faf77b56-3f75-4a48-8f6a-6266af9ea0c7", "value": 63096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767467247, "uuid": "42ce265f-045d-4d5f-9814-dbf1612bf8b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767467247, "uuid": "17a868ff-7676-4875-8f3e-ee6c65cce2ce", "value": "frost.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f68c197-e885-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767432024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432024, "uuid": "ef999cdc-fe48-4d05-9d9d-d4e0f849e488", "comment": "Malware payload", "value": "157f82a5970c167e7da4cae218be8334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432024, "uuid": "b77ba3b1-4f14-4b84-8ebd-5daf7c5841c1", "comment": "Malware payload", "value": "cbe4de355e8768d15712ce4bf22370a63673db136265ddd97bf1bc592585a6c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432024, "uuid": "8557bbb8-8b01-41cb-bc4a-059ddc92300b", "comment": "Malware payload", "value": "3d2ed52a3543a9b4058ea0f99b3175cd0c980786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432024, "uuid": "e7fb1f9d-807a-40b6-97f5-c4dd2365bbe2", "comment": "Malware payload", "value": "9500f40db9fbfa0ff48e2232e06410f5ee710cd3545ae1e5a02c0a639a03d32c93eac01f6830a7df3b1e80864cf9fef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432024, "uuid": "b2d8f88b-5109-4758-8904-f4908498a273", "value": "T1A5C44A55F8809F61CAC52976F79D869C33134B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432024, "uuid": "6179d877-b7f4-4aff-970e-729a8490c70b", "value": "12288:kUfxGeS0XnZTCWK116ShjWte+gpZ6mSLwCV8:xcaO1f8n1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432024, "uuid": "34a2674c-f786-444d-8677-44ba2a893acd", "value": 565920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432024, "uuid": "05df7d52-c87a-4979-92e8-622001442ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432024, "uuid": "2f0d0aeb-8f42-4b78-9fa1-4862fea84d75", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d215d46-e8b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767453468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453468, "uuid": "17541b04-120b-45c6-8ee5-eeabf18648e5", "comment": "Malware payload", "value": "23566cabda4864935687ef6d82cece7c", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453468, "uuid": "f71cf6db-fc8b-4edc-b44b-2be250aa386d", "comment": "Malware payload", "value": "cbe6067a9e1a2f4098c46baea2dc60b0073958fa6a1530f7bb8125255f38dd59", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453468, "uuid": "9365a26f-8267-4c2c-ac95-4c02339f3f05", "comment": "Malware payload", "value": "89ab097da6dd6139d27c8bee2115b35cdeacbd13", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767453468, "uuid": "f41e0b9b-5103-48a3-aac6-ea73327e223e", "comment": "Malware payload", "value": "93a84583271f30912ed760d093b0b6b8c49e5c5782188b2a5a77d4824974d119b33d074481d035ff174cafca3ad46e2c", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MacSync", "colour": "#E91EFE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453468, "uuid": "67bb4ccc-2340-447e-82ba-5b681257d5e7", "value": "T156B3AC79EB0818B7FD9010B07464201B1C9A1EF73A65CC69A4DB386F1387F35ADB4E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453468, "uuid": "1df908c1-1bd5-4269-9005-2073b6e7cfe3", "value": "1536:EAP75WMJEjZ4m97mSYNZm+K5DXPyvjAobVAtmprywEu8Zeb0+HL3/J6xS7I:Ee9JERmMhDX6coJAYpry8jbhzIxS7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767453468, "uuid": "20c59894-d40f-495c-9975-f23d50860746", "value": 113986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767453468, "uuid": "210471a2-f74b-4500-87c9-31af5efbd69e", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767453468, "uuid": "d4dd9a0a-bee2-4ba6-9f8e-94961e1ff3c1", "value": "oathBound_cbe6067a9e1a2f4098c46baea2dc60b0073958fa6a1530f7bb8125255f38dd59.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7576770-e897-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767439876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439876, "uuid": "595a9d60-f358-4764-85a8-b8c35008de9a", "comment": "Malware payload (Mirai)", "value": "8980b014b6adaa055489a49ff1f64ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439876, "uuid": "1a83882e-132d-49dc-bf9c-fde8bf051e2d", "comment": "Malware payload (Mirai)", "value": "cc70d502ff7eadf478c580341a357678bd5b09268bfa500f26ef278f7971f160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439876, "uuid": "f9036f55-6621-46cf-bfe0-169cbcc684df", "comment": "Malware payload (Mirai)", "value": "0d2ab351faa0bfde7ce11a40df1c60e0a84dd609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767439876, "uuid": "5f4cd8cd-5a09-48f2-94ec-ba7e2de8f21d", "comment": "Malware payload (Mirai)", "value": "48625ae68ce3edf39c041ff925f11c193317efa7b7ad22bd7b95eec274f38a6af5767745cc5edf1179dddff5f7b8516f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439876, "uuid": "3a2f3efa-32f4-4d0f-bbf7-aee4bcaca9be", "value": "T101140842BD818F13C5C622BBFBAE018D37166BA9D2EF3103DD216F61378A59B0D36651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439876, "uuid": "7597a145-265b-4886-83ba-0b1ab47e5932", "value": "6144:I/xDXkbOm+ZAiNbh4pO4H9dp8TTdVwRk8K:I/xD0bP8QO4Lqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767439876, "uuid": "e4eebf8d-3f48-4557-a335-6fd1b5bbf02c", "value": 197800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767439876, "uuid": "f159332a-65cf-4e90-a6d0-51979a844fd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767439876, "uuid": "1a97a609-79c8-4bf0-964c-379baf270247", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa07513-e879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427104, "uuid": "863e86b6-45a1-4e5d-8f06-9e1255b92af6", "comment": "Malware payload (Mirai)", "value": "faf0f5a4d618d6bde88054103d06de6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427104, "uuid": "08c5cbf3-10d1-452e-bf0c-8497990f6a54", "comment": "Malware payload (Mirai)", "value": "cc924e5fcd0d3b0a60dbd4dd7af49608a38700e018ac051cdf90819575f1ea58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427104, "uuid": "d2930b57-9768-4ecf-aea0-aed2695de8f3", "comment": "Malware payload (Mirai)", "value": "3c76553f02a1f40dc7198dc672f28deb1e073302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427104, "uuid": "6e81b32c-cf26-471b-be72-2fe92e2b3326", "comment": "Malware payload (Mirai)", "value": "03d2c48b86499de0eb5a82f46b2b54d002255c22e4867a84a933b29eb8830ac85fda9da4c53e00ec5133b85c954dfc5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427104, "uuid": "3b5634a0-167b-48df-9061-a8d356966622", "value": "T1E9A35C92FD81DA12C6C562B7FB1E428D371713A8D2EB33038E265F21778A51B0E7B554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427104, "uuid": "a1db0cf3-1ea4-4782-953c-bec3f989df4f", "value": "1536:snWc9ec6yqVWqTjLp8EUNuRoMreV7J5u3+rHFZjwOHB/P4fizN5vVZAR+:kWcIJyyWqT/p89HMrKQ+LrMS6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427104, "uuid": "63ee10fc-a049-4ea4-91ee-c85a083060b0", "value": 104032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427104, "uuid": "ab1559b4-a5ed-4da6-ac09-fc1f069d85e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427104, "uuid": "79ef99a6-3df9-4636-bcf7-411ae6ff5ae3", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b137f4e6-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446308, "uuid": "766eaa71-e88d-4d9b-9812-8d0eb22c82db", "comment": "Malware payload (Mirai)", "value": "6a5866905571bc2e9dc8a6ceb45778bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446308, "uuid": "9dee2f4b-56f8-41b9-b326-35a08b62d340", "comment": "Malware payload (Mirai)", "value": "cd85e7a75e21b57ac51c66a983bd1b498ab751103476ba37c2ca7009939c257d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446308, "uuid": "f51ce53b-5ab7-457e-bf91-f92fb1c952ce", "comment": "Malware payload (Mirai)", "value": "601e94ecb8a0b9379c49fe120e95113de8a79592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446308, "uuid": "a77af375-775c-4e12-8bf5-7584ee1007b2", "comment": "Malware payload (Mirai)", "value": "2e4c5a6457db0f4beddcc401c7aee08d48f74293db5d0d190e0746a0717ab39d7e9e3cf2e964d22defaabaaf61a1b4ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446308, "uuid": "eccf3dd6-bb51-4429-8976-f86a95376a27", "value": "T1A462D78EBCA2865BC1D14236FF5F867CB723A384FB5F2707A909125459963CDCE21A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446308, "uuid": "fceb3bf3-2573-4595-a2bf-03e5743e2346", "value": "192:TvyGmt2gDyQ5FCCVanChOaR5DGitL/kevH3roTzJFA6NJAPQwjIEjb1wRLUsF5Ze:j3mdGUJ4ChvtjzXrof06jAHh2e6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446308, "uuid": "fce415f0-cf26-4ee2-945e-098fcb33f0d6", "value": 15324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446308, "uuid": "9f4692e5-8664-4c30-aca7-fc5e753ab425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446308, "uuid": "5bb1b3ff-1d1d-43ac-aedd-6a95b25d751e", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07466ff-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445555, "uuid": "72dd396b-856e-4bcb-9036-6cb32e163f2b", "comment": "Malware payload (Mirai)", "value": "ef9517f77b1ab8e29c3f8f6f4901c83a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445555, "uuid": "5ebd58a2-a83d-4521-8c9f-c8d1b446e487", "comment": "Malware payload (Mirai)", "value": "ce646d9df1c29b4b3797ab4af0a66affdd3a7d491cf58a5b5aaf7d0d7dc0102e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445555, "uuid": "6ee949d5-fe5c-420e-9a9c-6d0e2d0a5ad0", "comment": "Malware payload (Mirai)", "value": "faead74613f88793c5370682857dc18b76b01824", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445555, "uuid": "fad19c0c-83c3-49bc-8e77-6e3c746f8bda", "comment": "Malware payload (Mirai)", "value": "b42d4d11d37fa92774892d1bb1556d55d7e14cdea662e8612e0dcb4cc505819000f9fdffdb92087194d4ebd58e8e4c6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445555, "uuid": "8c11a7cb-f16c-4392-a401-80ccd81465dc", "value": "T1B4136D23897AED69E14D4AB574708B750B27A201E3872FFA255AD115C083EDCBB4E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445555, "uuid": "1bfa238f-76b2-409a-a975-655788a5a2d7", "value": "768:HjfMddusrdZCpv7ooj49/RYFb9E6DjUHNCh251w3oA6WCfXu+7R:HjhgdmToHM9bfUHNV51w4bWCfXu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445555, "uuid": "0c2d6023-b57f-41ab-a489-4338721823db", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445555, "uuid": "cc641024-efa1-443e-a01e-de63dd4c0eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445555, "uuid": "4583eb4a-afb7-4061-ba59-88b08ff7e76c", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e3302b-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442833, "uuid": "d4f495ce-33f1-409a-9d51-5f7c0e937f56", "comment": "Malware payload (Mirai)", "value": "7efde6512b0a60c6afc540f2ad2b58ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442833, "uuid": "ec40c723-5b50-4fee-ae41-b4322772b69c", "comment": "Malware payload (Mirai)", "value": "cec59e5b34caed899b6127603e80e3c3c65285b5aad35638d1a400c04501a7fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442833, "uuid": "d17d9e43-811d-4784-bf6c-afdc506fb65b", "comment": "Malware payload (Mirai)", "value": "99aeb8bb989c93d4df8374e31e2a1b72d41aba0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442833, "uuid": "a6a5d217-d01a-4a6e-9c2e-4990b12f8420", "comment": "Malware payload (Mirai)", "value": "ff99caa81926893b68969d3555293b1c6c6fd316ed973e930cd77f27d8e62fe66119599bc9b79e77108733edb6974ae8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442833, "uuid": "7ce9b924-b2f3-410b-89e7-d37c446b89cf", "value": "T18283084AF9819F15D5D922BFFA1E018D33636768E3EF72028D105B15778A92F0E77A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442833, "uuid": "bc39e658-8d56-4174-aedf-cec02564fc68", "value": "1536:aRnZLuyteh2l1FWc5Xsw9Hwe50KlrDAwIDRrysZ+MbjNl94i43T7RlruM7R:ABtLPFXr9Hwe5lJDAwIDRrysZ+2u3Trn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442833, "uuid": "8a07b15e-2954-410b-903d-3516a09d4565", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442833, "uuid": "fec9b5af-1e15-493d-bbd0-54230b39e85a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442833, "uuid": "63f33cdd-a1b6-4522-adde-9df7bbe48901", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c9fba1-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400791, "uuid": "fb513cad-b187-4ee9-9329-e070344a20b6", "comment": "Malware payload (Mirai)", "value": "edda85077a0955a1bb2229bb7fddff3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400791, "uuid": "f23eed94-3339-4704-a12a-230190803b8d", "comment": "Malware payload (Mirai)", "value": "cee935cda088a9b239f194d7230bb14cd9a45b6bc7d6f6c6a6ee131d25a68cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400791, "uuid": "eade7390-6505-4588-a2b7-fcbb8674547a", "comment": "Malware payload (Mirai)", "value": "eb6fcdf1e0c7149572e1f438e308f4524adae35a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400791, "uuid": "5ca0161c-67e2-42f0-b79e-09e00f6baec6", "comment": "Malware payload (Mirai)", "value": "6ec4b685bca7b7143ebc5e5707be3f2c78474b1f12b54143f289215eb5ab5869249938c6a0428a63d8a2362170c4c1b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400791, "uuid": "22b6a4e0-8791-424a-afa0-2f71a9043d77", "value": "T12053027A10EA4FD5CB79833110FAFB6750D4A30B25918DF50B86307F69A6B0FB61DA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400791, "uuid": "d5973ae8-83cb-4977-886b-33a8398a670f", "value": "1536:8mhmLpNSB1HwbmumWNmL/lyyfqh7sVgdIsVmRdWgeNivVmt9Gwz1Gnouy8Gyg:8mhmdS1HIBzEEyfy7sVgdIsACgNvQbGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400791, "uuid": "339261e5-e07c-43a0-b002-ef83d5e4f50d", "value": 64008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400791, "uuid": "7c557892-1ddf-449d-81d0-8b6da9749da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400791, "uuid": "421c81ff-4a82-4765-b7b5-a606da7a837c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f119ead8-e8a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445556, "uuid": "15fe795e-72ed-445b-8a50-f8408bea772d", "comment": "Malware payload (Mirai)", "value": "210192dcd8cd19b97eeac2239fe65492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445556, "uuid": "f821a1cb-77e6-4688-bf95-a024987bbbd6", "comment": "Malware payload (Mirai)", "value": "cf1e05bfc0a1ae59fed7ca833b775da4aa39594fced1968a250dce10301e902c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445556, "uuid": "19488a7a-9fd3-428e-89b6-3d8d5e137f35", "comment": "Malware payload (Mirai)", "value": "cebb74e9724b6ce2fef9dfadd7ae6941e77ec7b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445556, "uuid": "728ac136-f15a-492c-9c04-fd4a07739ae9", "comment": "Malware payload (Mirai)", "value": "df63ba7546f050b78b4cada1a1d41c5766b504a8c7736636a7139851a23fc8cafa4ff33ed3b3b80d542ce0684d284566", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445556, "uuid": "b91dff13-cbf7-4ce4-93c9-d6e54e764195", "value": "T10E7302DEFDA45356CA3DA03844BD1A42250CE5A61B5F3707CBC19F80DA5EC17A89CAB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445556, "uuid": "ef3bfebf-6fd1-45cc-b80e-0d67e60c52b5", "value": "1536:FobDk9s1qU1remNdfRxAyc1eZDYFNHhrPlp626J55416B8Ea/eWO+vl:aXjqCem3f7aeZEnHhr9p626JO6qPvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445556, "uuid": "36853e84-65c2-423c-bce9-7ff01056063f", "value": 79676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445556, "uuid": "7353a048-46aa-47a4-ba58-39a146ad9889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445556, "uuid": "580585c5-dabb-4f1f-8cfa-2c3cf79bda6c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92163a9-e8a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443744, "uuid": "479b3ced-95ba-4d7f-adf8-67b480ecc7ca", "comment": "Malware payload (Mirai)", "value": "116e5966d9b04ba603773d0c52ebd88b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443744, "uuid": "27f18877-4472-4d75-be65-7f40bcf5b17c", "comment": "Malware payload (Mirai)", "value": "d09e15c51a7d6bd9a5fafe34fd87d326cd5dfd64315802afccd70071d8efb3fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443744, "uuid": "d806209b-71d6-41cb-86cd-ace8f64b9f84", "comment": "Malware payload (Mirai)", "value": "ac2217a80793e9a3cba6e0fac4be48e13f9c810a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443744, "uuid": "c42f3f0e-36da-463a-9910-67f6232f652e", "comment": "Malware payload (Mirai)", "value": "8c010ff512b98eb2902d5f2e64084a1a1e55f13795a2e75e5ef31897a3895b4c8358efdaf73a2dcc23caee3dfa49daaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443744, "uuid": "94eed939-8dbe-4e44-a3aa-694caaf65e9e", "value": "T12793074AFC819B15D5D922BAFA1E018D335357A8E3EF72029E105F15778A82F0F7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443744, "uuid": "6ec7e0c6-f993-4978-a3f4-a70cba0f2745", "value": "1536:ORnJR45UWc+hTkkMrqHcrHDsILKmHweJs/8+2680o3bPZclxst0qOllEVijDUCg8:64iW5kkMuHczDvJHweJ1+2hz3bPZclxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443744, "uuid": "d28f868c-2cf5-4568-a5c6-1035bc748131", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443744, "uuid": "8afa7e70-cb71-4f33-812e-73824bbeb845", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443744, "uuid": "c99b778f-0702-41e9-8f57-960849bb95ca", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d733863d-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432628, "uuid": "cbaee4c4-b824-4900-b427-7fdeff3eda55", "comment": "Malware payload (Mirai)", "value": "ed725360384cefdc80c3f2301823ef5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432628, "uuid": "dd5dd3fc-3a5f-4e4c-8b20-de68a3187d9c", "comment": "Malware payload (Mirai)", "value": "d0a0815a623204d055049f257758341aab0992315e940abf381d8c10467fa474", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432628, "uuid": "96f1149a-c240-48ff-8c40-bff5f2e686d3", "comment": "Malware payload (Mirai)", "value": "06caba3128ad9218eea9e8f4c79ec9a72f354653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432628, "uuid": "0e02ca27-c186-4c81-84e3-00dede55dd88", "comment": "Malware payload (Mirai)", "value": "3c12ffe39b9dbb39b801ffd853bcd6928900eea0b5ec50675cbfe6675330e604cad7c86bff604de177037a534a93d177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432628, "uuid": "4da985ef-2252-4bb2-ac0f-c230e9b4808d", "value": "T146536D4272184A57D2A60AB0293F1BF193BE99A021F4B3C9750FAB5D8571E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432628, "uuid": "968a9204-a73b-4613-85e3-6d4a03fda818", "value": "1536:1YYbbwRexDZFC8Zbhk8k05O5kFmFqMu+7R0h:vNDu8t25kFsu+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432628, "uuid": "fff09cbc-2549-4d39-a81f-19f55ca8998b", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432628, "uuid": "bd618f62-1c63-487c-af22-5df893f7c72d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432628, "uuid": "619b60d0-50fb-4ff5-a1f3-a96c4aff02ad", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b9d12f-e8c4-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyNote)", "timestamp": 1767458937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458937, "uuid": "27d364be-dc53-444b-8621-201b7de8146a", "comment": "Malware payload (SpyNote)", "value": "05aec94cc640a223d96780665467cec9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458937, "uuid": "4ea24ea9-182b-4067-a200-e33e32c412c5", "comment": "Malware payload (SpyNote)", "value": "d19edfbc70474a76b2dd6d8d0e844404f7b4c364c2278a6a668159e83310598a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458937, "uuid": "c2842766-31c5-4aca-95a4-72cc6144a353", "comment": "Malware payload (SpyNote)", "value": "3932c1023db81b79b3d829ef19af9ac9ac0b709e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458937, "uuid": "f322fbc2-ad40-4f74-9868-88956a727f9c", "comment": "Malware payload (SpyNote)", "value": "a20899b87884d7d2ef7fa11e2c83a79d21ef8d50fd8d99e1dcce29743610db8de7dd11d44097bfb993e5b0efc4294e76", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458937, "uuid": "e8634b38-40a4-4184-bcfe-6aaf2cd2f2b1", "value": "T13206D007FA84C79BD4BDD3F86E332DA91A175F04CA929ADB8029362E2D731D14DC598C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458937, "uuid": "b785ff45-faaf-4b80-8c73-1d8b22b7d6fb", "value": "98304:iZzBDT+mzeMvx2YqLYROcRXkaIC0t0TvhCKjJa:2ZzeMvYYhOJ00Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458937, "uuid": "fc062d83-c2bb-44e6-812a-28c7d5401ced", "value": 3980831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458937, "uuid": "8ff96fd2-67f0-4480-86d7-33ddac8317e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458937, "uuid": "7bc619e5-700f-4608-8aad-034b2326ed79", "value": "inattv.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0b4755-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442838, "uuid": "3235556e-9179-4f22-9596-034b0b57aa43", "comment": "Malware payload (Mirai)", "value": "6bef7a50fb9dedae97f813dcb7c72b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442838, "uuid": "be01b236-72f1-4b17-8cdd-55ad49292a61", "comment": "Malware payload (Mirai)", "value": "d1e241132ad5ee1411e55c01e7714034fad4c53073fe503655ae0f16147ee5a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442838, "uuid": "31a7c876-5ef3-49e0-a777-cf701d05370c", "comment": "Malware payload (Mirai)", "value": "774cb0f4ca13e071b47cde1c46dc7ad739678c7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442838, "uuid": "aa1f677f-6ba7-4d8c-931f-228c462e68fa", "comment": "Malware payload (Mirai)", "value": "499b0bd9f9192cdae558f23bb01ce73698d0fdf510e5ae44b70cc59452828265952ae399cc3d84764e483ba33c5bd93f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442838, "uuid": "45959d6b-c4bb-41c3-a8d0-2e2e73d02044", "value": "T133835A13563C2F1AD0E4E57702BB9352B2E12B8D05A8D65FBD720E4FEF262901D5B6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442838, "uuid": "d89007dc-63b6-406d-beb9-3277e3ebb9c6", "value": "1536:8Zpd7w1+YHy5BLDf4LV9G2sje0xtVQN6fuYDAPQjlPvddCVIgwPfwbZnI:8pqH+Ar8Q6sQx3fCGnwbZnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442838, "uuid": "d2c7a821-a184-499e-b979-b8c187ab94ee", "value": 84516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442838, "uuid": "5e0f1a16-c164-4f78-b929-5bd874d4e892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442838, "uuid": "bdc06093-cdaa-450c-bfac-3687fda3de1f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5182f3-e8ac-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1767448637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448637, "uuid": "1bdc0213-2562-4349-b4b9-aa5204adcf92", "comment": "Malware payload (SalatStealer)", "value": "9a84eeb50cdddda2b04dab183628c552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448637, "uuid": "c7d12f10-de9f-4655-8e5c-6529ebdbd543", "comment": "Malware payload (SalatStealer)", "value": "d2ce4e51dcd2ac22f33829fdceca3aa2341755fe1c366d220e57746cf4586527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448637, "uuid": "a318d237-241e-4b3a-acc1-2a8e90754022", "comment": "Malware payload (SalatStealer)", "value": "7a2920c4051b3373b755ca96bd7c32644eb24a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448637, "uuid": "d564de23-534f-4847-b0f6-dccde92d73fd", "comment": "Malware payload (SalatStealer)", "value": "7df19c9e8a29f3859480a084a2ad265ce491c1a0c180a98d995c97b9fe5ce5416eafda45bbce397275bd4f6ae6f34271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448637, "uuid": "7b5f5fa9-99bb-4888-b0af-a910df8fce46", "value": "T118E53378B3C81776F42A22B2E5B20353BF0CE5BE5614836DED310CD1B5E68A5BC856B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448637, "uuid": "1f8ae5c6-87f7-4795-8949-a9cfdec391fd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448637, "uuid": "33ec043f-63a5-4bb6-bf59-8c0d21284c15", "value": "98304:xw/xXMLXcMj5bHMXDMDhkuYWFKpswdTeB01W:yWLMOHMXY9tUpzux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448637, "uuid": "7151d182-61d7-44b7-9c60-ac8a0391bf4a", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448637, "uuid": "464cef0c-1cc6-4f7d-b270-265690b7c163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448637, "uuid": "118c72df-09d1-416e-af6d-0251ec4f86cf", "value": "SharkHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b41103b-e889-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767433708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433708, "uuid": "d14d8a3d-7462-41ec-9659-9460cad483e6", "comment": "Malware payload (Mirai)", "value": "4d58f6f24ba08f0188bf72a8563688e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433708, "uuid": "804ea36a-e004-43de-aed3-f67d537af56e", "comment": "Malware payload (Mirai)", "value": "d365c626436b2f111aca9a4fe51d173115292abab66f0ed449bdaa993369b5e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433708, "uuid": "2ae6a272-ee2a-4ceb-b2f7-bc8371646907", "comment": "Malware payload (Mirai)", "value": "497d4f8ebae44cb59a9d5fa6de153c114872b90b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433708, "uuid": "04f0fdf0-16ff-4916-8860-7271b35dde9d", "comment": "Malware payload (Mirai)", "value": "583a377036a68b802c125cb7d77ec993980ad4ee97b9e31f9c767926f5d7d5c8c6e3ad1201262dfc7466b48d5af6f2e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433708, "uuid": "ff20694e-2772-46ea-91cb-67460c87e95c", "value": "T1E4F2D1A6C159E5F0D3F40C3280350D87376B93B2D1EA62853A98CB446ACB79DF761AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433708, "uuid": "b9f5ce0e-639b-44f7-86f9-bbd1487e4971", "value": "768:1nPboD8ubyZQdSJHesGLtVExKNpVH3yWqA5YmYJIVpyxzs3Uoz5i:1fSYePHVIsYd6Vyezg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767433708, "uuid": "e6a0e01b-1e48-42d7-9dda-a6b402945754", "value": 36756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767433708, "uuid": "adab8f04-16f4-4531-807e-f9dd3a3279ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433708, "uuid": "033088a6-2f48-437b-9b8b-7a63741c717b", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f296c3-e8c4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767459204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459204, "uuid": "96bfd05b-804b-4722-a96c-e80f8adb8382", "comment": "Malware payload", "value": "f2854322409d79312fce605ec53f7cea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459204, "uuid": "5c45783b-13f7-430a-a43d-8c81c09a2b83", "comment": "Malware payload", "value": "d3b926411d12631bda77b5c80f96239585a5c805e20c58f70566d38b0180992b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459204, "uuid": "e4472df8-9e00-4ddf-a578-0cbbafe71428", "comment": "Malware payload", "value": "c497e6cb99f290ae227d12f281bb1525ad438311", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459204, "uuid": "cea26074-be16-4c83-af90-520742acea15", "comment": "Malware payload", "value": "e34d93cd561d5cd08fee807efdbfd483ed290c6528f2424195145f27a3f7cd1a4f0d1f908ff99ad99af59a2eb86d7502", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459204, "uuid": "87642c65-dd90-4a17-9edb-add817c8fd97", "value": "T114A6AE16B7FA20E5D0BAC03995039766FE70305A533C56FF52C4C9852B60BE8AE3D792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459204, "uuid": "b4218368-104b-4798-9d15-f7a94de5d121", "value": "11d8071ca9b0d2951a0b98b0268dcd12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459204, "uuid": "50c8f146-bffe-4a5e-88fd-c5b3afefb3fc", "value": "98304:/BxWaTb1bphsD2q1k7e3YuHpoo6lL1Ih7JXj4f4tp5Y7PFaS3/HJ:PWaTBn7e3zpo11IeY2bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459204, "uuid": "ed28a057-0d81-42ad-adec-3b3fb79a0b63", "value": 9489408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459204, "uuid": "4573c031-1b0a-4c98-af2b-5dae7478e92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459204, "uuid": "e20f8402-b6ee-471e-a614-0903a94e49d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30246125-e83a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399706, "uuid": "379eb2cd-7529-4d80-8f55-f633d2dc506f", "comment": "Malware payload (Mirai)", "value": "55d1eaca2e296303f725a30e92913e48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399706, "uuid": "fc859ee1-6907-4f19-81c5-889f251dfd1b", "comment": "Malware payload (Mirai)", "value": "d3e3ccb28c1ff8cd2334b2c86e0f46302f9ca9876e02516a79f0615b22b42fb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399706, "uuid": "ad8e44cc-4288-4d7d-b47a-b0041a36f067", "comment": "Malware payload (Mirai)", "value": "0d866bb969c7a7c1bb92db0e4cdd1334c0b14c45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399706, "uuid": "7b7c20bb-4c9f-43e5-9bf2-e3dcd61ec48c", "comment": "Malware payload (Mirai)", "value": "b43333b8dc7a1b092542d69dbb674ce6c1119e720ee5320f73906b4e27d27bfe90400ccdc1ce79a803ee06a5aca1aab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399706, "uuid": "1d55180d-b75d-421e-907e-0c7936ddf121", "value": "T18483F74AF9819F15D5D922BFFA1E018D33636768E3EF72029D105B14778A92F0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399706, "uuid": "23d1612c-1150-41c4-b0bf-b05244cea2d5", "value": "1536:aRnJ6ZmylepVVFNRD5vspRHwed0H1bqo4QLiPTsGywbGNlOyiw+1g7druM7R:3Zplq3jvuRHwedIhqo4QLiPTsGy60+1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399706, "uuid": "1e2198ef-6179-454b-83f5-fd6aae4d5426", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399706, "uuid": "26274b37-a4fb-4851-a18a-d11ce291e63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399706, "uuid": "a33b6645-5868-4994-b0bf-c51af24ba10c", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5e38e2-e89e-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1767442837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442837, "uuid": "a3f3393b-5c09-4fcf-9216-7b1a0886b66d", "comment": "Malware payload (Gafgyt)", "value": "143d9e02353ac77e2b03132eb9664c33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442837, "uuid": "18827d23-9408-4b53-be56-ddc7b560d13c", "comment": "Malware payload (Gafgyt)", "value": "d4d72de0e0335c9a3f3eec7cdfd93f7fcc5ee85fc1b8692b8fdab77355db7190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442837, "uuid": "86b2ec49-eaad-4d37-b95f-77ae2bf1b852", "comment": "Malware payload (Gafgyt)", "value": "57d55bb4252e33ed573f4b942d0bff6b53ad2b9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442837, "uuid": "49b5a8a4-5c0d-4cbc-aaba-26c5f97a524a", "comment": "Malware payload (Gafgyt)", "value": "f43d615b9d4f4a54f66f3cd112b9620a5707b70addfb59bdd5a9f6fb3a1bae7c6e0116c318674e83163878d2e39ce0e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442837, "uuid": "16e24048-47f8-4418-8aef-3b25733a51be", "value": "T1CEF3C609EF611EF7E5FBDD3752EC1B02218CA02321A83BB539B8D618F58A5474AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442837, "uuid": "fea549a6-17c5-4c13-990f-311b347bb9c7", "value": "3072:GUP4maZVt81oBpciFU4YZznjIsWZ22plrpcrob:GUPTYVt8RiSjRnjIsWZ2oqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442837, "uuid": "3e363328-c6f4-4e41-bdd7-1de88781c148", "value": 167480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442837, "uuid": "8c05ae16-4da5-4557-bc3b-8b088c2885bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442837, "uuid": "2609c732-fa53-4f74-bd27-50fa07c4317e", "value": "rondo.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfdae72-e8ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767448287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448287, "uuid": "5aa2422c-2c23-444f-8b71-de501b8477f4", "comment": "Malware payload", "value": "523357090e29ed8e3eefe9a971850cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaStealer", "colour": "#329954", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448287, "uuid": "71f2c633-a860-42f8-b889-c84a69fbbc15", "comment": "Malware payload", "value": "d4f57b427a281c4dc32d6b8cc12195e0ce262c9f80ac8a8505ff3a0b47536324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaStealer", "colour": "#329954", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448287, "uuid": "d3f70868-06e2-4ee7-832e-8894956dd08a", "comment": "Malware payload", "value": "0c3c6c471aaf5a75b94d06144d266164503d546f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaStealer", "colour": "#329954", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767448287, "uuid": "8acffb86-a03a-418b-a022-d118f57f67d1", "comment": "Malware payload", "value": "a747da2f7f820ff2aee549f48889edbde66c0c3bdd6b3aeb2fa1b92fe39630c01eefd73f4efad42d9815d3c762568f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaStealer", "colour": "#329954", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448287, "uuid": "7c14c2d7-3f3b-4904-88fa-2069efa66418", "value": "T1733733E6A66855F6F8FAE338D803C55AB970F9218364DA9B43D0401A2F775A14D3FF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448287, "uuid": "f0096077-5530-4109-ad4c-2f7fa7853f4a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448287, "uuid": "844d76dd-24af-4edb-a9cd-e8c0d94b5906", "value": "393216:ToSCBUkOBJkNSaM0tABR/nlPSa7wvLw3NJH1GWaw7uW:ToSChNA/nlx8jwdJgjw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767448287, "uuid": "37acaa06-8859-4157-a88f-596051792051", "value": 23250383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767448287, "uuid": "b6edbfa6-cbc5-4bcb-b8e6-030a460b453e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767448287, "uuid": "976ed96b-cf9f-400e-8af1-940c7819d4ca", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d9ca77-e8c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767459927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459927, "uuid": "27cd9bdb-c88b-46ff-bf98-5bd22b5cd553", "comment": "Malware payload", "value": "20cb11e531b732a5e7f1d4f32550e851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459927, "uuid": "2d87cb09-5aac-47ff-86de-98189048246c", "comment": "Malware payload", "value": "d61d9e7899fae9aff3cb8b4f279f13f80fb80167b85bdef8da4b5318cf110d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459927, "uuid": "1019b166-1443-4b4d-b85e-ce74659a3704", "comment": "Malware payload", "value": "86005ae8696a5a681f35a2cab71475cd26ce19aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459927, "uuid": "ad0f0933-449e-49b7-823e-a68de1f91ccc", "comment": "Malware payload", "value": "106e7f9139ebaeb4235e83f15ac0d05c06a73515408207ec59ac8d6ddf435adc7fe477d2fdc8d94a7f491e29ac35c24f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459927, "uuid": "ffae9e81-903f-446b-83e4-3e22bb4fb90c", "value": "T150C65B41FA8B54F6EA031832415BB23F63345D049B28CBD7EB643B6EFC77691197A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459927, "uuid": "0b5ae1e0-8236-40d7-b4f7-71965b147a72", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459927, "uuid": "56c470cb-1131-4d75-bab9-085d91b686d2", "value": "98304:3gjR9W/kpygAHt5z43ZlGkCkftrn5UxoTiwU:BQst5z43vSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459927, "uuid": "0396de9a-378a-4574-a03e-aec27cf0a7e0", "value": 11655680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459927, "uuid": "cdc20049-c38f-4e5d-904d-5ea5ea2e52f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459927, "uuid": "8ca8fab8-dd68-4f6d-bc4f-030bfea7c9ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1184ec1f-e87d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767428431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428431, "uuid": "6b8407d7-8d93-4323-bcbd-e4f36c793a7f", "comment": "Malware payload (Mirai)", "value": "e05d0cd87e5a7ad96c82de2545a0843c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428431, "uuid": "d53f9242-f4fa-4255-b7d1-98aecf9629fd", "comment": "Malware payload (Mirai)", "value": "d639abd46476b4d681dd9d653f1859c04864e1570bea96d75cdcc6d111338095", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428431, "uuid": "dd9c0912-8487-4d62-a0b7-2c7af9bf3f5b", "comment": "Malware payload (Mirai)", "value": "44e0a2ccba3617ac19544115ee4b4c299b97b406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767428431, "uuid": "639c5c54-7838-4a63-9240-f24dde046300", "comment": "Malware payload (Mirai)", "value": "a1568333cd6b9047327d35881b71106f9327591c35bf379a7a53c40de76264316558ada4c4b5b472fc471f72cc25f231", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428431, "uuid": "341ff663-48b7-4c0b-88b4-ca088a300c39", "value": "T12273C71A6F22DFADFB7C873547778E209698239227E1C681D16CE9005D6034EA45FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428431, "uuid": "1b4684bb-892d-456a-9b5d-eb1f371dbf13", "value": "1536:M29VMsSUJajhOl3/WUqF9DyLcVOzPbAPb2tPbbeLQhvrNWNuM7Rx:MGysSUJalOl3/Wh/5EOQhvcNuM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767428431, "uuid": "f2395ef9-2c46-4759-8f33-9d51da8a2047", "value": 76068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767428431, "uuid": "9cdef585-282d-430c-a241-bf3620568497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767428431, "uuid": "bfa3c824-ec36-43fb-9cf2-d5f2f261071d", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d743d5f-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443027, "uuid": "aeaaa780-5488-4cec-809e-fdbc8f05f8c2", "comment": "Malware payload (Mirai)", "value": "6c76161108cc027b1bc2835baeadc69d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443027, "uuid": "6caf89e9-3312-4b85-ba9e-6fb6405051eb", "comment": "Malware payload (Mirai)", "value": "d7447909ae3e9efa36aa9b27e0d79102141c21fdae572ddb522f4ce7ad98cdb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443027, "uuid": "a6d5cd5c-0ace-4f60-aec0-002b8c2ddcce", "comment": "Malware payload (Mirai)", "value": "a16e717ac1f326cb8aec6723e7833d2d732e1cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443027, "uuid": "c07fa959-d61d-42a5-a92b-b14a1693b65b", "comment": "Malware payload (Mirai)", "value": "b8cb58a415fd7a5710f2639b1cfa55137662a07c19b6ffd8a6b47a16ceaacfdd1a1b5be9e8230980b603681e8f9e6db3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443027, "uuid": "f55ccc42-ddb2-4fc2-8d51-53609db0b3ac", "value": "T172538E26C47AED94D18845F5B8B18AB52B53B200D6532EBB6AC9C5994003EFCF70E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443027, "uuid": "73b00f1a-37d4-45fb-b927-47bb76b76ada", "value": "1536:GaVwtyJ5CZtjsGJdVURbLUR/5sBTwC/ku+7R:G+R5EQGDVURkRBsBTwTu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443027, "uuid": "33747130-4956-405c-a8de-313db2ab5645", "value": 62328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443027, "uuid": "cff18f61-fa7e-4f5b-94e2-8803eaea55fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443027, "uuid": "fbebb2df-cadf-4918-83f1-1dad57e2333e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa04193a-e8cb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767462187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462187, "uuid": "34dc4ec0-2df1-435b-8289-3f36d8488f7f", "comment": "Malware payload", "value": "68e37e3f033c82c0b8fb131904c2c943", "object_relation": "md5", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462187, "uuid": "146f8cf4-344e-49d1-a950-a65b65820a12", "comment": "Malware payload", "value": "d7582e026e27a9e4d9047a193832fd3f1a5393336d1eb55075029e8b24118b0c", "object_relation": "sha256", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462187, "uuid": "dd735c34-92b7-40ee-bdc0-a1eefed71106", "comment": "Malware payload", "value": "54b6cb9418e3337fe476ab4d993834389c3f0b43", "object_relation": "sha1", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462187, "uuid": "34439f82-27d7-4ed3-9d02-4ebf8432f2bc", "comment": "Malware payload", "value": "c46144901a2d9aaa3c135b665a344099d5b59b0b252d201ca9b3511d35ecc68cc7996700a0d6d83c3603e2596ef492c2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-243-117", "colour": "#1563CB", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462187, "uuid": "23f182b3-0fa9-4e7d-9a69-b3650e10fdbe", "value": "T1D845EA06CE3189467A88955008778EB4E8CB9DB6BB9C17D44BE14CF68390FBCBE52477", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462187, "uuid": "4caadc16-be69-418b-af4d-71e0e06b9672", "value": "384:WCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKCKo:CK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462187, "uuid": "a5c46472-e5b3-42e8-bc44-c927f8d9874e", "value": 1266852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462187, "uuid": "2fc4e3b2-55f9-417e-a549-285a7942e1f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462187, "uuid": "635f8972-655c-4ea8-b435-3392b145badc", "value": "procesos.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9df3a14-e89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442484, "uuid": "f53deacd-569b-4b74-9c08-7629d31b85a6", "comment": "Malware payload (Mirai)", "value": "e0b778f7571049bca804f01c9b3dff16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442484, "uuid": "dd114546-f880-434a-a573-b3efa497afca", "comment": "Malware payload (Mirai)", "value": "d77a56283de682127ad68d3a0eab9fa358f64b0cc40128462d4672953c70b5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442484, "uuid": "3904fff9-d4e8-466f-ad2b-58af931d6271", "comment": "Malware payload (Mirai)", "value": "90de227edbf26e13db88d159f86cfc7c5aea5cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442484, "uuid": "a070bf9d-b958-4756-81a6-164f1ddb7e88", "comment": "Malware payload (Mirai)", "value": "b5a1a25bc15ca8c5debbce5c8836e0ca89fbcaaf7ede7f32480f009b8d17e38027d7b92e16dd6baa0f5d0f727b86b446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442484, "uuid": "8406c3f7-6abb-436a-9081-b242c8bc77f5", "value": "T110631264F268BDF4DF4CE9906DD957893BCE2E9EA0D0DE72C820DF0724232556E40A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442484, "uuid": "b2725584-c58f-46ee-b49a-0e6b0d75c823", "value": "1536:kigB6jGDPgZHuGHdCr3r0KFFTbXfsiY4u+qgw09G:9g0GcZHuJg4Tj/Y4u+qgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442484, "uuid": "443aa781-00fb-49c4-ac35-062bea3eb29e", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442484, "uuid": "fbd8d2c3-6dce-4287-947b-6cfa1a8ffcde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442484, "uuid": "eb68493c-823b-498c-95db-a5a63e034bc8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc71a9d2-e894-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767438623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438623, "uuid": "622ef0e6-89b6-475f-890d-ab3ff28d7e02", "comment": "Malware payload (Mirai)", "value": "c649f0d30468fcdf8b7c9f5cf76dc54f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438623, "uuid": "8cc942f2-c077-448f-adf0-41bc83a5d8a8", "comment": "Malware payload (Mirai)", "value": "d7cd7862e6c9e39bf572f426dd77aa8f5620bde280a57f72fff3e63f507797a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438623, "uuid": "3fd47094-9aec-48aa-b2c6-62cf5b5775c8", "comment": "Malware payload (Mirai)", "value": "2b8599f53851cc6ce6bf441c463e7ff3e65da216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767438623, "uuid": "245bce58-d700-4ade-b3f2-4d044e939f4c", "comment": "Malware payload (Mirai)", "value": "8bd0b20fb1260a97d0a6d31286314b2e8fee5e59127f012b465143c59bafe7489480436a0da781e567b12ef8ad3d7128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438623, "uuid": "fd1bcf53-867d-40a2-a0f0-977c37573502", "value": "T19D535D0233184A57D5E649B0193F1BF093BE9AA021F4B3C9654FAB6945B5E331046FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438623, "uuid": "a8b2a758-5586-4c6b-b491-fd6ec663bcb4", "value": "1536:i+uQkM26VfvdC8ObU0qkvzLNHDFB0u+7RRa:GoE894HDFOu+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767438623, "uuid": "24894dcb-7b32-414b-9c48-b092c15e3907", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767438623, "uuid": "a1aa834a-8afc-4d30-b432-ed3c5340582b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767438623, "uuid": "d4873fa5-9481-46d6-83ec-b594d4a67910", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911afc7e-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463434, "uuid": "3ccef50f-a3d4-4870-b733-e80c3abc34d5", "comment": "Malware payload (Mirai)", "value": "cd17f81fb4dd9014741d0f545b3e45cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463434, "uuid": "9dbabaab-80bc-440b-9b98-1612c926a857", "comment": "Malware payload (Mirai)", "value": "d89847ea39fc153a83c24b0fa850d421d6287c4aa707f1f3dca84c5213e30aa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463434, "uuid": "0c990134-19aa-45e9-b7b3-f66e78caea21", "comment": "Malware payload (Mirai)", "value": "21a4bcfb38d4a474bbfd354901234d8c7942ef19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463434, "uuid": "9f1562da-6391-4c82-8857-58fc75750395", "comment": "Malware payload (Mirai)", "value": "c4bfb1dad0bd94b011134e81c6f3d8a67e306e63d86ca10da3a8dabddda8d151409a856b91cbce2019356c5b79b914a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463434, "uuid": "0f32a0e4-af2a-43f2-9a6c-636d88bd1097", "value": "T1E3637EC9E283D8F6FC1705706036E73BAE71E0AA211CE696C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463434, "uuid": "247044b2-2577-4c78-a227-52b5e796221d", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAWpx6x97qJ7RvsuIr5bhF8x:pnUQJ7RlUXTQpwOaOAwx6n72+uWsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463434, "uuid": "9fc54093-c172-4ca8-86f2-1855576ff548", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463434, "uuid": "a0470850-8e89-486d-a7bc-847a13a4ab10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463434, "uuid": "7cddab50-17d6-41ac-a794-177c6262a695", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf99ebe0-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767463539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463539, "uuid": "13665789-1949-4e05-9ccb-97f036d84e9d", "comment": "Malware payload", "value": "cefaf6ab7b944bced9818f84188b0053", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463539, "uuid": "bfd186b9-5ae5-44a9-b8ca-d8e02e89337c", "comment": "Malware payload", "value": "d8b1c487fea9824d699b8a561a41e754cd3a9b5359c7013862fa3aefd36580db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463539, "uuid": "10d5b988-b7eb-479f-b8ae-07e43d87f3b6", "comment": "Malware payload", "value": "2432aba58686f5111d5171cfd75b3e6006a25e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463539, "uuid": "fe74e72b-7874-4485-9e08-0097dd541895", "comment": "Malware payload", "value": "8c051e3f6a529aa99f550fb1d1bd623f390f3cb98d57eb6c823df32443dac4bff5ac9dee1d42208223c5cc1e553a09c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463539, "uuid": "f4d632aa-7155-4ffc-ab1f-41f51b0e6bef", "value": "T183654B477C91B0E6C0BA92318FA692A27B71B844473023DB2F51ABF91F367E45E76314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463539, "uuid": "0e355166-054e-400e-9e06-bb557011b575", "value": "24576:PpkPsvF7CSrb/TAvO90dL3BmAFd4A64nsfJpOSXa0lfg/oXJG7ND1P:Ppk0NCSrb/TAvO90dL3BmAFd4A64nsfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463539, "uuid": "cbfba015-65e4-43b8-b6ec-55084ba1b6db", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463539, "uuid": "57e28644-bbcc-42cf-a7dc-4a67cf238582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463539, "uuid": "08716e7f-d2a1-4cb4-aee8-a70152714e10", "value": "cefaf6ab7b944bced9818f84188b0053 elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941f79f8-e88a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767434233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434233, "uuid": "720b809f-0d0d-4084-aa1f-83f19c46a16c", "comment": "Malware payload (Mirai)", "value": "eae085219f87ff1e1a630a5988c59e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434233, "uuid": "6ad7f5d2-2e04-4583-bf6e-b3ada1bcef88", "comment": "Malware payload (Mirai)", "value": "d99930445b4ce8f14caadf176dc88d0d765bbe3ca2d33392b882024e91dc2038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434233, "uuid": "cbe4b5a8-af07-404c-ab40-56aa7fa3f6e7", "comment": "Malware payload (Mirai)", "value": "43c7d450c21da965f33444ad4c288d06e4088f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434233, "uuid": "de4c8430-e021-4f69-99b5-e0e189ef7568", "comment": "Malware payload (Mirai)", "value": "fff9e7277180f2c3cb94b74e098c0b281d5038731dd61bad3d4d525b8aef3c61e1d691b35c9ddb74df8f9aaedaa5b38e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434233, "uuid": "34500bc7-aad7-44e6-9764-b2e9bcb90a59", "value": "T139733B02731C0A47D1A35DB42A3F27E0D3FEAA9121E4F689650F9B869175E371186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434233, "uuid": "04c5b388-7f6e-454a-a72b-08afc0bc6204", "value": "1536:3rqFmpsBPb2tEfvYx5OudwqyOC1sVOcBGf5tXqu:DpHxZm1kOruu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767434233, "uuid": "bb4ad7bd-a246-422f-b82f-9b5885ce0558", "value": 79452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767434233, "uuid": "7287b1bb-c186-430d-be8e-9b577ddde427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434233, "uuid": "3cec1349-db11-4aab-9c88-0fc5e3f938f2", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93113ba2-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463437, "uuid": "eaa98b36-7dfe-421c-8b71-245ba6f39cb0", "comment": "Malware payload (Mirai)", "value": "e894c35313f48d3fac3e00120a5b30e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463437, "uuid": "f5b99af0-1f70-4a4c-b68c-3316cd2f57d8", "comment": "Malware payload (Mirai)", "value": "da2505f87016a569acb73403600f1d0e4c9c9019b1f0fe810a95fdb91556c53c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463437, "uuid": "9dd9e800-10e8-41a2-9045-a4ab65365a16", "comment": "Malware payload (Mirai)", "value": "010ff724f1b6bec66a26ef00adc5444d781fd5e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463437, "uuid": "841214a8-200f-47b9-bcfa-f1ac2ae41bbb", "comment": "Malware payload (Mirai)", "value": "7863d96ccdbe1a5f6fd4a8c8734af4209b403cf6269b8224b36c1588469b78149d1f7c2587d0b931e555921078e80432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463437, "uuid": "07824746-f79f-430e-a85b-c555823806e1", "value": "T179633BDAF801DD7DF81BD77A4853090ABA30F3D512831B376397B9A7BC721A81912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463437, "uuid": "39ec52c0-1311-40f2-bda2-c03144462080", "value": "1536:nIgNf/No0n0BDYnPq8VpHw1ox16P9dJWLa1ngChQH2:nIAf/GPEnPTw1y1y9/SCha2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463437, "uuid": "b02e8719-e5ab-4f84-8dfb-6097ca19a42d", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463437, "uuid": "9464209b-ee78-465e-bcf7-1982d3038e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463437, "uuid": "2e0b78af-5b0e-4e2c-ab0b-63c715bf45c3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335a35fc-e8c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458123, "uuid": "1b451114-446d-4b5d-8473-47c2d3fdb767", "comment": "Malware payload", "value": "47d141d34cd9d3cf9e597acb9a6ddc2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458123, "uuid": "c6de145c-eae2-46da-a882-5d5ee53ad0fe", "comment": "Malware payload", "value": "dae4e3ef73e9789b396b5f1117d8dd668bf07f6e703e7e7c18f14bf53c3406c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458123, "uuid": "c5c4c95f-8b10-4052-8ae4-31c74303c40f", "comment": "Malware payload", "value": "e922664d031af6c5ed48019ff318ee974a131f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458123, "uuid": "ff8f6b1b-f214-4f13-8f77-84f2722d21f0", "comment": "Malware payload", "value": "0b08c7d2dc8cfc67a4dcb208d31af57f78d3434b59539bc8981beafffab15bac6d3cad33fc6d8fc5973d70b890d9452c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458123, "uuid": "b8a7417f-99c0-4c95-a8f0-df9c733f0317", "value": "T12CC65B41FA8B54F6EA031832415BB23F63345D049B28CBD7EB643B6EFC77691197A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458123, "uuid": "d5c3dee6-5add-4766-a8f3-7643dbbadb87", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458123, "uuid": "aa5f6d8e-7388-4cc5-a433-f739a2cc57cb", "value": "98304:xgjR9W/kpygAHt5z43ZoQkCkftrn5Uxq8HlU:HQst5z4364x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458123, "uuid": "cb3cca50-30aa-4eee-943b-a9c8fa670b6b", "value": 11655680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458123, "uuid": "500dc4c1-f83a-48ed-b13a-0fdfea9584de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458123, "uuid": "3bfe2360-c39c-4a98-9e5f-5100160f5777", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f66b602-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767459592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459592, "uuid": "d737ca11-eb89-4908-9eb3-79412e89be4c", "comment": "Malware payload (Mirai)", "value": "59e23d6f1744fe098124864c42cf20b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459592, "uuid": "16db80f4-eab0-424f-8a7a-1b27d9455f82", "comment": "Malware payload (Mirai)", "value": "db8291da269852cb1bec2e49804d00885d576d322c8fd073917702d53bb265c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459592, "uuid": "1afdbca7-99a3-4488-b1be-c38276b88571", "comment": "Malware payload (Mirai)", "value": "c9f1578ace472b94fc627d32737b2cabaf6ac148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459592, "uuid": "d26704b8-ceb6-4c22-a402-0caa27202723", "comment": "Malware payload (Mirai)", "value": "263e6e5fcf2527108e25c81358d1b1f2a8b961025c0126f14b066646be5def8c8921082e567d485dbceb4d4635233cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459592, "uuid": "cdc85073-f391-4ba8-b5bb-76dc6e1631d5", "value": "T1AD937E02BAC0D8FCC859C278929FB276D962F42D1235725B53D0FE167D9EE113B2E291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459592, "uuid": "8d583d72-9ff8-44f5-a08e-49d03b6e2bf6", "value": "1536:Hem1Vy0ZTb8M3VTAqbHQd5qKV51JXNIkCvba5sk4BdYB3tzTb:HNfZhFAqbwd5qu1JXGVba5sbUB3tzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459592, "uuid": "d8c5924c-c059-42d3-abc8-cf7c11054d68", "value": 95888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459592, "uuid": "fff36b0c-ae87-42a0-851e-a47772a46379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459592, "uuid": "e6d48469-1a8b-4181-85a0-4628ddc52464", "value": "x86_64.uhavenobotsxddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc74fef6-e8c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458809, "uuid": "07600cb1-dd95-4caf-84e3-4295cd56cb70", "comment": "Malware payload", "value": "e70c92505128a4f85a381030c5f55fa9", "object_relation": "md5", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458809, "uuid": "8ad6b58f-f103-4fa2-bdae-ea20957c43ec", "comment": "Malware payload", "value": "dc3f65a78d171f91d2309592cd4d3528cad11d0fe5fe3ae6232150961e3960a8", "object_relation": "sha256", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458809, "uuid": "3fd7f88d-1ccf-430e-ba19-c2f912440003", "comment": "Malware payload", "value": "f145b816aa0e0ba81f44cb6ac1a3dfb40c4f3e6f", "object_relation": "sha1", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458809, "uuid": "7637fa06-b9dc-4a5e-b2a6-465df23b1ac6", "comment": "Malware payload", "value": "b29475caa88f51efc3bd1883ffe9f9a7c3cd72a0922362b2d9bcfeca143e0e60c772976d00733d79889a2939415f61b6", "object_relation": "sha3-384", "Tag": [ { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458809, "uuid": "16c38744-6362-47ec-ae8a-8615a7d820f4", "value": "T114083321B26769D5DA2FA37FD0A45FC844307DE1731BD66B73787FA589B168220B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458809, "uuid": "3e9da31f-7cc8-455d-8d67-3c00f0a66dcb", "value": "1572864:L7D8lopqPJhspfXsq0gD3QCETSryJ/7YHCRqc+0PcoaHbEI4V89IujFw:L3k44TafXsQECEGUpq9a69ICFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458809, "uuid": "bf283bc9-6c28-4fdb-a08f-2fd23ac68292", "value": 80496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458809, "uuid": "a79bcfc6-8e2e-4d62-8f03-3f988a522734", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458809, "uuid": "7deb871a-baab-4465-82dd-7203c3fe5bff", "value": "\u8c37\u6b4c\u6d4f\u89c8\u5668.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea2e81-e8a1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767443868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443868, "uuid": "3095ca35-a6d9-4e4c-8422-ddc675c87005", "comment": "Malware payload", "value": "2a71693830dad8d3c54d2badb674ab94", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443868, "uuid": "a779109b-2b50-4b11-8b96-7155252044bc", "comment": "Malware payload", "value": "dd4673e5640b4fdf701591aedb53b07604d4bc5b1658be3890a26368c5341fbe", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443868, "uuid": "a9428db3-2ba3-4a83-a27e-e2059b5941e3", "comment": "Malware payload", "value": "a0c5b6ea56da8144112c1267299f85adb5ba14f0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443868, "uuid": "67214d02-b1f1-4405-a3d1-a02241acf261", "comment": "Malware payload", "value": "6dc2c2be78a578dfb4f15aa8c61f6d4a4742eb7f2d1305f7e6285e064e1652616b1340bc7f8617c6f7df4c11202f11bd", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443868, "uuid": "510cb8af-d1e2-4271-94be-cfdf52d06e45", "value": "T10AA7334C1FBCABC27F404535949CA88E6DB756CAF5BBEF674138E3CA798A21C1213614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443868, "uuid": "88e55188-b39d-4dfd-8dd6-fa5311ec3b1a", "value": "786432:IdJmsRsdZZCjcm9uoP5agLrT11MGpmAAnlDUgoGVxT+EpThhzU6HBk3ngOrWFNgq:IjmsSocOuoP5aUZpzClAgCQhhwN3ngOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443868, "uuid": "dd331a59-4484-4eae-9900-009badb02d0e", "value": 46609913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443868, "uuid": "ea96628e-6593-4921-879e-9b831b3ea7dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443868, "uuid": "75c0fc83-4905-41ec-ac1e-a55c0655deb2", "value": "NyxoraV22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ad02ac-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465155, "uuid": "da3795c1-1346-4ad5-a9bc-c6cac195c445", "comment": "Malware payload (Mirai)", "value": "f1ff602012928df183d9a53d0a915799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465155, "uuid": "c3930df5-b22a-40c1-8c0c-17e2a29dd698", "comment": "Malware payload (Mirai)", "value": "dd62bf1f88c40246c6aff0972fcc14798ab67dc6e90f10fbc1b966127f42ff11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465155, "uuid": "0e089e8b-94a8-48db-8c51-63e01212c9c3", "comment": "Malware payload (Mirai)", "value": "aedf9e00309371d9407cfcdec9ea06392c8ffeda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465155, "uuid": "db7df148-6bf3-4423-bcf7-61f20ae1b6e2", "comment": "Malware payload (Mirai)", "value": "a30412a0f7299bd5c720372be9db0ef851613529a8b353bb5a3b1b2b820058b4f04748bfc5033e71882968fd24158852", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465155, "uuid": "0515e036-abc3-4bc0-a207-289e7f239b47", "value": "T163C32956B9929F01D4C735FAFB9E414933136FB8D3FA71019D206FA1238A99B0F7A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465155, "uuid": "878e25b4-1950-4ae7-9870-4c54b00abe56", "value": "3072:i5pLJFb5wKDMa22C5B1nLE1iZNjLuztDOpOMm:i5pLJFFwOMa22C5B1nLMiZ8zxO0Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465155, "uuid": "b452813c-5ec1-47d3-af24-f82e514e8f3c", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465155, "uuid": "8bb4ffd0-a9b8-44c9-9381-b8489531a092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465155, "uuid": "36eb681f-14c7-4985-9a7c-7e5dfe080c39", "value": "arm7.kok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54f13b6-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444650, "uuid": "c42b58e1-22ee-427e-a542-032130ea0343", "comment": "Malware payload (Mirai)", "value": "127f0288a54fd501743eb22174c5243d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444650, "uuid": "0485c7a9-8687-4719-8b43-4aa5c9f12a5b", "comment": "Malware payload (Mirai)", "value": "dddbf25be9e6ca4b13c2c33159aeedf7d4a7accecd53b87aa5d2406ab05ecfa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444650, "uuid": "76064b89-ba57-4e91-ab0c-d7eca2b7b1ff", "comment": "Malware payload (Mirai)", "value": "d044a7f7b580d489c54e11a6ce703b017e77dd3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444650, "uuid": "55830a8c-8258-47f1-b799-a46bb874da8f", "comment": "Malware payload (Mirai)", "value": "732d85f0bfee5636264fda7e443116719fac7a40229f123e3aa87d1aeac872fadb68d6942be0e0bcca4132a154e614a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444650, "uuid": "4634d176-1573-4579-9ddc-fdd8ac9442d5", "value": "T14213E107DEEA8622EE7624332987FE435904D16FE8078E53ADD43177DDF0E416926394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444650, "uuid": "d5b0ed2e-a0c1-45a8-b626-bc882f1653b4", "value": "768:PlIUbfix5uB+nziFBWxpGhcFnBcoqN4pxGryCfDBsqb8QofmwCC/PWI7TnvVqZ7A:PlPbfV+nziXg1RvcBfWI8XmwC2OgLsZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444650, "uuid": "e31df196-cd86-495c-81f8-d879e8925a49", "value": 41729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444650, "uuid": "43568cfe-dc18-4891-a022-10be6db70026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444650, "uuid": "7c68225f-b510-45d3-9efc-889621e64b87", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3739be-e8bd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767455938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455938, "uuid": "130a6732-eba8-4bff-83df-554b23b0b17a", "comment": "Malware payload", "value": "a75963f16226c1e67b0254411c045e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455938, "uuid": "4d2bed14-86c4-49cb-b3b1-352fa2a912ba", "comment": "Malware payload", "value": "de84d30f33ec188bf7bb4bee5db11b592176ad4b90efe6de8423b221bdcd48e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455938, "uuid": "cda59bc9-1621-42cb-84ed-dc33eb35c0bb", "comment": "Malware payload", "value": "301a6182e972c5a38b6fd12ec01d35bd9771cf8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767455938, "uuid": "e59e8e35-a4d0-40bc-89e8-cc11112b7f87", "comment": "Malware payload", "value": "7c944801946b113e03cb2f212be4ec4d6fb2e430409ec5cf178a7e5f9f7888b1c5c80ad1437f929f65747bc74576e235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455938, "uuid": "a4c62a99-c158-461b-a86c-957934096f66", "value": "T1EC762883EE904264C59FD1389DB5A2467234B445533223D77E670BB24DCEBC85B3BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455938, "uuid": "192a30d6-67be-4a16-8c6c-b952fdbcb78f", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455938, "uuid": "c9108a39-2e72-459d-bc29-e9d7397e43c3", "value": "49152:Wc3Pl/rb/T9vO90dL3BmAFd4A64nsfJm1wk0Dj8650z+YSxu8C34//7UPK1xDnME:Wcr7hM1MXMQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767455938, "uuid": "1704bf73-fe9c-4370-ab7b-1d393c1644f9", "value": 7181952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767455938, "uuid": "9d437eaf-97c9-4cc7-9956-e5b1966f7b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767455938, "uuid": "cbcac159-9a6e-462c-ae11-f0a5486f898f", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1e8e90-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463431, "uuid": "41bc06e1-ab42-4d01-bc9a-d57a965a75c8", "comment": "Malware payload (Mirai)", "value": "5ffdb671f31a1510b7aec43346033da8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463431, "uuid": "8c349d34-c31b-4152-8560-928733b5599a", "comment": "Malware payload (Mirai)", "value": "dee5b977943e63dd3623c0ddb787091ff495044551f022c9228ae4cf364196ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463431, "uuid": "73ec6b81-dd2a-4d61-b143-b11254650e2e", "comment": "Malware payload (Mirai)", "value": "9bfb793f9b74d4c9baf14de0fadc0a4fd766826f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463431, "uuid": "2ba7d186-f34a-49fc-ba35-413cd1879b65", "comment": "Malware payload (Mirai)", "value": "1a7d0a23c63b751bfedfea7cdfbb31a9d914453c3158f666fe91a1e84a99366cbb7b989efc5cc4097da10e507e9b268b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463431, "uuid": "c31d30b9-e119-4514-bde0-92acf554b23f", "value": "T14A03F751BC829A37C2E1137AB66E4A8D336163E8D2CF7217DD204B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463431, "uuid": "e81cbb71-3111-4097-a18d-124f7e1f62ff", "value": "768:kg4QCbvsG5f0OlnlUlQOBFdApwAUb9z/W56v+b8O7LDUXoTB/NwwW:kRbEG5fXlUlbH4aScv+/UmLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463431, "uuid": "a3dc65f2-9336-4771-90fd-6a43d579933d", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463431, "uuid": "f5ca4c18-1d4c-4a6e-b2a0-76da2af976bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463431, "uuid": "533cdb96-6ce6-4366-8901-3aafa12f4b24", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934e6a03-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767465156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465156, "uuid": "31827425-f1d8-4047-92ae-753f19a34844", "comment": "Malware payload", "value": "fdc177c008c23440e316fc5423d66461", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465156, "uuid": "ded292eb-df1e-44fe-adb4-43ca75aa62b0", "comment": "Malware payload", "value": "df688e5930ad7993f3b5501fcb3edcf964239e345dd9a58eed72bb579e3eb07c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465156, "uuid": "e0e3ebf0-3302-4170-9794-287f901b7d0b", "comment": "Malware payload", "value": "43705534196eae404ca0f43b017993c7d83e1e3d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465156, "uuid": "8e46fc53-aa2c-4c97-8e61-790c9980a04f", "comment": "Malware payload", "value": "aa005682f2fd5e08db4490016c2f7ae87335f0766341aaa86f19526fa74b950664bd8a4eb7dc18420566235a561037d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465156, "uuid": "e169d36b-6f9a-4561-aaf3-4fa1650b3c83", "value": "T1154195CF053E39154EC7CF1F73F646CA5195E2E1A1838FF5684C043A9889898B99DDA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465156, "uuid": "d1426433-1f00-4b1f-8e55-8b6ea138af11", "value": "48:WVThJWVjNJQJrmz9AjUZr75ySAGJGOWC9Q58oqk7hqGqPn2:WVThUVjN6JKzijUp75ySAGlB9Q5zrhZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465156, "uuid": "0b950a53-14b7-4772-b87c-320e8cc8a7e9", "value": 2052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465156, "uuid": "4b0b78cc-83e8-432b-aedf-541814987695", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465156, "uuid": "2458a39f-2454-4c59-9675-ab62a72f4440", "value": "logic.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7930d47f-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443207, "uuid": "a3cffc58-450a-49c4-b52c-5145f5d412e3", "comment": "Malware payload (Mirai)", "value": "802cc00de23dd1b9025d65b883888d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443207, "uuid": "f10cd9c6-a7f1-49d1-b57c-f518c9a549f3", "comment": "Malware payload (Mirai)", "value": "e20864e7824c5b484b8b09b39a549a5efb88e7d0e4198728f6af9eb7177c22da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443207, "uuid": "f98730e4-3563-4617-a6a8-1fe8799f5543", "comment": "Malware payload (Mirai)", "value": "c0734df1da96f09ce302df2eb0bbb8a05148a22e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443207, "uuid": "e0a8c2ed-a158-49bd-92c6-8ab5e36658c7", "comment": "Malware payload (Mirai)", "value": "0d395136d480336605b2f20abde5a77b1f2503edf4b5850c4f473ca898035a5c2f258749acc7638914964e3b96beefe1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443207, "uuid": "1954290c-7ba5-4d6e-872d-909bc6ac5dd9", "value": "T1F4534A217A796D1BC4C8B87E21F78234B1B1174A32B8CB2A7E720E5EFF1055461179F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443207, "uuid": "7167defb-2bff-4733-8f2a-1e2026ad37a3", "value": "1536:HpcSTDaKFCQhk2il6Djv3uad9S6/BlXe8chG:JZtoQ2O/fXe8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443207, "uuid": "0a010dd3-89ac-4e61-b6a4-b2a2f21c0ca1", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443207, "uuid": "e4376eaf-e862-4501-873a-85f8b436d781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443207, "uuid": "727f8db0-8848-45c8-9ad4-23d000fea213", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adadd69d-e844-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767404211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404211, "uuid": "5ec8049a-73f8-409c-b124-7e1b61d92cac", "comment": "Malware payload (LummaStealer)", "value": "1887db648d4209d4f3822efa6623093a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5211", "colour": "#8C7088", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404211, "uuid": "56f1d54c-4756-4722-b196-f5eddc1f8494", "comment": "Malware payload (LummaStealer)", "value": "e217f6bddfedbea968476ea8c2c1cfbccc0c7a7628a9528579ab6dd731a3a756", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5211", "colour": "#8C7088", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404211, "uuid": "624f564c-d63c-4ae6-962b-3ad6c44c8dfa", "comment": "Malware payload (LummaStealer)", "value": "6fbba52702705d1a2f0874478228bb16175d0ca3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5211", "colour": "#8C7088", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404211, "uuid": "77fc5c1a-ebe1-4223-83e9-aee39ffafaf1", "comment": "Malware payload (LummaStealer)", "value": "6eb1dc92a809ff30ec7553e10d8fb0c78290adc4bb7515608729d652e9832be3528b8231fe4ce11ff4e64bec3da1a885", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5211", "colour": "#8C7088", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404211, "uuid": "f72d9bb7-a80f-4933-b72e-006ae4787640", "value": "T1D5E633D0149661F04804E3692B7AF7177AFA127F8360B96C765A30C4F8FD3BD8A39526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404211, "uuid": "c80b3a02-33d4-4ab7-858b-b917f142692b", "value": "393216:yjX4wGdE9fg1NnhGyvBKI4Gn4nioUWaxmK:s4wGdERgvLvBoqRmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404211, "uuid": "d23408df-ffaa-4f72-ae9d-06046831dca9", "value": 15105571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404211, "uuid": "caeb5500-853b-46ca-9d40-a4df35da924f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404211, "uuid": "e964bae4-7a96-45ec-8682-8838325e5313", "value": "cx-programmer 9.1 free download Full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c099466-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429280, "uuid": "241a38ca-a891-47be-917d-cca1519d74ba", "comment": "Malware payload (Mirai)", "value": "ebc79ce087e882bc632f2715bce91d47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429280, "uuid": "1f8d3fd6-2288-4cae-8bc8-29412d355401", "comment": "Malware payload (Mirai)", "value": "e396a80885361c6efdc29b7fccb8a93de8fa847cf186b3965621159d26eedccc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429280, "uuid": "7a1c1a49-4270-4cb3-ba0a-6f5248530747", "comment": "Malware payload (Mirai)", "value": "67452f2445394f0d20fe760926bd9abae5c5088e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429280, "uuid": "52581052-eceb-4971-b37b-24667cf4248f", "comment": "Malware payload (Mirai)", "value": "742a38e2c46de5337b09a6b749727e68d536c34805a8304945afdb244e4969b2006b2644d0c16c658ea704627759c489", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429280, "uuid": "fc4dee8a-b319-4aa3-bf5b-c689bb57d271", "value": "T11F63023516D72DF8F530C13EB6FC6A8B75D42F94C08A37A1476942B8FAC31351AA9E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429280, "uuid": "0f6dbca0-67ce-4b08-8866-cc464cf355f1", "value": "1536:B1BGt21Z5+8o2uBD85FZ/KhVyPE0M34mkYd1zG:gt21Z5+tzBA52KPE/4mkI1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429280, "uuid": "c894e321-b205-4b0a-920b-2326bda82977", "value": 71348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429280, "uuid": "6d7cbcb9-4997-48fc-ac4d-65a0212b40e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429280, "uuid": "9063ec32-0c42-47ca-94b8-cdae5c333005", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4c1b82-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767429277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429277, "uuid": "79c28442-bff5-48d5-abe1-14e991d7b84d", "comment": "Malware payload", "value": "364b9c5e434ef76887a0c9affbbbe68c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429277, "uuid": "92b25931-ab9e-4711-bf21-41c0f30a2f13", "comment": "Malware payload", "value": "e41e242833a266fa3116628be7dc61722c79a29acfad0e350920856af7032ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429277, "uuid": "41a75850-715b-4708-aa55-493540f7e53f", "comment": "Malware payload", "value": "8c7b42a7d4833aa4a4d60de4dce42bbf6338bd60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429277, "uuid": "8c0b30db-df42-44d2-a9cd-9bff2e35cd65", "comment": "Malware payload", "value": "fd56d18907ab94509891ef3751c793fcfd0a978377397a288e3fae23b8c30324ba536d474406e954027cb8b5ed0199c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429277, "uuid": "3595630d-392b-4274-a84e-f892a67b1aa9", "value": "T12AD47D58FF4E3C42E2D7E278DA4D83E1722B71E0D76391A33582024DD5CA9E9CBE1A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429277, "uuid": "e8631b8e-c0cb-448f-b42b-3b403e8faa0a", "value": "12288:DWc/T2LtrnWvzMD/GYloje/drOf36l6eE9GB06gyNwjZ0iyw5kXFo+S4:DWcyLBnWv8Ae/drOf6l/palzKmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429277, "uuid": "ef66750d-ee0e-46b1-8439-54d6157e3ae6", "value": 638880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429277, "uuid": "bdcb5bbe-f4ab-4b3e-8594-db8f92c2ed27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429277, "uuid": "b48fb3c9-b378-4375-8f11-89b043a2e72e", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2857f21b-e83d-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1767400981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400981, "uuid": "f7a5ca01-7224-4b2b-89b1-f495fa9249c2", "comment": "Malware payload (CoinMiner)", "value": "1790e163ba801ac5605837386d196f73", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400981, "uuid": "69a9f8f6-0f8f-4d4f-bc91-c89fdf18f313", "comment": "Malware payload (CoinMiner)", "value": "e47c960ef8440011c734c536e17021a2bef7dcec0f1584a4e2d583c30d47ffa4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400981, "uuid": "73dbdb5c-4ce2-4c2a-a323-6f2b5f52d0bb", "comment": "Malware payload (CoinMiner)", "value": "489fcf486d9e818cc67574f6a2e52d4e71fae3f6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400981, "uuid": "08999754-bff3-41e5-b400-46c0aa84a5e9", "comment": "Malware payload (CoinMiner)", "value": "3e1b95f697decaa9cdd923bb9a129fa72bf23e6c953c0f4cced0984940e8d57c97a6c84e27ff1ef81d8e795313a531f6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400981, "uuid": "15a78ee5-fd82-495b-97e2-54abd77d204f", "value": "T17DD05EEE1CD53227136AD8116909169ED24B06AB4D465922941940BD21B9F802A966FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400981, "uuid": "06e1efa5-5183-4893-9fe6-720505331921", "value": "6:+DORnsz50IJVOlAkFopG/C0FdzjhBFaoOogEHvkqQTK3HvV:UORng5TvGP/DvzaoaEHvJQkHvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400981, "uuid": "a207573a-e3d9-42dc-a67f-18d17d02fa2d", "value": 242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400981, "uuid": "e71f5b45-ff8c-46d5-8cc6-8a382dd699fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400981, "uuid": "55d0d884-95e0-42e9-a10a-0fac403c48b4", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444b3053-e87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427227, "uuid": "bde1d6c2-5a16-4e35-bbed-fe0390ed8417", "comment": "Malware payload (Mirai)", "value": "0c45e97e06b08e3a8423742345b17d38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427227, "uuid": "aff4b412-d38b-40a1-bb55-fa3adea068a3", "comment": "Malware payload (Mirai)", "value": "e4af798ef4ee50d200befbeb5c43407fe52890c4a9fb36d5e5a8b611f3373456", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427227, "uuid": "05d60be0-1d71-42cd-ad8a-85c80aacbe9b", "comment": "Malware payload (Mirai)", "value": "8f7e016d1cc57da30c7689d96b0c772c7d93daf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427227, "uuid": "26e7e82f-4914-4181-b652-eb83d213fb77", "comment": "Malware payload (Mirai)", "value": "f9c18f9bd411ff5afe08523cf1503c9d811880b0c3f5d76bb27bc827713814dc976bab37c9f30df7dd22848838e5a4dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427227, "uuid": "d7f88cd8-33f2-4c43-a551-20c866e3d56b", "value": "T14E93F74AFD819B25D5E822BEFA1E018D33535BA8E3EE7202DD105F15778A82B0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427227, "uuid": "56bd18bf-1cc8-4a31-b173-361485ed2a37", "value": "1536:RRnb2tRVZ6eoNJQzcqB8ct1sx4peHweoXZojpHHGVGQSbpPDQG3dNl+CiJ0qfFh7:OzZOJQzVB8212JHweoijpHHmGQSbpPDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427227, "uuid": "fca42b3b-118c-482e-a163-349e85ded735", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427227, "uuid": "4f81639c-f047-472b-8029-db18289453ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427227, "uuid": "fcfa7e65-4709-4562-a765-b0ab70e47d79", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3950f4ed-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427638, "uuid": "8bc86ed0-2b27-430f-8cb9-c20582d4e4e9", "comment": "Malware payload (Mirai)", "value": "a954ea16d03cf786af1a71b27e26d51d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427638, "uuid": "7f914888-ca4a-4287-a7fa-c1f21b66c7e5", "comment": "Malware payload (Mirai)", "value": "e563ddddfdbb09171c841d17e35c63f981215a2a350ca2815fd3db898896f53e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427638, "uuid": "2127fef8-7cf4-486f-ba80-c1a1f275793d", "comment": "Malware payload (Mirai)", "value": "3d0c763addc42eaf47d433df131353f86d3065e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427638, "uuid": "2dd40e1f-279e-4639-ae74-c086e15b9df2", "comment": "Malware payload (Mirai)", "value": "b24a78bf92c4ab17b09ce9eab1a761b26a161b5f7128be41c075a5ba86273b7f5b181cbb79707596a2474f9ea02feeed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427638, "uuid": "5ced5d5d-1d90-4ed4-8255-13002375c653", "value": "T1A95302F1DD69D484E1C940BA0DE77D9E0142ED16D91069F6FCC86D794A22FB01E2EAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427638, "uuid": "b507f9da-2aee-4bf4-9a95-9fea305915de", "value": "1536:/J5h3s4S99sIDIK8BSjLuWDIljqXhcN/YbaRDAhyR8t7jJjnouy8Gyd4:/J5I9s3Sjiz/dayEjZoutJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427638, "uuid": "0d678e3e-8094-414f-916a-714cc3542475", "value": 64088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427638, "uuid": "02cdfd1e-b1fc-43eb-abeb-77285c856a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427638, "uuid": "afaf22db-5a31-41f4-a999-746fa3a9057e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe0d320-e867-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767419348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767419348, "uuid": "7c10e95b-fe74-450c-8a29-eb3be7032731", "comment": "Malware payload", "value": "fd04aa9001b1c4cffa5671eaa44c0f9d", "object_relation": "md5", "Tag": [ { "name": "Conti-based", "colour": "#F8D732", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Sauron", "colour": "#064526", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767419348, "uuid": "eeb2fbdf-3fda-40db-acc5-e31abc939f9c", "comment": "Malware payload", "value": "e57e4e8e7e2816d4603445d2defaaa73763e164ede1a5e9ec13fb14d17d4fd41", "object_relation": "sha256", "Tag": [ { "name": "Conti-based", "colour": "#F8D732", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Sauron", "colour": "#064526", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767419348, "uuid": "f40b5147-65a4-40bf-8ade-1a70137d6f37", "comment": "Malware payload", "value": "dbd7c5fc4990ef4ddaa0eea099d557e2c726d49e", "object_relation": "sha1", "Tag": [ { "name": "Conti-based", "colour": "#F8D732", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Sauron", "colour": "#064526", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767419348, "uuid": "b9aabb23-6df4-4b75-894f-36e6bd2a81f1", "comment": "Malware payload", "value": "08211e516a58d673dc12516a53f59d408d252e7fc644c59bddf8fc42a3150813d812e87ef63702de1ee7031a6ead4336", "object_relation": "sha3-384", "Tag": [ { "name": "Conti-based", "colour": "#F8D732", "exportable": true, "hide_tag": false }, { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Sauron", "colour": "#064526", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767419348, "uuid": "e5f4278f-0331-4c67-a988-1cb51d4b9f04", "value": "T16A2422E13FFFE2A22A810465704E4B3C612CC92E44DCAAE1F0567E0C94D48ECC5EDE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767419348, "uuid": "5db2178c-6b70-423c-8e62-b54cb90b3150", "value": "6144:K+R3LLRQwD9g1dkrz7PiqSeaf8hc/y1wLAIdoB80GIbq:KmdpRykr/cK4220GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767419348, "uuid": "c308c7d1-8a98-4f97-b3ae-82181da8007e", "value": 217239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767419348, "uuid": "db45c6fc-313e-49bc-9b00-c0d9d2b78017", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767419348, "uuid": "78cfdec1-0733-4798-a641-9a0dbdbbfc6a", "value": "805ebf2efdc55295289eff342adae101f9b10a80c4444c2518fc8459bf2d9b25.bin.sample.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c54798-e8cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767462482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462482, "uuid": "b79c0037-3400-4748-9cb9-001e2013eca6", "comment": "Malware payload (Mirai)", "value": "eb68d2ce24cc67f555df969c2e1f5e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462482, "uuid": "4c2f192f-53e9-4d48-b53b-c496b9b2ff94", "comment": "Malware payload (Mirai)", "value": "e58201dca7e8add8d79f311c5e416f09bc1db187efe2ead3a839df26a9ea7422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462482, "uuid": "3d34031a-6437-44f6-b46e-77ca55e9e0ba", "comment": "Malware payload (Mirai)", "value": "541c73583091f0a0d233571b2177be014076b5ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767462482, "uuid": "57775528-52e2-4181-8dcf-51f800d0fbd2", "comment": "Malware payload (Mirai)", "value": "6c5c044371621d0e4d87d644833828ae4b4e08cc4e1514b977a3b4f735392ca62ee93ca214cdcdeaafa3a51fff618d76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462482, "uuid": "5fb05e1e-79aa-4b99-9f87-56dba01ddee6", "value": "T106E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462482, "uuid": "ca193588-cbdb-4483-8e0d-208822c7cefd", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvbPhLZ85iBMR6yoC1QM:walgM69pe0QmlTvI8t9mrsplDKZUQQBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767462482, "uuid": "43be9709-1bc1-4a14-801e-78a2377259ed", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767462482, "uuid": "859bdc86-ff3d-48de-a3f1-ba411017fa13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767462482, "uuid": "5d8165a5-68bb-4e98-9748-b74f03c87710", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6009ee6e-e892-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767437582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437582, "uuid": "17bf1c54-b0aa-400b-8664-7ed47a1e3fbc", "comment": "Malware payload", "value": "b755d8aacf897adcf2a8918940c3ff4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437582, "uuid": "5c8bf7c0-e188-4315-8ce8-7fcca941126c", "comment": "Malware payload", "value": "e67a634cb2d96d28e3138a64bd659a3bc0d2640094f825d820bfbb080dca0b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437582, "uuid": "756c80ec-a4c2-4468-84f8-b44fe8e5ea02", "comment": "Malware payload", "value": "320e8b6b18ddd1519cc83839c0521a3e95fcae0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767437582, "uuid": "868cda13-61b3-43b2-b919-e88d1861a19b", "comment": "Malware payload", "value": "643c8363360a539c2c9c248436748063a35b739280227e7cd33b70674e0fa711830f12534d1afa3818ff9cadbc8d5bbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437582, "uuid": "9c3da654-0878-482a-a815-e460ee233331", "value": "T19A915CA0F7B90863D44CF53DF0DA40D9598C5A85A08025EC9D9BAD7AA045F5DF525007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437582, "uuid": "3a85a5d2-0f08-4cb5-b5a5-dbb35d46d814", "value": "96:G3xBoCUHclW49mrxCPa/2QbgFeQHnAe2Y4DT7j4lSg3+hq9TG:G3HpdlWcsCi/9epHnATD4lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767437582, "uuid": "f6331419-daf7-43cb-8703-59700a082aba", "value": 4498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767437582, "uuid": "96f82a30-c8c8-46bc-b589-8506cde8aae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767437582, "uuid": "af225de0-560b-46dd-8e2f-1ad1e44b34b9", "value": "skid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aad9ae-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429325, "uuid": "979d9327-2386-4bfa-90ba-0b0669e9ac30", "comment": "Malware payload (Mirai)", "value": "91428b5ab434b1792a048f82b4feb9d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429325, "uuid": "b0825197-5b69-4319-8369-e60de073a287", "comment": "Malware payload (Mirai)", "value": "e6c570ab44d79a67dd9c141e619c6311ed6a159cfc1dfad8b576216820836d56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429325, "uuid": "b98250d0-f0a0-44d6-8d44-a0a80891f2e2", "comment": "Malware payload (Mirai)", "value": "cd7bc8199b8fe0bb4a4fb2f555d1a406539c7a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429325, "uuid": "04071d90-17ef-48e5-894b-c5df47d68456", "comment": "Malware payload (Mirai)", "value": "f8dd1c3ef952237a06a6313f6afbfb44723196d2a65f2b5f2e84f04eaafa3950b73caff9476205a23e548ac6efbc1b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429325, "uuid": "77d923c6-7556-4efc-984e-c1f7b9e0201c", "value": "T10B143A06B5C180FEC499C1744BFFB13AD972B45D5238B29B67C4AF222E4DE701B6DA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429325, "uuid": "aee7afa8-33d8-4ad3-bfa2-d8fa9abcc18b", "value": "6144:fmneEfgAddO70EZyZcoXzwBuYZRU//bA1:O3VXzwUY8/01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429325, "uuid": "387a1fc2-17b7-4f24-ad71-b7eb408b409a", "value": 197288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429325, "uuid": "68b0d830-c80d-41b5-94fa-33c3d13e4090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429325, "uuid": "0a968afa-06f2-4bea-a5ed-4eb392c567f2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5138ded7-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431114, "uuid": "1fa67999-b6d5-484c-b429-adca480fe86c", "comment": "Malware payload (Mirai)", "value": "172633822dc3ab9fa9ce49d04a89078e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431114, "uuid": "934c50eb-41f4-42dc-b7d6-19f59b41674d", "comment": "Malware payload (Mirai)", "value": "e757e120f93e76ed62e87f26189c19d55f9cd2016894925f645d49b374eba25c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431114, "uuid": "7fbeafcc-6bce-4a74-b0d4-0f971f28a9c0", "comment": "Malware payload (Mirai)", "value": "0a19a933454073d0dcd8b32bf7dd21e423393ef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431114, "uuid": "84910d64-466e-4adb-ad2a-3af9c2ccdbbc", "comment": "Malware payload (Mirai)", "value": "90beedc2c4f1c8e373d1a61f338e52c9a3540e3ac8fc511d961572394fae0fa6e83cba1a038dbfde2b869ffd70712768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431114, "uuid": "a859b5fa-59aa-49a9-a2db-8b81f5bad807", "value": "T10683B60A2E219F6DF76C863587778F31D798339226E4C245E1ACE9005D6034EA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431114, "uuid": "08d6c4c6-2d1e-448e-bbe5-f9d9819edae5", "value": "1536:eK7FLNondaAlZwOwkXEmxa+qGqpgfoaB2ij43jlJ3jjQoi1/tquGcu+7RyiT:ekNUdAaavGBHOi1/Gcu+oiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431114, "uuid": "4dc9dbd7-bc02-47f8-9004-8c4cd672355c", "value": 85848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431114, "uuid": "ef29f1e5-c4bb-4d55-b69e-0c38ea2229c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431114, "uuid": "ccc9ee1f-5e5e-4cdb-94be-45be7f658277", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a105c5-e87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767427761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427761, "uuid": "f1fdf6d8-dc14-4473-9552-2c74d48cb60a", "comment": "Malware payload (Mirai)", "value": "8c76c1caaf36279f2c0ce53798dc97ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427761, "uuid": "173a6035-2cc7-49b4-bdff-a5ced2c6b8c5", "comment": "Malware payload (Mirai)", "value": "e7dd4a7357fb6753274c42c81dc20a5ef114f865df8079690563d88de4b62da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427761, "uuid": "b14c7365-5fac-480b-a59e-c7792cd2c9a3", "comment": "Malware payload (Mirai)", "value": "c6e0a4c4f6cbd0edba96fd4ce53ae91b46b3edc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767427761, "uuid": "51255982-b9a8-490d-8553-f5f624b4d1b8", "comment": "Malware payload (Mirai)", "value": "fbaf4766b12b34e81227e631256877a3cef3ac243545f2881b2ac7eede018b5313d4be04797d3cf3490b95fc3737d7dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427761, "uuid": "5c7f0fe1-39b3-45ba-91df-37b27fbbf5b1", "value": "T15683B60A2E219F6DF76C873587B78B31D798339226E4C245D1ACE9005D6034EA85FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427761, "uuid": "a2ceebe2-48cf-4446-b992-e47e8e601b6e", "value": "1536:eK7FLNondaAlZwOwkXEmxa+qGqpgfoaDDij43jlJ3jjQwy1/tquGcu+7RiaT:ekNUdAaavGBHVy1/Gcu+IaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767427761, "uuid": "d889056d-5912-40d1-858d-6294c8ee11c9", "value": 85848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767427761, "uuid": "45f310d9-a6a4-466f-b633-ad3a6af7344b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767427761, "uuid": "16b68c18-1e6e-4fb5-ae09-a36bd1314389", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a63a1b5-e838-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767398918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398918, "uuid": "ce98242e-d8fc-4e37-950b-dbe0fbdb5bf3", "comment": "Malware payload (Mirai)", "value": "61dcd1e4c1968d7ea73fd63c2c84087e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398918, "uuid": "b6c545fa-a16f-44d1-ad31-8985cb8098db", "comment": "Malware payload (Mirai)", "value": "e905d11773e452072b65391ed46e1cd86a635d96155935c41f7f49b48e4fd24a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398918, "uuid": "e219e4a8-550a-4207-8691-e3b5c72d95e2", "comment": "Malware payload (Mirai)", "value": "dff512e6341f1d092d00b1ecd7e45942e64d5c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767398918, "uuid": "30f5e713-48a9-4df6-98dd-ffac8fe411ac", "comment": "Malware payload (Mirai)", "value": "cc59b1ab07f38b2c6e9f98204874a5c95b1845e75b3b45e64f002d70f9ce71bcbc16ad4be26e4d8f79094f6b70623e68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398918, "uuid": "e8a1a6bd-e2e9-419d-8541-c1e8600a930d", "value": "T1F9F2E15050FBA7B9D63508B3F7B4A962BA924774B1B433E9C4D50544CF8294A32F8B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398918, "uuid": "f9f24e80-788a-4489-ad3c-b47c3101317d", "value": "768:Cqx+uaclJlJpOcUVvyaAVHrYU6ryJwGymd260yneB4+s3Uozx:CqxPtPJhUVvyrVLFHSmd2HS4Ezx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767398918, "uuid": "670baf6a-f171-46d4-97ee-b848c536200a", "value": 36672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767398918, "uuid": "426bb515-2821-45c3-85c3-21eead44116d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767398918, "uuid": "8feadd6f-4d5a-49fe-aa2d-97a818c02d33", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f97540-e8c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458092, "uuid": "92c79ee1-4a61-46d2-ad37-e8aeae550d2b", "comment": "Malware payload", "value": "000dd4a02f8ee3834695c73057447bb8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458092, "uuid": "9f8a917c-479c-47da-9472-5618b49d8f71", "comment": "Malware payload", "value": "eabf7bdb824ad80bf0f9e9efea896b80d88cc20c70e71e7880072a43d4ea99f0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458092, "uuid": "238a27e4-1b0b-4703-a685-ffefc7bb3d87", "comment": "Malware payload", "value": "08e56c122089291e849ccb5e5de967a13a536671", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458092, "uuid": "e5c7d938-2514-4932-b4a8-f867b79cde79", "comment": "Malware payload", "value": "42907b8419706395dc3ec99e2629c146d684a061eb017cd1200b1037ce9fd51280d585fe00a9cfe97cd24d5398b4df5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458092, "uuid": "e8f91c43-380e-4e8b-a131-7aabaa71c461", "value": "T1ACA65BC3BE584215DA9FD239E87116576230B085173222D7BFA50BA98D0BFC45B3B72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458092, "uuid": "5cc4d677-0260-4d96-a70b-09ab0af9d41e", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458092, "uuid": "5cacf6c3-bd1d-4a54-b183-1f8692a46725", "value": "49152:P4xmvNwrb/TxvO90dL3BmAFd4A64nsfJ+mJI4IOHU5G5BV+Go9B4aIxG2k6a6DlG:P4xME0VcC/NqcSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458092, "uuid": "4bd1c36c-62a7-4b1f-8333-50ddc1d11b83", "value": 9865344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458092, "uuid": "93bf0fea-c552-43cf-aa2e-0e2a31c378ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458092, "uuid": "2a267f10-4941-4ac9-8484-f22c9ad4dcd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da66ee6b-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454108, "uuid": "a126f54b-2f1b-4de0-a4d9-4026adb4c82f", "comment": "Malware payload", "value": "f47554d14a3156e4073de28dfbf82afe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454108, "uuid": "e338f02d-ad68-4154-b074-99ee53a7c860", "comment": "Malware payload", "value": "eaf35044a770394428479b090ae6c2268efa53b16c5adf509e41c18a21a4694c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454108, "uuid": "39fee08f-89cb-4b41-a0e5-f076704aac3d", "comment": "Malware payload", "value": "8f4dc21404759ade524c0272ddfa44650014d25d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454108, "uuid": "adf74ecb-6b05-4b19-bc78-4a377e358254", "comment": "Malware payload", "value": "ee82102abf1fda3890983af05af083b3f06267c52b7688e4543e1f31bca8acf17010042bd158116eaa97682ce79c6fcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454108, "uuid": "fd5bdca0-c92c-4cad-84ea-6352202d9b13", "value": "T1C314DF7C7C8EE66187AD0F23346E077CD841CEA26744315B9FDD464828DD4EAB2D17A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454108, "uuid": "db677402-6ac9-40a1-8890-7d2268687c72", "value": "6144:trzOCcu7JP1LydP0MZSgTalJn1J0qodUw:tXOCcuNdLC0M1Olxj0hmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454108, "uuid": "56d6ebd1-1de9-4516-ae0f-6b57655118ef", "value": 202201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454108, "uuid": "c9dcc5ea-43bf-4e64-92df-7f22acf4cb02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454108, "uuid": "df1b3e24-544b-43c4-b233-d12e532b5d92", "value": "4e4KpBhYuOiJgp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915e7e88-e844-11f0-a129-42010a9c0007", "comment": "Malware payload (PureHVNC)", "timestamp": 1767404164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404164, "uuid": "81200dfc-3a23-4447-8e50-510b1ecbea24", "comment": "Malware payload (PureHVNC)", "value": "caa104e2093c3c02d121715e5340ff0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404164, "uuid": "4e53b237-9f1f-4146-b61b-36b185040d7b", "comment": "Malware payload (PureHVNC)", "value": "eba32a07adf4a424f44d99b8dc4abf9cb1c7f4c771c6312e07d3fb92fc4b4c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404164, "uuid": "b6e7f4b5-df95-4a4a-bf99-036c3bf357ce", "comment": "Malware payload (PureHVNC)", "value": "1d25b7276fead0d30e85b437f9366ff061a4ee37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404164, "uuid": "8cb5a2bd-c72e-43e3-830d-204d412157cc", "comment": "Malware payload (PureHVNC)", "value": "80b615b6a41929284b28bd1cde1de371c6884e677452d6ebfc79a5183cd7051f3aa965bb9f55b7e8d3ebc740ea4e076c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "windirautoupdates-top", "colour": "#5EA68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404164, "uuid": "7b605b59-370d-484f-99ff-8a86be6ea623", "value": "T1A5E633ACEE706376D4ED43F7ECC4C006475A8D252E6612A158BB9FAD2C48B4815FDCE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404164, "uuid": "ff8245a8-1a25-4a91-9a5a-696eb27700f0", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404164, "uuid": "556eab29-a8dd-41b0-a1d2-7647fba68dc0", "value": "393216:kp6IrXEd2wve+2gaPTn0beuePIH5ADnq/WzjccXr4:kp6IXLwve+2XPT0bH5uqOzjHXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404164, "uuid": "8e6de24c-350b-4a4b-a369-4cb4bb7881d8", "value": 14396928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404164, "uuid": "d19194e0-aaa4-4a4e-beb7-d31b7a2815ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404164, "uuid": "47c09942-8978-4786-94a4-048e412d5b58", "value": "Installer_v2570_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c58baa-e841-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1767402780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767402780, "uuid": "e6f858d8-842a-40ef-8f34-eb119477e4d0", "comment": "Malware payload (QuasarRAT)", "value": "734d40b2da2f75db8b52b79def7ad2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767402780, "uuid": "d705ffa8-b034-4385-88c7-0479fa6af24d", "comment": "Malware payload (QuasarRAT)", "value": "ecfc9a5ee4b9ea2c241ce89f30b276d832270fdc826af3c683ac29d832db5231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767402780, "uuid": "cbcc4652-843d-4df0-a87a-c2cb7c5542d6", "comment": "Malware payload (QuasarRAT)", "value": "901c2fff90f7de73fd0534389392ea676e5950ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767402780, "uuid": "9a0c096c-ebcf-4dd1-9f4b-64dc6b68e4dd", "comment": "Malware payload (QuasarRAT)", "value": "c59edd0243ad64c423cb6d8de4c39a8a0730e50f72413c6cff20ab8e617838d92b6d2fb8e4674b0f438b97d9b5c07046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767402780, "uuid": "bb356a51-a103-4d60-8583-1e90dbee4917", "value": "T11BF539143BF85E22E1BAE3B3D6B0041667F1EC2AF363EB0B619177795C53B5048426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767402780, "uuid": "5f077ccd-1ab3-4a22-b419-8111615cefc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767402780, "uuid": "74963b6b-08ea-4d3b-a586-efa49f575979", "value": "49152:OvNuf2NUaNmwzPWlvdaKM7ZxTwvWK7NNarPxoGdR22yTHHB72eh2NT:OvYf2NUaNmwzPWlvdaB7ZxTw+iN0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767402780, "uuid": "0e0aac4e-9c43-4b97-8156-4aa0c4be149f", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767402780, "uuid": "0bbbeecf-d4ba-4bd0-a8f3-8c88640c9be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767402780, "uuid": "d8faaf04-29e7-48ce-a329-a027cff3baf4", "value": "resolve-wannacry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fbba08-e845-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1767404411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404411, "uuid": "3eec1bce-42f5-4f8c-9959-2f013c6409ab", "comment": "Malware payload (LummaStealer)", "value": "099182c902550cc7dc5691cbbd484f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404411, "uuid": "a4a7cecc-576c-4739-968d-4d345353c502", "comment": "Malware payload (LummaStealer)", "value": "ed0df4e63f9f4ae680a8ae1d8ab92b192f406ea10794ece9de8fb719f70d6205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404411, "uuid": "a3a1e7cf-53ee-4e93-be33-86a25e1cec8b", "comment": "Malware payload (LummaStealer)", "value": "78c1c96e8af979e05507eb975ca14c48eaa37eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767404411, "uuid": "97685dee-d952-4dc5-b307-3e833783d751", "comment": "Malware payload (LummaStealer)", "value": "633d25b604ceed5c0f4224d2c063183da4776fd1bcb08cd3146fb7dfd21f01467a071278a121fc441c50bdebbffe287f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404411, "uuid": "c56a923c-8171-43e4-a1d8-b82fb7b88625", "value": "T1CB474AD3FE145325DA9FE33AE46162592230B145073211D7BFA907A6894BAC8173FB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404411, "uuid": "affe0fcd-8cb5-4b5e-879e-75f11287a30a", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404411, "uuid": "dd0d1d47-e77b-45a8-b31c-13b604c941f9", "value": "49152:RGz0lMG1VMMXEt5zdcpbyb81toIWrZPiUyoIXMsgeTzzM2WKWyygtnF3bKa++pN:RG0B8dnfSMMWgVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767404411, "uuid": "f09fc096-06d9-49e3-add9-ee962a76e899", "value": 24593544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767404411, "uuid": "beaeac47-2c8c-4bf8-abfe-89beb8f928fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767404411, "uuid": "a6032014-7cd2-42d1-b402-900d091bfe28", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdb9013-e880-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430038, "uuid": "0d7be20a-c415-4647-b9b6-51b6d41c00cc", "comment": "Malware payload (Mirai)", "value": "a5815d24b66902a22d9bfec3823b2196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430038, "uuid": "640f3909-396f-46ab-897d-8ed259c1b42e", "comment": "Malware payload (Mirai)", "value": "ed8270386074778ce5d752d9be356057d4c1e48c4239b1f9e8aa50625c14e2e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430038, "uuid": "5d90be2c-a9a5-4a79-b3fd-471a181ec514", "comment": "Malware payload (Mirai)", "value": "629b83ec6be4e02d5e400952fbb998705f73d143", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430038, "uuid": "ce9df921-095b-453c-bb30-34f147159f8f", "comment": "Malware payload (Mirai)", "value": "6c7865b1851045612d5605f4599e6e2df6387f3be5b93ac8e9d380e21c6a0e9993d676a9e8d4ab5136fc9f44416341fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430038, "uuid": "2e276428-bfa0-491b-bf76-757cf271c708", "value": "T11644E70AAF610EFBE8ABDE3706E9170128CD641722A93F757534D918F50A64F1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430038, "uuid": "d0257ddf-1442-4148-b997-0d2520113f96", "value": "3072:z0ONMKQdNa6Zmf18P198YYx5V5Pc7TejL1h24p6mj2CzDSaXINHBbY:bN7QdNaym9WTYx3X332k2kxXINH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430038, "uuid": "b0e17055-5b1f-4b7c-a9d0-ef30988a4feb", "value": 257512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430038, "uuid": "593053ae-a965-4a7e-b4a2-5ac572ee26a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430038, "uuid": "b08e2f14-cec3-4040-bc19-fe9b03e8cc41", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b9deec-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399532, "uuid": "efdb4a20-feb9-4fb0-8b90-0648c8a1901d", "comment": "Malware payload (Mirai)", "value": "7470ec7e9701c6123deb9d5fdeccff0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399532, "uuid": "7f4a7dd3-ce43-4267-b451-70ce36a696e9", "comment": "Malware payload (Mirai)", "value": "ee3938563541f71218cf203afa0399afde6332dca9fb21a95c7d2fd51f1052f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399532, "uuid": "5c36158d-c4ba-47f7-89e3-a2587f853293", "comment": "Malware payload (Mirai)", "value": "8f3c3b9f649602d50bcacdfa16a6ce5a33b43eff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399532, "uuid": "7151c9fb-d9d0-4783-b3b1-7de14a0028a1", "comment": "Malware payload (Mirai)", "value": "92bc55e1d147de952901baf359fcc9875854e5a09149833e5d11e2f932ce3c184d7e177956f287de2521c18d1b84c77d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399532, "uuid": "03f7bb4d-fe7f-43c3-a02e-c5897b4216a3", "value": "T16F73E846BD918A16C5D512BAFE2E118D332357B8E3DF73139D106F247B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399532, "uuid": "6f63dd27-e44a-4024-9911-1c54cef7f6f2", "value": "1536:uRn5KZ9QUoN4j+zAfqgVTGseJHwew4JvvFSMNlT43wMZiF3q2VsIu+7R:NZSUR+zAigdGlJHwewavvFSy3q2VsIu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399532, "uuid": "90645cf4-fdb0-4058-b447-287c1186c1e1", "value": 79032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399532, "uuid": "97fe9413-0338-48e6-ac5c-0e62feb77e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399532, "uuid": "34a69085-92f5-4206-a0bd-6e0b3af346a5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c28442-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463435, "uuid": "724a9c61-6611-4671-a254-6388d343185d", "comment": "Malware payload (Mirai)", "value": "66d696f83763a159d5009be3c7181046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463435, "uuid": "e182b5bb-64b8-4428-991a-bd690572c8a3", "comment": "Malware payload (Mirai)", "value": "ee6930e8ef1e4bc8530b8c2d8829bc68f4e3efbe5816d536583b4310807b156c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463435, "uuid": "83974848-9d7f-4232-bef6-1a4c699302fc", "comment": "Malware payload (Mirai)", "value": "be8c31160481d3b9728eab300e8d178b05d9f165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463435, "uuid": "f2168c34-6e32-40ec-be62-01f3d51782ba", "comment": "Malware payload (Mirai)", "value": "3e103c5a903d9041e81615506361a2727af1fbe87fe243f69c07657c41dae91356cfccbc3e601e7510e7eeb3131a692e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463435, "uuid": "7121fb76-ec8a-4271-ac86-ca4375f14f64", "value": "T1ED534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463435, "uuid": "a93c5e48-d73f-4d28-a0bc-5e047d228f0b", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGV8+BCpEMss/J9KCrMvuBxANUr6FV+tMiwWOIC:MvolWm+phBgdTKCAWBxANee++bWOvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463435, "uuid": "24ce8197-0d59-4e57-a89a-94a8a758bdf2", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463435, "uuid": "952e382d-7d84-4ff4-bea6-2e61af62aff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463435, "uuid": "75895303-3fa6-4f24-90e3-9668565f20f7", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fccb56-e887-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767433079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433079, "uuid": "5ed8639e-7b20-473e-bd70-c2aca3b5dcf3", "comment": "Malware payload (Mirai)", "value": "7b6b69ab9c270d836c9946d4d07220a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433079, "uuid": "37093f49-2e88-4c31-8385-e508bf7356e7", "comment": "Malware payload (Mirai)", "value": "ee89fb176f3d53abb8137c782d53589d3d6df1c864682e1d05e8e7a212480e61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433079, "uuid": "e25fee87-185d-4c69-84ef-02e1946bc49a", "comment": "Malware payload (Mirai)", "value": "b985118efa902f6c860b31cf9ed5618a312022ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767433079, "uuid": "8d7ecde1-693b-4c2b-baae-04e4266fdade", "comment": "Malware payload (Mirai)", "value": "c7c857e19ecf9e4c7c2e539e14ab8b0ebe14a5bdbf227850c8d664e89ab07d18416909ca8fc873ddb63ad13e59ed048e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433079, "uuid": "4878a1c2-9cc9-45d9-b904-ce426485cf21", "value": "T1C563AEB7C83A6EA4D45942B0F8B08F791763B44081471EFA5BAAC6798043DECF6193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433079, "uuid": "c42f0af8-6684-47d0-94ee-4f843418977c", "value": "1536:yUwtGa9F4Yn5Hbg/FRndKn8FFvGUoCNNwwW2QF:yUO9iYnJbuPnEnMGUoeUnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767433079, "uuid": "0ab825b1-53ce-484f-b43f-6a2a4af322ed", "value": 69316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767433079, "uuid": "36c6ecb9-5a3e-4213-b522-4fcc5afea66f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767433079, "uuid": "a01b6828-a16e-4d70-89ee-04330386d53a", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3d555c-e8df-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767470700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470700, "uuid": "5a9ad2d9-f7a4-4aa8-a30a-943d35d4a5d4", "comment": "Malware payload", "value": "17c43255176f94d277972fb384c5a0d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470700, "uuid": "927b9f06-3580-46f2-bdad-25b1fde442c9", "comment": "Malware payload", "value": "eec8527bb6dc8e1da8cbdc7348c4fba6f2c7d9be352bac57bfe7333d5dcd2a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470700, "uuid": "97c3f878-66fa-4a98-8707-d2f439826a71", "comment": "Malware payload", "value": "1472e7f9df19decc98a537ff1e56a49484ec0b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470700, "uuid": "0708992c-89ce-45f6-9f5a-62638f4406e9", "comment": "Malware payload", "value": "4e9292b31691c58726908857a13c52057cead09d7478b7c511785900954b9c3b44e6689917cf7a57ac414a6f4d2cfa3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470700, "uuid": "0e811e26-3e2b-4691-b903-82655d3f8ab8", "value": "T13D086B4262EA04C4F9F7DA759AE66617C673BC122F30D5CF221C17291F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470700, "uuid": "a88117a4-2e6a-4997-af43-fb6912f502cd", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470700, "uuid": "c373a37c-999e-416e-a86d-6d6537d7ba83", "value": "393216:JkmBVz3lbx3Jlm7+dMmXg5cidiCKNhgVBbsIyNOnS0B4AycWMCYALhvdyb0scoNu:J5NmdsJY62A0y8Xy5rs3wbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767470700, "uuid": "9faba303-19ee-4a01-9b07-88b7d81f2a77", "value": 81964444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767470700, "uuid": "728b5467-03d5-48aa-9a36-3d25c0695087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470700, "uuid": "9ef28290-5677-4154-a1f9-c9b7331d39dc", "value": "b0m5coyc0p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4443a9f-e882-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767430824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430824, "uuid": "dfe2915e-b658-4771-812d-bfb1b345423a", "comment": "Malware payload (Mirai)", "value": "bde510acb6ecbaa70ea864fbe7936907", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430824, "uuid": "80227685-d830-4b66-839c-1605dc02c121", "comment": "Malware payload (Mirai)", "value": "eed6cd09a0207f8b60ed9b55469c63d417e53960790b16ecd193e07df460e098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430824, "uuid": "9041aacc-08f8-47ff-9b18-8d0f6db030ee", "comment": "Malware payload (Mirai)", "value": "527af220df57c8032f03190a632dd0e6f222f781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767430824, "uuid": "5acded80-e365-4819-88d3-abadd09908a1", "comment": "Malware payload (Mirai)", "value": "868a7faa25f334b89999e36119d567927ad19fee5b2c8249f38350a99ff1dbf4e21c7b1fbee42887e3a480a683ffcca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430824, "uuid": "db5383da-fafd-4114-b3a3-3850a8fb7366", "value": "T1B8F39C72C8756EE8C664D174F0B09E7D1B53E62081476EFB69ABC6714087D8CFA093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430824, "uuid": "ee65704f-7724-4ee6-8d36-9f05cd8783c7", "value": "3072:of/+fEFq2PiLARHSNBGnsBeU0oOPCKExfkWHnv2Q4txy:of/eEVPbyNBIGxLOqP9Hvx4txy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767430824, "uuid": "bc306e4f-b308-496f-bcb4-ce87d08343ce", "value": 171040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767430824, "uuid": "27483d1e-79cd-465d-ba9c-aeb2b24be57f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767430824, "uuid": "63196225-1cd5-4407-97e7-0ca5cd4b39a5", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdab320-e89f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767443024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443024, "uuid": "ff453a63-9cdb-464e-b102-c4d3696d002f", "comment": "Malware payload (Mirai)", "value": "ff4566bd44c8495287ac3949eb9d7b71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443024, "uuid": "04bdea19-55ee-4222-96da-db8e61775518", "comment": "Malware payload (Mirai)", "value": "ef4e8b8289c6f51e9824b7b08cc000de15abd836177b311cc039f8715bae67be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443024, "uuid": "4faeebab-815a-4376-93ab-65e32daf0521", "comment": "Malware payload (Mirai)", "value": "fd9a198d07693dd02610b6510eddfe2ee944e519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767443024, "uuid": "4cc2482c-7fea-45e0-9a92-348961dca47d", "comment": "Malware payload (Mirai)", "value": "c5cd74a57883f8f1d09298eeb0ae24dfe0e686b45909ee685bc778b189610b4ed1d3ed8fb6f804e5cc8cc61407147f35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443024, "uuid": "aa802f68-ff64-4a0a-b871-58d388472aa8", "value": "T16143960A3E229FAEF66C873547778F21979423D226E0D684D66CF9015E7030DA45FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443024, "uuid": "da0bc2b8-f524-4c99-916d-8ad1ac133b56", "value": "1536:p3WkIGLCIDfnKZvQcff/yt+Haj180g/bTUzTuBzTT8rzVCs88au+7RN:8xQc3/yt+6BDzzVrnau+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767443024, "uuid": "1d1672da-5389-42ff-a16c-09b12b85dee9", "value": 58060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767443024, "uuid": "e322b1c2-e85b-40cb-b09e-76852d835c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767443024, "uuid": "86f407dd-11c3-4fee-91c9-2c87ef197bec", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edabb316-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454140, "uuid": "edb66bab-3ed3-4b0e-b72f-7fdc3d233188", "comment": "Malware payload", "value": "78b2b856288a519457669b5cfe4dc728", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454140, "uuid": "e46460c2-265e-40aa-86fc-155aa802696c", "comment": "Malware payload", "value": "ef8ecadff909f6f04990db64e7f2efbfaacd8fd6b89a0f3e9bf7631e1dfb4460", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454140, "uuid": "51210614-4c20-43d1-9a69-b1c1c68cd945", "comment": "Malware payload", "value": "b5e0594955c8e7a5d048c67c425ecbd3999ac551", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454140, "uuid": "8308d043-b0e7-4985-93dd-c2c1399735f6", "comment": "Malware payload", "value": "c55858a440cef77281923d9a3662b1bc12670a3a0521ea9a880227de943c2e2bf1d1c038621ea32305d63009f0218340", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454140, "uuid": "6808cf61-43a3-4bdd-a861-b0b58e0ba2a6", "value": "T1F524CE7F780D9D61C282587B353370B8DA42D8899B2C94908B44B87663CDE74E6FE7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454140, "uuid": "9a58e3ae-edd4-4bb2-b93f-1cf90c6cf49a", "value": "3072:4WQtk0N4n89KWUlcb2iAqhNrgcK6OF63877iGEO0jSCT1rS9IkBngMQExD/u0KpI:4jtk0SnrWUlkAQ+6zUWVr1r3kx/qBOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454140, "uuid": "bc31861b-70f9-4024-a855-3113a81bf4d5", "value": 215843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454140, "uuid": "811fc7f9-bf6e-4985-bb46-54cd74536ea2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454140, "uuid": "bcf43555-3722-4c6e-858f-02670864557b", "value": "IsUXWsWZ8w3d8h.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960fb925-e8d2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767465160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465160, "uuid": "9dcc0f8b-77fc-468d-a208-836c7ea56b56", "comment": "Malware payload (Mirai)", "value": "2a001cf7f7ab5c6414c3f17b652be0f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465160, "uuid": "b8f519f0-dfab-469a-98c3-d0023582e646", "comment": "Malware payload (Mirai)", "value": "ef95d9a07ed4c15f062f6730970876a57228154730f826c7039b931a0415cb5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465160, "uuid": "15c4569c-522b-4152-998c-83e7e4cbc578", "comment": "Malware payload (Mirai)", "value": "fc0b64687f361aca9219337bb175d386595c1be7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767465160, "uuid": "3f912c7b-f243-48c6-ada1-9e57ee4bd165", "comment": "Malware payload (Mirai)", "value": "4f341ad2c3c1c6c5383d4d4aa055a64f6c0eb5fbe81ee3b0c36da7a67e6ac94722b2151cb10cd968c2f1ce54eb91fd69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465160, "uuid": "3dc89cc4-f0ef-4cf5-ae7a-3e300b76247c", "value": "T180938E02BAC0D8FCC859C278969F7276D962F42D1235B25B53D0FE167D9EE103B2E291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465160, "uuid": "2e17c3ad-e7c3-41aa-9eae-0b06a473c6ce", "value": "1536:Hem1Vy0ZTb8M94VbHQd5qKV51JXNIkEvba5sk4XgaftzTb:HNfZXubwd5qu1JXGbba5sb5tzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767465160, "uuid": "8dd9b1f1-a333-4e47-a57b-a30b9e006932", "value": 95888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767465160, "uuid": "cea4b725-1704-49bb-bac1-8e865c9da510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767465160, "uuid": "0ce11688-b517-4aa3-92b4-1df217a29162", "value": "x86_64.kokz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8c291e-e89a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767440876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440876, "uuid": "d0c4d39c-8838-4480-b7ec-35b6c8a36f56", "comment": "Malware payload (Mirai)", "value": "b1d6d6935602ec0ce751f07307002acd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440876, "uuid": "09f7d057-7cc4-4bbc-ba15-25b6d4445f11", "comment": "Malware payload (Mirai)", "value": "efc5bb5e7deefd0a7753dd6d6492f0efb7e51085136dd0c9491992beece77451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440876, "uuid": "062aee01-be96-448a-b264-c146696234a8", "comment": "Malware payload (Mirai)", "value": "683a8246d8823965f0e8f2a8f82807f9c3938d11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767440876, "uuid": "874da31a-46f7-492f-b2e9-038eb85098e3", "comment": "Malware payload (Mirai)", "value": "37bce38f1a42834bf835c8d7587baaa3d134891ba1f795d8331599e666aba327cefca41b244b4dd11a0d7f33a385f47c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440876, "uuid": "d3a4583a-f5c4-4f1b-bac2-6d14c56ef662", "value": "T18583A64A6E21DF6EFB68C73587B78F20D798239226E0C241D16CF9045D6434EA45FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440876, "uuid": "25f1bf90-1adf-4f60-b0f3-ad169d30bb39", "value": "1536:CZFIcIh+a41YWLbjEqvNEdnFgZSSD+1HSgSTc/TlR/TTcdjRhlmqu+7R1K:KInh6YdFhSy1AjRhIqu+HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767440876, "uuid": "317ea39c-adeb-4e3a-a787-8023bbc90ad6", "value": 84636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767440876, "uuid": "00460f5b-743b-4504-b64d-f3cfe04a1d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767440876, "uuid": "8d103a83-3bc9-4478-a349-1026de457e8c", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6395a6-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400612, "uuid": "c22688f3-129c-431e-b43c-012879d4f087", "comment": "Malware payload (Mirai)", "value": "743a971e4b585a85bc1a3b354badad00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400612, "uuid": "19f711e2-378b-4083-8cff-dbc8686ccc6f", "comment": "Malware payload (Mirai)", "value": "f01f86b069e80d7d838b68911d9a5639b33efd745eb9d10adf166bde21aaf90b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400612, "uuid": "43f975d9-33cf-4270-9ccb-e056ebf08b23", "comment": "Malware payload (Mirai)", "value": "ecd405353441e7bcc94ac9051fc5274c36188838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400612, "uuid": "f35e849e-7cbb-45de-805a-8c93b2049f7a", "comment": "Malware payload (Mirai)", "value": "4004d23bece2bc236b7c2e904bdfb89f27f32caa35fefec9252e55b472b3f7ce13cff5b36d6881eaa886e40568964006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400612, "uuid": "24391a92-b085-4ec7-8a96-2474434e47a9", "value": "T15E530845BC81D616CAD462BBFA1E42CC332653E8E2DE7207DD116F157B8A82F0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400612, "uuid": "1c4a4761-7229-44c7-8c8b-ab69706547fb", "value": "1536:vHxnCpy88n9Rc257b3eT/E1auUP6Zu+7R:vHxnvO405Pgu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400612, "uuid": "fd8337ad-abec-4263-8efb-4479ac272215", "value": 66428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400612, "uuid": "6bebe70b-edae-4dcb-a34f-286f398408b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400612, "uuid": "9d8b5a49-fb9f-4cd9-a4d2-c6e4605da462", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc42e257-e838-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399189, "uuid": "35d92ba9-f57f-4534-b2ad-06367e1fcecb", "comment": "Malware payload (Mirai)", "value": "484eb8339598085545561e78e97627c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399189, "uuid": "c4878258-bd98-41a1-ac82-a2a1e4f4c2a6", "comment": "Malware payload (Mirai)", "value": "f26be1f909364aee75927fddb91c11687a16d47382386df315364646eddc8432", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399189, "uuid": "d1000cfe-6c51-4b02-95d7-8dc9b88913fe", "comment": "Malware payload (Mirai)", "value": "0f352e3a663fb56f688a67f284ba3c6e8c32bc60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399189, "uuid": "2294340e-e3dc-488d-81eb-5da5a9645cad", "comment": "Malware payload (Mirai)", "value": "00bd812dba100ea4c0d0a2d7bf3d4cb4b916a1e2aadba960062dfa854e70316e769ac258f37be9254dc93bb39573ec91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399189, "uuid": "1806b0cc-3d8c-47a0-9108-b04bfb3dd77c", "value": "T111536D4272184A57D2A60AB0293F1BF193BE99A021F4B3C9750FAB5D8571E331486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399189, "uuid": "0e4055c7-f419-4244-8387-8cac3b23b600", "value": "1536:1YYbbwRexDZFg8Zbhk8k05O5kFmFqMu+7R0h:vNDE8t25kFsu+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399189, "uuid": "fd716640-efa4-4d17-8333-1c4f461beb79", "value": 66528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399189, "uuid": "c3886582-35b9-4db6-bc91-2fef5eac84a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399189, "uuid": "dbb7d014-cfb8-43eb-81dd-abe5205c6167", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb038479-e8a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767445036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445036, "uuid": "d6f29771-209d-435d-8592-573d53a232c7", "comment": "Malware payload (Mirai)", "value": "965403008aaf7c2da924e27643af4562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445036, "uuid": "810ac503-d082-4edb-b411-b3e48ae5d045", "comment": "Malware payload (Mirai)", "value": "f26d5a33b21a9d4bbf4bbec5a3ba5b7b9c6787bc85c3929e89f860830d405c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445036, "uuid": "5353f5f6-67af-4f8d-b9f1-292731782a1c", "comment": "Malware payload (Mirai)", "value": "d89c1930069026b3f139b710a2c528393837af26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767445036, "uuid": "af2f56f9-e8c0-4bd8-91a8-ac50e41c4c5d", "comment": "Malware payload (Mirai)", "value": "b90be69a52088a9d19beaa9e27d0a3aec2c1ca5eb5b6c29bf873f9b8b59f72c4c88431f50a8af0ca1e6f9b1956d3017c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445036, "uuid": "90fdaa45-e27e-400c-8424-9236a272f306", "value": "T1C1141B46F9428F12C5C112BAFA6E418D33137B79D2EE72129D246F60778A8EF0E7B511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445036, "uuid": "2d7f52cf-78d6-44f0-903f-7a6b6e4e13fb", "value": "6144:ElV+dEdarDkEiXm1XCxDZaon+DMPZL/afwR5PP:ElV+awHRi21XgZaOHPZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767445036, "uuid": "883a0ee1-8dc4-44bd-9f7a-970c1e2a3e7f", "value": 209212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767445036, "uuid": "af129124-8b39-420a-96a3-ee1088564942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767445036, "uuid": "57147241-d4bd-4763-bb05-95cb900fa32e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f841ce-e8ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767449185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449185, "uuid": "af2d37b4-4c17-4d8f-9963-f51bf2b077c6", "comment": "Malware payload", "value": "1c755c5169331e63f9c214c2ce3b58dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449185, "uuid": "eebb9681-ae9b-45ed-802d-9db79fb5ef94", "comment": "Malware payload", "value": "f34d71948c070e4e412de5bb756311778bc1df5639bf0cc03175642dc5347d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449185, "uuid": "3c79111f-c0ca-4789-94eb-d5d30693f858", "comment": "Malware payload", "value": "1b483f194824e2bce39c48a2df2edb1276de0bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767449185, "uuid": "20204819-323e-4a10-9321-8ee6fa335648", "comment": "Malware payload", "value": "6342adab40701aa96d6d1c156a0722732ebfd46df168a5cb77046b4a9d04aa3185f641942e094f2c0424916bde416afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449185, "uuid": "8a154b31-3097-4bb5-8bb9-a5e1c2419bd4", "value": "T1B2A62983AE448225C99BE279ED756245B234B185033113C37FA71BA2DDD7BC4173BB2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449185, "uuid": "967f519f-a941-46e4-8f33-0b50dfd6cad9", "value": "da7f8acb6151c95be088a02465d68ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449185, "uuid": "4011d2b7-fa81-48e8-b204-324b3189dc90", "value": "49152:hzAEhHrb/TzvO90dL3BmAFd4A64nsfJiGuaQv9TrRR11nu9Y95WJGPMAehWUjIJ5:hzAa9v8Dzu5t748", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767449185, "uuid": "86f0506e-f150-4cdb-abfa-cf4d243723ea", "value": 10059392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767449185, "uuid": "5c2ae0ff-0bd2-4028-b200-41b81858d8d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767449185, "uuid": "5f850e65-4e5e-4a5c-a91b-d39ab00ed340", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2af16b-e83d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767401152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401152, "uuid": "8d2bda12-7ff1-4849-93c5-98fad15d3432", "comment": "Malware payload (Mirai)", "value": "26886fb7d9b33536199e016b5d072017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401152, "uuid": "3462c564-b019-4249-9a44-1d9b3003b78b", "comment": "Malware payload (Mirai)", "value": "f418d68c21ddacbafed8247a0c44847402b73a75c5e52fdc51bcc671cf8d27ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401152, "uuid": "29bfd483-e1f6-4b18-81b9-d32531cb4c8f", "comment": "Malware payload (Mirai)", "value": "4e7ff6e18e2fa7febe42c7127cf48665a210c95f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767401152, "uuid": "255b31be-a908-4fe3-8d67-9dbaff96184c", "comment": "Malware payload (Mirai)", "value": "10eb6d53eedcc1d1c015eada93eea730adbae673da27bae47b8d7f7b688286f650b335c98fc76fcf3c942c1b9f03e9e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401152, "uuid": "729e9eed-dd24-4194-b3f5-b759e804ed32", "value": "T17C53D71A5E258FACF76C873547B78E3197C8339626E1C246D15CEA012EB034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401152, "uuid": "436e93de-b3cf-4fed-8466-7e21624b207f", "value": "1536:CCBzxvqWPBr+2toc0SLbsAppP34P3eZP33eTrigSOIweun:TxCWPBqJcvLbsApUrigkweun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767401152, "uuid": "79c48e7c-3240-48bd-b268-589e167420b1", "value": 63568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767401152, "uuid": "89255107-200f-4d56-8f52-8b219de16693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767401152, "uuid": "fc270345-8c16-49f0-b8cd-daaf8e8a1e3e", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605b6ff1-e8df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767470654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470654, "uuid": "7d71a01b-0269-414a-a6cd-ab5f12373546", "comment": "Malware payload (Mirai)", "value": "53399358177c933d4b7eeb827a7eaf6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470654, "uuid": "ab4ad31f-a1ed-4e8b-9703-da9938445988", "comment": "Malware payload (Mirai)", "value": "f4970d2d37682be8757e3602b52f51d2a375008e71eef98eb9bdfba722d7bd1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470654, "uuid": "a1f5d37f-e6a0-488d-a400-cef7689a0b93", "comment": "Malware payload (Mirai)", "value": "68f07a55420264d4bd2e4b7a4dc783ba70d66d9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767470654, "uuid": "5c3674d0-c4da-48c0-a5a7-a25e853ded88", "comment": "Malware payload (Mirai)", "value": "6b217a7b0e721202804c7747aefd963248c0915545e801de6c189b20450a63254299925bebd69bcfb77c455b9a994fe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470654, "uuid": "69092d1e-62de-4982-a69d-ed2f68c8bbc3", "value": "T1B733C609EB518EFBDCABDD3342ED071230CC591722B83B3A3674D928B51A54B4AD3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470654, "uuid": "168384e9-dfdb-40e8-b666-0351eee1ab33", "value": "768:G44YLsSK2SeGuovLGThe2ueNle7VViuCDVwqQYfb9naXixecG/VR+/8U+0LI:hPLsdvaNPuwl0VQewf9G/VR+/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767470654, "uuid": "1bc8c33d-5814-493a-a90b-15d2e19c99f8", "value": 52264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767470654, "uuid": "4836899a-22b5-4cca-ba28-a722bfd29353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767470654, "uuid": "a74eed78-6197-4b13-ab6a-7e008f03993d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50ffa87-e8b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767454126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454126, "uuid": "74b0302f-1a8a-4752-9cc5-93aa53235056", "comment": "Malware payload", "value": "0bf3aaceb7b702d677c3efbaf132ed0d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454126, "uuid": "1bdd32f9-1ec0-42cb-aa07-5902abddd2fe", "comment": "Malware payload", "value": "f5ca61a19dbd943317f9c116c6feb063ade779f2ef5a5d12a08dbd2254b49fcf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454126, "uuid": "521c87c9-60ec-4a49-8523-4421b66e90cc", "comment": "Malware payload", "value": "5a8a91bbfaeb72da1b5b852cd9b24583a03f5589", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767454126, "uuid": "1c573f32-4fc3-4660-b77b-b1da25a30901", "comment": "Malware payload", "value": "e55940f3146882eb0307fdeeda0e25a967845c10a6c4c4d8efc6cf912956610864da9e9681d3226e2e98aa9c929ab8df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454126, "uuid": "e76f550e-dd5e-4c44-957f-227453ba9b72", "value": "T15614E1D54FA0B0A2EC8E52E83576731D5DF3893DFBC78944661AE344A63A8B01CF19D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454126, "uuid": "0eaca04b-e78e-41f3-89e0-25cc1fa3306a", "value": "6144:FH09uWuHtBiFmUf99U3Bg9iNGJU7rfKu+s8kzzlq:F3hNcFp9U3Bg9pJU7rB/jzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767454126, "uuid": "0f5a0f55-e5b1-4fb2-9ca0-e8292749413d", "value": 202976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767454126, "uuid": "3862f217-c336-47c4-a9dc-38db311f3ec3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767454126, "uuid": "d491addd-3814-4fd6-8978-87d6ce1b77db", "value": "DD3rSZgk6ZFuUY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da00624-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767446275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446275, "uuid": "199ea964-d600-47eb-8ebb-2fe8bf871179", "comment": "Malware payload", "value": "a69c9512351ddd9f90c190bb9f961b42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446275, "uuid": "917ddba6-7c3e-4785-9d0a-82c3e5714461", "comment": "Malware payload", "value": "f60d835a43bafa4fdfc48e2dcb94b4bc9938d1f7b3b5266e5630b85c6de783bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446275, "uuid": "9f659381-1b62-453b-af0e-39f1b353d3a7", "comment": "Malware payload", "value": "77d2516abfd9efd173a9b76afeae75b607f27aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446275, "uuid": "7eb2b9ec-a542-4d24-b6fe-8032cf99f3e2", "comment": "Malware payload", "value": "834f5dc858c173ed7ee4af8acd4874750c78117ec86768af0adeae1814a5a5fb67ebd8e89a1bf6ec48b506587e5ae548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446275, "uuid": "db261805-7852-4c0f-9a8b-60dc6c91425c", "value": "T1CB058D9DE787E0E1F22310F1025EDBF64A34A12A5013F6F6EF452A6374727616F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446275, "uuid": "8395bfb8-33c3-4d82-a62b-26076a7f5e59", "value": "12288:8+qgiwJh4lhAbl1Eg04omeYL7owJEbU22Z51uDzYdrBh6DPyMD4rZabBF8HLu:8+awJh4lh6EgBcY4IAU22ZjmY9BhesW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446275, "uuid": "b5168055-93f3-41b2-a665-4a12f4d466f8", "value": 861080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446275, "uuid": "d0ff10db-9be5-4ced-92b2-14c25042ebca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446275, "uuid": "377b4d02-cd14-4cd5-9aaf-927e687326f7", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28138960-e87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429327, "uuid": "8005c023-35ea-4f93-ae6f-d9900622db74", "comment": "Malware payload (Mirai)", "value": "98b22dade963f061d4f9f5cf0b2d9bb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429327, "uuid": "06d9b82b-c0df-4a33-95aa-ea317ec97704", "comment": "Malware payload (Mirai)", "value": "f6162d840f76a21187a5c8e67df15e3f2883f6fbab471ecd499a2a208a6233a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429327, "uuid": "1e7f57a5-a8ca-4e20-abdc-ef49094cbf40", "comment": "Malware payload (Mirai)", "value": "fea56b4cb7f8ccfaf99f089c1ccc1fa088f2715b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429327, "uuid": "6f41dbd1-ea46-4630-8458-51cf3dde29c8", "comment": "Malware payload (Mirai)", "value": "1e03ccea114a5d472ee973047e2892e426c859f33803e06ad50085f341e3d0a1c744e232fcbc1d0679abcbd7587bd152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429327, "uuid": "1125643f-4f18-4ae1-a216-89e7d52d5a71", "value": "T15C140942BD418F13C6C622FAFBAE018D37166BA9D2EB3103DD21AF6137865DB0D36651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429327, "uuid": "461f2994-4630-4c8d-8032-e6b3236add2a", "value": "3072:Omj0+pXS2D6xY6r6vKqlztg+b5zZ4+YcVF8euZrdauHb8K:ZAk6xYxvKqxtgG1Z4+FFjuVdauHb8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429327, "uuid": "eb411ada-d3c3-482f-ad5e-0d1d88ce8d9b", "value": 196840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429327, "uuid": "618903f6-f318-4ee0-9209-67cc321a8f38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429327, "uuid": "2b776b28-20b0-4ae1-9152-49cff5c954a4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950e098f-e8ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767463441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463441, "uuid": "e3b1a6e9-7ef6-45b2-b2e4-a8d9212e5217", "comment": "Malware payload (Mirai)", "value": "d14dac22978edc82d41f1321fea68a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463441, "uuid": "447eba52-c8fb-4198-bc57-26bc29706a94", "comment": "Malware payload (Mirai)", "value": "f640e54e9cc8dbbd0f7282f58040ad13c7516b85cd54313bf49fd777e5402762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463441, "uuid": "bb8640e4-feac-4b35-a543-3ef76ee53827", "comment": "Malware payload (Mirai)", "value": "9b26e2edff4aed34a8cff46b30174eb0a03fb77c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767463441, "uuid": "004e631b-9189-4c69-b24c-1ee3bfb42599", "comment": "Malware payload (Mirai)", "value": "00e40320135ec512cde22daca2fb364a0f7851ffb76f434358b01672de8a0f9ce6997758cb42dad7c73e36a5a7b8afeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463441, "uuid": "12445402-b39f-4d91-bccb-7552fc96af94", "value": "T162534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463441, "uuid": "29a5894c-9234-41cc-8f99-340b543f71a0", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQ8LiKimfFoktCe3fYRMc:WShU3q7cEDlCK/0DE9i8Fok06fYRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767463441, "uuid": "f46d51b0-7888-45b9-bd23-ddfe64a07690", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767463441, "uuid": "a3da30f0-683c-40ea-a44c-e5c91b164b12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767463441, "uuid": "67380fe5-7758-4e7d-984f-f6d0b3a6c53a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2ef90c-e8c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767458082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458082, "uuid": "53042ed8-456c-4544-8067-3f626557a093", "comment": "Malware payload", "value": "796f84073564a4cfa7b62158fa4f221a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458082, "uuid": "68545f67-20c9-4db1-a9e1-c6b95f40fc2d", "comment": "Malware payload", "value": "f64a21cf8cc439f9e97c4bbbad857353c35eb18c048e3ffc1c810c789116d1bc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458082, "uuid": "b5e9fe95-4b2d-4c5f-b9d3-02eb29f02e23", "comment": "Malware payload", "value": "a2cd63e98c67587d677a92375c9fcd9e28e06f82", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767458082, "uuid": "2422ba9b-279e-4fd7-9a0e-e544c1576318", "comment": "Malware payload", "value": "235315591adaf9fc58ec427f8a30641ee4fa30a37f345f1667cfa496be004a29f8ef2f4b233cb2d9cd593bec4fcfaed7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458082, "uuid": "a65031f1-3a2a-425a-8cc8-dfad574f3157", "value": "T1BCE533724D7887E1F9D901FC5FA8C419BCE0552133F84D235B84EB6C8ACE926BB54B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458082, "uuid": "8ae2ff00-9f8a-40dc-b44d-55d1e5f2360e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458082, "uuid": "4482bc1e-6ecd-404f-a3db-b65acaf45b59", "value": "49152:ClizxqKVG+7wF1tkXfFjBQVstoCcfVQsWKJ97q4mR+PRSLtX+hijkpKBW9:MizxZVG+UFmFN8su/IBLtXa/KBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767458082, "uuid": "d6eb301b-03b3-4fc2-be93-ec0602df8c2d", "value": 3289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767458082, "uuid": "741719b8-a172-422c-8d49-8cde4712d536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767458082, "uuid": "a5fe128f-8993-4c5c-a499-f3502ccba1cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea865be5-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767446404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446404, "uuid": "92181adb-1864-4bcf-9fbf-d85c2b933162", "comment": "Malware payload", "value": "a3739b6b8750eca71f40ff59ae0909f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446404, "uuid": "d4838817-5907-4e4f-948c-f76c2a1f4598", "comment": "Malware payload", "value": "f786e218c6c164b25d8b1ccbe0c2c5fdfbdfae5e53e2de815aa4a0bf875ccf24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446404, "uuid": "422b2f4d-a924-4ea6-a8fc-759d146c9dd8", "comment": "Malware payload", "value": "aedc647d83e896d90b94a6a1c8a0b7233dda9f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446404, "uuid": "1bca4b80-c0b1-4163-83c1-4b9ef49ba982", "comment": "Malware payload", "value": "fa53c14e5acc54ecc76a79b314d000c8ec363507698c629036a914bae8260408834949ce27ffeaabd782ea1380ae5e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446404, "uuid": "5452871b-e35d-480f-83a2-eb25149bb889", "value": "T18B878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446404, "uuid": "10651b6e-4190-430c-b38c-d407c2367f1e", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446404, "uuid": "b7d7cbf1-3df3-4066-af82-fdfa12eb6c1d", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfU:fMguj8Q4Vfv+qFTrYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446404, "uuid": "7bc1ad6f-e4a0-470e-a473-9bee3c666f4c", "value": 37656893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446404, "uuid": "fd656bb1-5290-4b60-ae2d-ca4cb61141ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446404, "uuid": "ed00bfb0-89f4-4972-b0ed-cf7b887dbf17", "value": "Loader.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f1e261-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432466, "uuid": "4c97ccad-9106-41bd-ac16-d969860e1f8e", "comment": "Malware payload (Mirai)", "value": "a48d9be4baa7fc360e819beb60db11d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432466, "uuid": "eacb5b0a-92ce-4ee0-87a6-5a650854c9c7", "comment": "Malware payload (Mirai)", "value": "f8d10b02671de196293a24694bfad3664e71c080d8e847d3ccbbd84df1fbf46f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432466, "uuid": "649059c7-76eb-42a3-a187-a15ff0ed1e36", "comment": "Malware payload (Mirai)", "value": "04197c9149a685045800344d4b384852144883e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432466, "uuid": "565d794a-202d-40bd-94ce-70d36e6be507", "comment": "Malware payload (Mirai)", "value": "6b77209822f61ae48edd9c1aa5142485928a4bb650436b94fc616cdc54aa197e4023abc23ee88ce4334cf338728628e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432466, "uuid": "f320a18d-ebc9-4eb4-b959-3a04ccd7a0ab", "value": "T19B83F74AF9819F15D5D922BFFA1E018D33636768E3EF72029D105B14778A92F0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432466, "uuid": "6756d9aa-4a0c-431a-b9b2-d47b506bf6d5", "value": "1536:aRnJ6ZmylepVVFNRD5vspRHwe/0H1bqo4QLiPTsGywbGNlOyiw+1g7druM7R:3Zplq3jvuRHwe/Ihqo4QLiPTsGy60+1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432466, "uuid": "983daef5-9722-493b-a655-4b5ba5a58a0c", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432466, "uuid": "422d9274-6b02-41e0-b2a1-c17e14fc71be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432466, "uuid": "b0f1e69e-d058-43a3-bccb-2e500a0cc10a", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e073a27-e8c5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767459590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459590, "uuid": "ea23fa53-ade9-4d5f-ba8c-6c717a9a4068", "comment": "Malware payload", "value": "b27c227298c29658159ef95514bd2e5a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459590, "uuid": "924d8d1f-2048-41bf-aaf3-ca37ddd00d6f", "comment": "Malware payload", "value": "f95c858588f02b843020c817178a3ab302cc26d6ad766827503a0636f35bd7f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459590, "uuid": "589c9558-a71e-4c14-a00d-81734f5c9c69", "comment": "Malware payload", "value": "3c3067c746c6d71ce524cffe893c4e9c77ba7502", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767459590, "uuid": "cfde3964-0a7d-4740-b47e-005cfa135360", "comment": "Malware payload", "value": "1ee010278d4832c237cbc1bad58e196d45d072f074981866c6f39bf59877d6496afb0811c24e5ca6149b614fa97b291b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459590, "uuid": "fd804b6d-9ca2-4e44-b9f6-f2e0b02b3135", "value": "T1A3511BED035043793D1A4B7AA3E30A9D89068F9431556BACE5CA28675C1E48CF3FDDD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459590, "uuid": "171207b2-a40b-4b61-b394-669e32a14e49", "value": "48:YezIFuqeMI4KEecfN+aeXoNa0eUIseRIWegIWeqnIqJeqUIqm6eqPpIqPMZBnZ+Z:YecFBeH4necfN5eXoNNevseCWezWexou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767459590, "uuid": "b89eb4b2-2472-4748-84a9-6fd5043396b9", "value": 3036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767459590, "uuid": "094fe98e-200e-47b4-8e54-f1a66f18c7b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767459590, "uuid": "0165f853-51c7-4347-909b-fe5aa05bd6f5", "value": "weball.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529b68ed-e883-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767431117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431117, "uuid": "3c498220-0dd5-4c24-9b9d-8d275be93ee8", "comment": "Malware payload (Mirai)", "value": "dce946f6d1eaf04dfb49f16ebc52bb02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431117, "uuid": "1bf81c90-5a41-4ce0-b734-2b44a9a0a4a4", "comment": "Malware payload (Mirai)", "value": "f95ee9d216b037fb9446d25bfe137ac0572bdbfeaae63f96e3ef55367aa2dbca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431117, "uuid": "5c588e90-bc2a-4400-9d4f-dd3e0ea10227", "comment": "Malware payload (Mirai)", "value": "3ea164661b6ced8d01d22a0e90856184ac08eb7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767431117, "uuid": "2aa488cf-8bac-480f-8411-9286ce96f38d", "comment": "Malware payload (Mirai)", "value": "dd9be01bab1e0255fb5331f1e8f01de6068ca8773114fb3b3fed22e45e855008849b042a5eec2b44f150c799def704fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431117, "uuid": "f4f70ddf-5d29-4d2f-a281-18164003ed1f", "value": "T13A530945BC81D617C9D462BBFA5E42CC332653A8E2EF7207CD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431117, "uuid": "39dc8e13-9747-4006-bd84-0ae04170c6a2", "value": "768:k5BzSXi2bMgSf+7AVF2MlLOZLYNz0th4RyRiih3UM2J6yN+ThTm0iuM7R:6NSy2UF2eLOLwwtKR6hk7J6JeuM7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767431117, "uuid": "5b144c96-878a-4d2c-a02e-c7fc4ae3f1dd", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767431117, "uuid": "b5c5ef36-b637-49ca-a7b8-7c3b911d4dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767431117, "uuid": "0c55aaef-951b-4124-bbd5-390fbf6736d8", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeaa5fa-e8a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767444687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444687, "uuid": "dcaeb78e-00ca-4d28-9a85-59f651ba160e", "comment": "Malware payload (Mirai)", "value": "736de35330efefb8b857ff4a4391adaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444687, "uuid": "5c653e61-815e-4198-8b61-f08206728708", "comment": "Malware payload (Mirai)", "value": "f9bad2857b714d05818b7f63f4db768f517c8125dddb4209483cf7479de7aea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444687, "uuid": "064491d3-709d-45bb-a581-b90fb012f2e3", "comment": "Malware payload (Mirai)", "value": "de5321755cfafd6ec7d6a219dfc6b11fbfd54b88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767444687, "uuid": "d5e86164-99c0-439e-8a74-a2640acabaf2", "comment": "Malware payload (Mirai)", "value": "e67b4d0cd4245f657d7ed2660acd557cf7e02bbde533a72672f503fd58579ee30f5d98421e445fcf68fba9b1bb4a8010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444687, "uuid": "7ad09817-1dc0-4862-bbf1-10821abc8606", "value": "T15CF35B80F64BC4F6C807897050A7F33FEB31E4258077C65DEF9AAF32DA275429616299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444687, "uuid": "095b9ecd-530c-4181-8c27-a43abef2375d", "value": "3072:8aiLz9WjMQIyGY5QcwocM41CmpOlaCJ/GhPsYX32Yg346cxwbZnYhEE:1KKMnyG4QcwNM41CmHfH2zOxwRYhEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767444687, "uuid": "adfb03c8-efff-434f-b9ee-57d011d55236", "value": 160232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767444687, "uuid": "4facd651-16bf-4e25-a5f6-d376da0a5ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767444687, "uuid": "d626b320-d502-4a63-9d94-9b4972515b4e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88c7a1e-e89d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767442482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442482, "uuid": "b6864084-7a15-43f1-95ec-1025b6189595", "comment": "Malware payload (Mirai)", "value": "73b9259e398f918ca8e804e6a77b5a53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442482, "uuid": "17ebc324-4396-44d4-b06e-9229caa023a7", "comment": "Malware payload (Mirai)", "value": "f9cccb7264ed943351783d9aac52a8a08e2db86bf88d8e972424c8496333c36b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442482, "uuid": "68363a9f-eaa0-45b3-89c6-2907699b02cb", "comment": "Malware payload (Mirai)", "value": "b80b6ef34e83c0d03569d89092a208f29413660d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767442482, "uuid": "1be5a014-520e-4e6b-906c-5f45e7f4f138", "comment": "Malware payload (Mirai)", "value": "16a1078a5bb4e196e26a87be9b4e5a0d58a68c9282a74fc43872e88b23fbd3b9fc3796e78b5f408b7872042066621e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442482, "uuid": "8ce2202c-b8f4-424a-bca8-bdb5c9fae2ca", "value": "T141436D86E409DD3CFC4AE67BC41A0E04F5287351A6830F279766FCA39D731689C17E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442482, "uuid": "38d2d93e-86be-4966-bf8d-80631346ebec", "value": "1536:VO8yEFjMfB3DtZmTd0xKLDoJtcmqXKd6s8I6ZPm:VOFEFjMJmTdNLwtqKA7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767442482, "uuid": "77c527a2-66b2-49c9-b5ea-dc1db40d1ea5", "value": 58684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767442482, "uuid": "596d0716-2885-4163-ad07-d5a7edad545a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767442482, "uuid": "f1477617-75fe-49ce-8da3-6ae99080e349", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23375a80-e8be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767456378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456378, "uuid": "ba73f40e-fdc8-4f66-8f4c-f57f1e40dbe6", "comment": "Malware payload", "value": "0714700fb18dddc323e66f8715b92151", "object_relation": "md5", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456378, "uuid": "33fb4f6a-5379-4d5f-8186-c5ecb1cf2e83", "comment": "Malware payload", "value": "fa731f2137b6f42e340230e1a72cad9226e68b1b3eaa83323fe8c6b55537dfa3", "object_relation": "sha256", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456378, "uuid": "de397ec9-a420-49a5-beaf-af6f6969a375", "comment": "Malware payload", "value": "65b2a4824cbc1c1585d2c4ae8f8ddf346da94a2e", "object_relation": "sha1", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767456378, "uuid": "94f890f9-26bb-4f8a-b0a4-ef63175e9d62", "comment": "Malware payload", "value": "b3f8356b50f134c154bfdd7be90b06c8e15f4947d51529bf30ec314595e1d81e735ac4e2e3b931b9aa34926c8784d8a7", "object_relation": "sha3-384", "Tag": [ { "name": "BRAT", "colour": "#9366DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456378, "uuid": "c6a3fe80-9e0e-438e-a415-1686c8e916dd", "value": "T1D6374C3FB1BB828A7932715ECAD43AD6F171F23067131D8F48459C8687AAC63163FA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456378, "uuid": "2cc2a2bc-663a-4618-a452-481a8c59a942", "value": "7a193a3eefb3365f7ade83b550268c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456378, "uuid": "bd5b9b7e-8e4f-44ff-9066-816c9dd3720c", "value": "196608:4V265qgAl7ctfa0u203bvt2WDGDSWQl9EJiL9mQH+BSsIO6qD9+SOWGX:yqgAatfa0u2K3GDSz/Uq9mavsIO6qQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767456378, "uuid": "507b17b1-c843-411b-9f69-9b22fc502bf7", "value": 23554560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767456378, "uuid": "845e5d7b-26c6-4b0a-8196-6d92fa10d8a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767456378, "uuid": "486b2feb-18c3-43e4-9795-d0eade424758", "value": "xLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0c0704-e887-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432983, "uuid": "9d5644db-f1a7-46d5-88f7-e59179d896b8", "comment": "Malware payload (Mirai)", "value": "38cb2a36ecebe34999c10c4d5be04516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432983, "uuid": "09d7d9ff-ec07-4add-8a6c-6c8ecc5da16f", "comment": "Malware payload (Mirai)", "value": "faf1a2062c1e67704830d3ce16748c1ed33d7870176317449feb3db8b4ac1f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432983, "uuid": "82b3dfc3-6682-4cd2-97f9-3c7f8a000e31", "comment": "Malware payload (Mirai)", "value": "aba4c946d8bb843dff1730e5af2dda734efe2046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432983, "uuid": "75d611a5-21eb-48f2-a0d4-cd1afa495737", "comment": "Malware payload (Mirai)", "value": "9868f06333f8c7a6ef81b0ee1a6e81c5b74601ac3d6730a46eacee773ca1f4e0a074a8d97d4ea4318bc71aab1a24252e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432983, "uuid": "c6a323e8-5ddc-4480-905a-bec97384ad37", "value": "T1AAA3C81E6E218FBDF769873047B78A21975833D637E1D681E19CD6011E6038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432983, "uuid": "c6c1b666-ded6-4f66-9cc8-6dcae05cae21", "value": "1536:bin5Uj/uo2bdi05V6Y23n6dJl/O+wJTNGZGZ1e4BD8ETA:OSj/uJbBkY2KB/OvJTNGZGZAETA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432983, "uuid": "1e614ea0-0ee0-47de-96a5-86c1f2990e10", "value": 101568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432983, "uuid": "5cd7cb17-376d-4c1d-b51a-2d99b3c1e594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432983, "uuid": "b114c257-7596-4a7c-a209-27d229cc7062", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e799298-e83c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767400642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400642, "uuid": "49defe4c-f4ce-422f-9a05-11e0003315f9", "comment": "Malware payload (Mirai)", "value": "3e72cd0af47a79ab27684e6b74dd44d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400642, "uuid": "13612140-050b-43cd-9a37-674f8670aa39", "comment": "Malware payload (Mirai)", "value": "fc92edfcb1164653ef1d56f84f2c06ca9313811cd135307edfa4136ce8159938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400642, "uuid": "d1eb758e-0d13-4fa4-85a4-f2d200969b64", "comment": "Malware payload (Mirai)", "value": "74f724e03ca14e35ac5cb30449b31868e7723cdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767400642, "uuid": "82bebbf4-f442-47fa-a44a-a50e15a14239", "comment": "Malware payload (Mirai)", "value": "71540dce88adbda37eb905a5afeaab6a562ee34f229b642f5919a70a8627128f69d4aee22f70b9c704da4411c5d01c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400642, "uuid": "50db9269-2c75-4333-bdb4-ea8bd2b48caa", "value": "T18B042945BD418B11D4D632FAFA9E418D33536BA9E3FA7102DD205F6023CAA8F0F76652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400642, "uuid": "2b9ccee7-582f-4934-ba36-524b2b130d8c", "value": "3072:Uo+FGYwzq+CuU4nS6xArrJNJkPmCia+5xzfD5Z1CEkdfodNwpFD:FYwz/fjSsAxNJeDia+5xzfD5ZwBfqNwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767400642, "uuid": "503b6093-e186-4ba8-a96d-633fa6a3d723", "value": 174372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767400642, "uuid": "9081f70a-62c5-4a6c-ae40-1fe749db4b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767400642, "uuid": "a39d16c7-4424-4112-b903-b15e1c6ca6c0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69302ab7-e87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767429007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429007, "uuid": "b8f00be8-15c7-42bd-a9f7-5287ea8f5689", "comment": "Malware payload (Mirai)", "value": "0d4a1a4035070c47944244d1947d85e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429007, "uuid": "53281b0d-fd14-42f6-b080-411e24c45261", "comment": "Malware payload (Mirai)", "value": "fcff5a3aa406899ab947d468969e4c2485c8bdc8ef71f4eac15f3e85d54c79c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429007, "uuid": "3e978576-9838-42eb-a0ec-555f298039b3", "comment": "Malware payload (Mirai)", "value": "0617706af9b4f0396f19e66d90e3863aa74da37c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767429007, "uuid": "693375fa-11bd-4f20-ae69-0c46ce101cb9", "comment": "Malware payload (Mirai)", "value": "b83bcf688e9ad2448e1a2e507e713c21984b5c943c698333ec14ac74846b94a381f4b0fe41f12b10a3c7b4eb25a006e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429007, "uuid": "53288539-6125-4ece-94ee-999d1200a6d1", "value": "T110C32956B9829F01D5C735FAFB9E414933136BB8D3FA7101DD206F61238A99B0F7A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429007, "uuid": "c3515f06-4e60-49c4-9ea3-632d35408fdf", "value": "3072:EJhoO188Ir7DtaqgR/1XrfQOxBzX+zRzxZ73m:EJhoO14rftaqgR/1Xr4Ox0z1xt3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767429007, "uuid": "8e66e806-c00c-4d75-a81f-4d2104bbe24f", "value": 129252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767429007, "uuid": "ef180176-4b7f-479a-89ef-78378fd29dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767429007, "uuid": "e973f324-ab4d-4b86-9145-227d1758e595", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f725c2-e886-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432629, "uuid": "1865cb07-bcbb-4f7c-ae02-88fb9e2366f8", "comment": "Malware payload (Mirai)", "value": "53b9c4eb73578680894a2f51a0592309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432629, "uuid": "01e46ccb-59c4-43ad-b066-a5047f7756cd", "comment": "Malware payload (Mirai)", "value": "fd148805976659f36914724ec4b8614299d7bcc29bb5b0a06893dbb71ff2d8ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432629, "uuid": "3d1f87b4-708e-4fcf-8598-e73f1a2335e7", "comment": "Malware payload (Mirai)", "value": "4c5c527b03bf9b114494dd5a960c9f8aca142040", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432629, "uuid": "8557fe1a-b9aa-4b83-8f2b-a218389df9fd", "comment": "Malware payload (Mirai)", "value": "0eec26724e39afbfa2e83d2fed97e0318d59240c2b9894dadeb43249027fe1253dce5ba431551dc85a558a88a1cdd947", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432629, "uuid": "efb5c608-003e-444f-81b5-d99ac9826920", "value": "T1E893F74AFD819B25D5E822BEFA1E018D33535BA8E3EE7202DD105F15778A82B0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432629, "uuid": "f44eb8c3-9a50-43cc-8d7d-e0220e24862e", "value": "1536:RRnb2tRVZ6eoNJQzcqB8ct1sx4peHweWIZojCrHGVGQSbpPDQG3dNl+CiJ0qfFh7:OzZOJQzVB8212JHweWzjCrHmGQSbpPDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432629, "uuid": "bc8ef6ba-f06c-410a-adaf-8e9e18834d8b", "value": 91488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432629, "uuid": "f4ca34b5-9f85-4dbf-99c4-74e4cf600591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432629, "uuid": "adff0d2c-c65a-445e-a1b5-5623154a8a44", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc45ad70-e88a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767434327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434327, "uuid": "29d2ce2f-089d-4712-9d6a-cd9d751ae48f", "comment": "Malware payload (Mirai)", "value": "a2e76a38256512ab3abaac31c13561c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434327, "uuid": "e08514cd-8a12-4270-83d1-3d1d1e34ba60", "comment": "Malware payload (Mirai)", "value": "fd1902061c9147a53d20b1bb2eea79c15f201380f336036c79554d0f0387f6ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434327, "uuid": "98856ede-b8d7-474c-9596-6e30f47519b4", "comment": "Malware payload (Mirai)", "value": "cbe31692c192b1ae0cec40b2d80b34c219db6654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767434327, "uuid": "f87f2cd1-1710-4efa-9d72-c649b5ef7d8a", "comment": "Malware payload (Mirai)", "value": "8c919360cb972a88f9e352141e058fc903e82e28fbdc53b99b95f30da14fcda2f80bb9d7ab2b13d45070f7dfdbe43d96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434327, "uuid": "4c6fd3a4-1ec3-4ad7-a818-1cb0f097c9a8", "value": "T1F7833AD7F400DE7DF80AD77B44634A0AB570A3514A831F366387BD9BAD721A84827F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434327, "uuid": "89baee39-4a7a-4686-ba30-f3e337cda0ae", "value": "1536:feQ1FZad9enfp4sZDgpu8ZDLr3Y49d23NFQH7S1YYRwFKEzQ:feS0QpJZDgpN3bdGN+ARwFRzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767434327, "uuid": "d3040cc4-0f5c-4b2d-838f-6cd7f64b8596", "value": 87276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767434327, "uuid": "eb746794-da91-445e-974d-4a41bca87dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767434327, "uuid": "4d77fdb6-d9c6-443c-a2d1-b595952d32fb", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967fc34d-e8d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1767466879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466879, "uuid": "6eeac5a5-34ba-4630-b622-8f2c8d00645c", "comment": "Malware payload", "value": "9e8368ec4efe8bc49d9f3784aa36cc62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466879, "uuid": "feac0061-1ac7-4ae8-8a59-ff7a4f79324f", "comment": "Malware payload", "value": "fd9fe121bbf5830af0b5fe1c83d17a7b14304a33f25388dd3c6d6b945d7f4cb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466879, "uuid": "bec07b35-c7c0-4f6d-9984-ad6b347ae56f", "comment": "Malware payload", "value": "1a5dc6ec3e2ac664704869288e9bd9fd4c15561b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767466879, "uuid": "fbd34b13-f6b6-44a9-88fc-31751067b492", "comment": "Malware payload", "value": "65ded2c126a63d5cdab9c71a7e488ad82932289ce60a52f54b582a2196606c12a33e7f34a23859b939cdf386bdd5909e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466879, "uuid": "45f3c1f9-cae4-4c8e-884e-5b92114c4938", "value": "T1285423556BC626EAA67B7731A8460A30153CCC30602B73DF41653B61F735DA0FF2ABA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466879, "uuid": "8065eada-4292-46a6-bcde-a98fd7fad688", "value": "6144:5Fw1rdtPOJ/sxYmc7Fx21AGuprZf/p8ORrxIzSiLJfoj8rUKlgBtr3Tt:5EPOJnGunBazvRrJS/r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767466879, "uuid": "92f28550-bba5-47b1-9132-f071d5ce7f30", "value": 306491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767466879, "uuid": "1e97110a-0bb1-4a85-b2e0-8e152f9668da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767466879, "uuid": "fc77db12-2275-488c-af36-7d4eb5214a6c", "value": "bizy.mpsls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4895f32-e885-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767432167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432167, "uuid": "79bd1fb1-15c5-4600-a58c-b8be22d04e38", "comment": "Malware payload (Mirai)", "value": "e1fb1a59be464d6150f1123a637b8c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432167, "uuid": "b52c41fd-86e5-41c7-a298-cf0db2e70cc4", "comment": "Malware payload (Mirai)", "value": "fd9fe1dd0a7bbcaadbce5d02d5891adcf16580be8e51b2c7c28951d7ecfa84e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432167, "uuid": "d035f45c-93ee-4488-a015-e2c9e268ef1f", "comment": "Malware payload (Mirai)", "value": "cdd823272db648fac1e99684a435a5b8c3645f06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767432167, "uuid": "b6991d86-4d5c-40f0-9904-2c9d508c8388", "comment": "Malware payload (Mirai)", "value": "90d0407a68d0024184d3aafa8e3e03eabcf5ba4891bd0ea25563ab027500c558a1c6702e05c47d1b19f96bf3824afafd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432167, "uuid": "ff360197-2173-4f26-a105-4c69ae3434a4", "value": "T1FA137C238679DE69F22D96B575348B794B53E211E38B2FF62609D5248043E8CF64E3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432167, "uuid": "e405eb3d-53a1-4d0f-a3b5-f829cea9be7f", "value": "768:EzwWOJdo9Krd2DpvDRejam6aZFIdECPtjULCPO5Rgoq9eC0bu+7R:EzwWt92dwrR5FdjPlULf5RP6eC0bu+7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767432167, "uuid": "b3d8431b-11ea-4e7b-8f56-4ee6f17d87e2", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767432167, "uuid": "40e44ba2-2a1a-484a-8895-c173740b99ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767432167, "uuid": "07bcf2c0-e26e-4493-a9a0-6471df3e00d7", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f967a7c-e8a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767446278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "f789029c-25a1-4dd3-a10c-cf7fbe05ddfd", "comment": "Malware payload (Mirai)", "value": "425fc162b482d96bf679b41141043a73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "d80ef7f2-bf39-4a08-bd8f-25bd1a851da2", "comment": "Malware payload (Mirai)", "value": "fe5dd9afa5befc245dc433f517de494649d8c5760286609e0fe10a90a833ecf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "f85cc087-fb65-4f0b-b7b1-62c4c15c8c85", "comment": "Malware payload (Mirai)", "value": "3537ae5289c7975ee99b910a224b8f834af15b2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767446278, "uuid": "5df3c6a3-b5b1-4a75-893e-a7c148819eab", "comment": "Malware payload (Mirai)", "value": "40d6142226454af9b6cd8da3279b31a72f5dbdd2824fd8d935f1bbd6c1a6dd4af60c81a4521a33922971998d84dbd720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "3fe39afb-da95-4f75-8b47-c6a97bc05d75", "value": "T1FB534CD6B400EE3DFC4BE67AC0124B05F524334566530F2BB76BFC936D721588969E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "3d40e2e8-6209-4978-b2f0-e694fa8942f0", "value": "1536:Fo3+A4xnm5tFQIujoUvcrrLYvPJWHAM9A8/bDPO:Fo3+X8QIujjc7YvcAKxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767446278, "uuid": "c3a54b65-8846-4db4-bee0-e40de6f81106", "value": 64128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767446278, "uuid": "dc582bba-d209-42c0-ac10-29b6b4f9399b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767446278, "uuid": "774b8c86-dd24-4654-807f-e8dc9e5008e0", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a1bec5-e839-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1767399205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399205, "uuid": "8adf7749-c100-4ef1-b7f5-214d8ef1740f", "comment": "Malware payload (Mirai)", "value": "2c57095ed4ebf76fa6895387003a6b68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399205, "uuid": "535e4e6c-7532-428d-8256-7a37232e4cb3", "comment": "Malware payload (Mirai)", "value": "ff74054c1bc45cba4b962f7b2ac85219baa7165dd580ba0b6356a64daf8f8f8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399205, "uuid": "cfbe8246-cc5d-44b5-a5da-21da037c95be", "comment": "Malware payload (Mirai)", "value": "31d64f172505911e3873b6b2324a1b3393eea000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1767399205, "uuid": "c5c601f7-4d76-4831-b4fa-2b4c8d368958", "comment": "Malware payload (Mirai)", "value": "4a127bff8914ee1505f339bf93ca0b58e696bb7f8f141a6460718a0d0ba9465fc3a599f564056ffa2b435cdf5f31a5e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399205, "uuid": "22b0bbee-c672-4370-9b74-4a2efee8e8c0", "value": "T15DE36CC6F643D0F5E91205712077EB368A76E13A202FEA47C7BD9A36EC52941C9173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399205, "uuid": "211a51fb-3052-4c9e-8f98-d134ab180765", "value": "3072:lZo4pNKeAgfiDxLg89/4uT3IvqRyGL/11JtGFZ3dNWkXd6pd3a:noGNKeAgau89/k6yGS37zApl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1767399205, "uuid": "64d73a5a-1b62-4a98-8cf8-83b66ac6897b", "value": 147432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1767399205, "uuid": "45ceea2d-f6e4-4bcb-8a90-97de1a42ec82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1767399205, "uuid": "294c2ea3-2008-4014-9cbd-0143ba205dc7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }